Patch Management.
Vulnerability Detection.
Compliance Automation.
TridentStack Control
One platform for OS updates across Windows, macOS, and Linux, plus application patches, CVE scanning, and security compliance. One agent, one price, every feature included.
Manage every client from one account
- Each client gets its own isolated Organization
- One sign-in, switch clients from one console
- Limit each technician to the clients they look after
Patch. Detect. Comply. Control.
OS updates, application patches, vulnerability scanning, and compliance tracking for your entire fleet, in one platform.
Patch Management
Unified update management with intelligent applicability filtering, approval workflows, and phased deployments.
- Intelligent applicability filtering per endpoint
- Supersedence tracking and automatic cleanup
- Deployment rings for phased rollouts
- Pre-staging for scheduled deployments
- CVE enrichment and security metadata
Sample data
3rd Party Application Updates
Unified management of third-party applications with package manager integration, version targeting, and custom packages for your own installers.
- Comprehensive application catalog
- Custom packages: deploy your own installers, security-scanned on upload
- Silent deployment with progress tracking
- Version targeting and pinning
- Configuration profiles per endpoint group
- Application inventory and compliance
Sample data
Vulnerability Detection
Automatic CVE detection across your fleet with severity-based prioritization and compliance tracking.
- Automatic CVE detection across your fleet
- CVSS scoring and severity prioritization
- DISA STIG and Microsoft Security Baseline compliance frameworks
- Exception management with expiration
- Fleet-wide vulnerability dashboard
Sample data
Network Exposure Monitoring
Real-time visibility into listening ports, firewall state, and network attack surface across your endpoints.
- Listening port discovery with service identification
- Risk assessment based on port, exposure, and process
- Firewall state correlation per port
- Process verification with digital signature checks
- Port change history and timeline tracking
Sample data
Policy Management
Deploy configuration policies directly to endpoints through the agent. No domain dependency required.
- Extensive policy settings catalog
- Web-based configuration UI
- Works without Active Directory
- Policy versioning and rollback
- Enforcement verification and compliance
Sample data
Compliance Framework Management
Continuously evaluate your fleet against industry-standard security baselines. Track compliance scores, identify gaps, and get actionable remediation guidance.
- DISA STIGs for Windows, macOS, Ubuntu LTS and RHEL
- Microsoft Security Baselines
- STIG results mapped to NIST 800-53
- Automated baseline sync from authoritative sources
- Control-level exemption management with audit trails
Sample data
Frequently asked questions
- Log 01Log 01
What operating systems does TridentStack Control support?
TridentStack Control supports Windows 10, Windows 11, and Windows Server 2012 R2 through Windows Server 2025 on the Windows side. The macOS agent supports macOS 14 (Sonoma) and later on both Apple Silicon and Intel Macs. The Linux agent supports Ubuntu 20.04+, Debian 12+, RHEL 8+, CentOS Stream 8+, Rocky Linux 8+, AlmaLinux 8+, Fedora, and Amazon Linux 2+, with native apt and dnf/yum integration.
- Log 02Log 02
Does TridentStack Control replace WSUS or Intune?
Yes. TridentStack Control replaces WSUS for native Windows update delivery and replaces Intune for patch management, vulnerability detection, compliance baselines, and policy management. It also covers Linux patching and third-party application updates in the same product, which neither WSUS nor Intune address natively.
- Log 03Log 03
Does TridentStack Control require Active Directory?
No. TridentStack Control was designed to deliver policy management without Active Directory. The agent can be deployed to domain-joined or workgroup endpoints, and policies are enforced through the agent regardless of directory state.
- Log 04Log 04
How does TridentStack Control detect vulnerabilities?
The agent reports a full software inventory including registry-installed applications, package manager state, and OS update history. TridentStack Control matches that inventory against an enriched CVE catalog with CVSS scoring, applies severity prioritization, and surfaces a fleet-wide vulnerability dashboard with exception management and expiration.
- Log 05Log 05
What compliance frameworks does TridentStack Control support?
TridentStack Control ships compliance baselines for DISA STIGs across Windows (10, 11, Server 2016 through 2025, Edge, and Defender Firewall), macOS, and Linux (Ubuntu 20.04, 22.04 and 24.04 LTS, and RHEL 8 and 9), plus Microsoft Security Baselines for Windows. Each baseline produces an automated score with trend tracking and per-control evidence, and STIG results are mapped to NIST 800-53 through the CCI references the STIG content carries.
- Log 06Log 06
Can I deploy my own custom application packages?
Yes. The Package Catalog accepts your own installers: MSI and EXE on Windows, PKG and DMG on macOS, DEB and RPM on Linux. Each package holds multiple versions with their own install arguments, success exit codes, timeouts, and install detection, and every uploaded installer is security-scanned before it can be deployed. Custom packages deploy on demand to selected endpoints on all three platforms, and Windows and macOS packages can also ride the same application update policies and deployment rings as catalog applications.
- Log 07Log 07
How do deployment rings work in TridentStack Control?
Deployment rings allow phased rollout of approved updates. Updates progress through canary, expanding, and complete phases with configurable cohort sizes and auto-promotion criteria. Each ring has its own reboot policy, service-restart behavior, and Linux kernel-update handling so rollouts can be paced safely.
- Log 08Log 08
How much does TridentStack Control cost?
Every tenant gets 200 endpoints free forever. Beyond that, TridentStack Control is $5 per endpoint per month with all features included. There are no feature tiers and no enterprise sales gate. Annual billing saves about two months. Fleets of 1,000 or more endpoints get custom pricing.
- Log 09Log 09
Is TridentStack Control multi-tenant for MSPs?
Yes. Turn on Organizations in Settings and each client you manage gets its own isolated Organization, with its own endpoints, policies, and enrollment token. Your technicians sign in once and switch between clients from one console, and you can limit a technician to the clients they look after. The setup guide is at docs.tridentstack.com/administration/organizations.
How does TridentStack Control compare?
Honest, side-by-side comparisons against the platforms TridentStack Control replaces.
Ready to Take Control?
200 endpoints free forever. No credit card required. Deploy your first agent in under 5 minutes.