Patchmageddon

JVM Discovery & Estate Assessment

Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.

The problem

Most enterprises can't produce an accurate, current list of the Java runtimes they run. The CMDB records some. Config management records others. The rest are shadow JVMs: runtimes bundled inside vendor products, application servers, CI/CD agents, monitoring tools, desktop software and container images that nobody thinks of as "Java".

Shadow JVMs are the ones that miss every patch cycle. For Oracle Java, they are also the installs that can put your entire headcount in scope for a subscription.

What we find

For every JVM across dev, staging and production we capture:

  • Version, vendor and patch level: Oracle JDK, Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat, Microsoft, IBM Semeru and others
  • Where it is embedded: standalone apps, Tomcat, WebLogic, WebSphere, JBoss/WildFly, vendor products, containers
  • CVE exposure, mapped to each version and scored so the worst exposure rises to the top
  • Installed agents: APM, security and profiling agents, which cause many patch failures
  • Ownership: who actually runs each application. This is often the hardest part to get right.
  • Criticality signals that feed application classification

How we do it

Discovery is read-only. Nothing is patched, restarted or deployed, so the engagement doesn't need change-control approval, and the access we ask for is kept to a minimum.
  • Agentless scanning over SSH and WinRM (process listings and filesystem inspection) where possible
  • Reconciliation against your CMDB and config management (Ansible, Puppet, Chef). The drift between what is recorded and what is running is a finding in its own right.
  • Cloud provider APIs (AWS, Azure, GCP) for instance and container metadata
  • Container image and artifact repository scanning (registries, Nexus, Artifactory) to catch JVMs before they are even running
  • Reuse of the scanners you already own. Tenable, Qualys, Snyk and JFrog Xray already collect useful data. We add the JVM-specific interpretation and a remediation plan; we don't sell you another scanner.

Three ways to engage

PackageScopeTurnaroundPurpose
Quick ScanOne business unit or subset of the estateDaysProve what a full assessment will find
Full Estate AssessmentThe whole estate2–4 weeksComplete inventory, risk report and remediation plan
Continuous Drift MonitoringOngoingSubscriptionKeep the inventory, risk and license picture current

What you walk away with

The executive summary puts the findings in business terms: unbudgeted license exposure, days of exposure on unpatched critical CVEs, and the percentage of the estate on end-of-life versions. It ends with a direct recommendation of which applications belong in Rapid Patch, which need Critical Patch Assurance, and which Oracle installs to migrate or keep.

Further reading

JVM Discovery & Inventory

You can't patch what you can't find: building a real JVM inventory

Most enterprises can't say how many JVMs they run or where. Here's what a useful JVM inventory captures, how to collect it, and where it goes wrong.
6 min read

Oracle Java Licensing & OpenJDK Migration

Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.