# US 12,602,223 B1 · Dynamic patch management system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,223 B1 - Document ID: US12602223B1 - Status: Granted - Kind: B1 - Application number: 19/411,591 - Filed: 2025-12-08 - Granted: 2026-04-14 - Earliest claimed: 2025-12-08 - Applicants: NinjaOne, LLC - Inventors: Rahul Hari Hirani; Peter Bretton; Joel Carusone - Web page: https://patentgrep.com/patent/US12602223B1 ## CPC - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 8/60: Software deployment - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are disclosed for managing deployment of software patches across a plurality of client devices. A patch management server acquires vendor-supplied patch data, community-sourced patch data, and/or platform-based data, and evaluates the information using weighting logic that may be implemented by a machine-learning model trained on historical patch outcomes. Based on the weighted evaluation, the system generates a bounded risk representation indicating a likelihood that installation of the patch will have a particular effect on one or more client devices. The server selects a deployment action in accordance with the bounded risk representation and may generate and update deployment rings defining the order in which devices receive the patch. Deployment rings may be dynamically recalculated in response to updated data or anomaly conditions, and post-deployment monitoring may trigger rollback actions when thresholds are satisfied. ## Claims ### Claim 1 A computer-implemented method for managing deployment of a software patch to a plurality of client devices, comprising: receiving, by a patch management server, vendor-supplied patch data associated with the software patch; receiving, by the patch management server, community-sourced patch data originating from one or more sources other than a patch vendor or the patch management server; receiving, by the patch management server, platform-based data originating from one or more of the client devices; applying a weighting procedure to at least a portion of the vendor-supplied patch data, the community-sourced patch data, and the platform-based data to generate a weighted evaluation of the software patch; generating, by the patch management server and based on the weighted evaluation, a bounded risk representation indicative of a likelihood that installation of the software patch will adversely affect at least one of the client devices; selecting, by the patch management server and based on the bounded risk representation, a deployment action for the software patch, the deployment action comprising at least one of: deploying the software patch to at least a first subset of the client devices; deferring deployment of the software patch; withholding deployment of the software patch; or generating a notification to a technician computer system; and executing, by the patch management server, the deployment action. ### Claim 2 (depends on 1) The method of claim 1, wherein receiving the community-sourced patch data comprises accessing, via a computer network, one or more public internet forums and collecting data associated with the software patch. ### Claim 3 (depends on 1) The method of claim 1, wherein receiving the platform-based data comprises collecting telemetry or performance data from one or more client devices via a computer network. ### Claim 4 (depends on 1) The method of claim 1, wherein receiving the vendor-supplied patch data comprises accessing, via a computer network, a vendor distribution service to retrieve patch information associated with the software patch. ### Claim 5 (depends on 1) The method of claim 1, wherein generating the bounded risk representation comprises applying one or more threshold values to weighted evaluation of the software patch to map the weighted evaluation of the software patch directly to one of a plurality of bounded risk representations. ### Claim 6 (depends on 1) The method of claim 1, wherein applying the weighting procedure comprises evaluating community-sourced patch data based on at least one of: a credibility score associated with a reporting source, a volume of reports referencing the software patch, a relevance of the reported issues to one or more configurations of the client devices, or a consistency of the reported issues across independent sources. ### Claim 7 (depends on 1) The method of claim 1, wherein the bounded risk representation is generated on a per-device basis, on a per-group basis for a subset of the client devices, or globally for the plurality of client devices. ### Claim 8 (depends on 1) The method of claim 1, wherein the weighting procedure is at least partially performed by a machine-learning model trained using historical vendor-supplied patch data, community-sourced patch data, and platform-based data together with historical deployment outcomes. ### Claim 9 (depends on 1) The method of claim 1, further comprising: generating, by the patch management server and based at least in part on the bounded risk representation and device classification information, a plurality of deployment rings defining different subsets of the client devices and an order in which the software patch is to be deployed to the different subsets; and deploying the software patch to the plurality of deployment rings in accordance with the order. ### Claim 10 (depends on 9) The method of claim 9, further comprising dynamically recalculating, by the patch management server, at least one of the plurality of deployment rings in response to updated platform-based data indicating at least one of performance degradation, anomaly rates satisfying a threshold, or stability across one or more of the deployment rings. ### Claim 11 (depends on 1) The method of claim 1, further comprising: monitoring, by the patch management server, post-deployment platform-based data for the client devices; and initiating, by the patch management server, a rollback of the software patch on at least a subset of the client devices when one or more anomaly metrics satisfy a predefined threshold. ### Claim 12 A system for managing deployment of a software patch, comprising: one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the system to: acquire vendor-supplied patch data associated with the software patch; acquire platform-based data comprising telemetry or performance data collected from one or more client devices via a computer network; acquire community-sourced patch data originating from one or more external sources of data other than a patch vendor or a patch management platform; process at least a portion of the vendor-supplied patch data, the community-sourced patch data, and the platform-based data using a machine-learning model trained on historical patch data and historical deployment outcomes; generate, by the machine-learning model, a bounded risk representation indicative of a likelihood that installation of the software patch will adversely affect at least one client device; select, based on the bounded risk representation, a deployment action comprising at least one of: deploying the software patch to at least a first subset of the client devices; deferring deployment of the software patch; withholding deployment of the software patch; or generating a notification to a technician computer system; and cause execution of the deployment action on the one or more client devices. ### Claim 13 (depends on 12) The system of claim 12, wherein acquiring the community-sourced patch data comprises accessing, via a computer network, one or more public internet forums and collecting data associated with the software patch. ### Claim 14 (depends on 12) The system of claim 12, wherein acquiring the platform-based data comprises collecting telemetry or performance data from one or more client devices via a computer network. ### Claim 15 (depends on 12) The system of claim 12, wherein acquiring the vendor-supplied patch data comprises accessing, via a computer network, a vendor distribution service to retrieve patch information associated with the software patch. ### Claim 16 (depends on 12) The system of claim 12, wherein generating the bounded risk representation comprises applying one or more threshold values to a weighted evaluation of the software patch to map the weighted evaluation directly to one of a plurality of bounded risk representations. ### Claim 17 (depends on 12) The system of claim 12, wherein processing the community-sourced patch data using the machine-learning model comprises evaluating the community-sourced patch data based on at least one of: a credibility score associated with a reporting source, a volume of reports referencing the software patch, a relevance of the reported issues to one or more configurations of the client devices, or a consistency of the reported issues across independent sources. ### Claim 18 (depends on 12) The system of claim 12, further comprising instructions that, when executed, cause the system to: generate, based at least in part on the bounded risk representation and device classification information, a plurality of deployment rings defining different subsets of the client devices and an order in which the software patch is to be deployed to the different subsets; deploy the software patch to the plurality of deployment rings in accordance with the order; and dynamically recalculate at least one of the plurality of deployment rings in response to updated platform-based data indicating at least one of performance degradation, anomaly rates satisfying a threshold, or stability across one or more of the deployment rings. ### Claim 19 (depends on 12) The system of claim 12, further comprising instructions that, when executed, cause the system to: monitor post-deployment platform-based data for the client devices; and initiate a rollback of the software patch on at least a subset of the client devices when one or more anomaly metrics satisfy a predefined threshold. ### Claim 20 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a patch management system, cause the processors to: acquire vendor-supplied patch data associated with a software patch; acquire platform-based data comprising telemetry or performance data collected from one or more client devices via a computer network; acquire community-sourced patch data originating from one or more external sources of data other than a patch vendor or a patch management platform; process at least a portion of the vendor-supplied patch data, the community-sourced patch data, and the platform-based data using a machine-learning model trained on historical patch data and historical deployment outcomes, the processing comprising generating, by the machine-learning model, a bounded risk representation indicative of a likelihood that installation of the software patch will adversely affect at least one client device; generate, based at least in part on the bounded risk representation and device-classification information, a plurality of deployment rings defining different subsets of the client devices and an order in which the software patch is to be deployed to the different subsets; dynamically recalculate at least one of the plurality of deployment rings in response to updated platform-based data indicating at least one of performance degradation, anomaly rates satisfying a threshold, or stability across one or more of the deployment rings; select a deployment action for the software patch based on at least one of the bounded risk representation, the plurality of deployment rings, or the recalculated deployment rings, the deployment action comprising at least one of: deploying the software patch to one or more of the plurality of deployment rings; deferring deployment to at least one of the plurality of deployment rings; or withholding deployment to one or more of the plurality of deployment rings; and cause execution of the selected deployment action on the client devices.