Your servers get patched while you sleep.
Shepard watches your stack for new vulnerabilities, installs the fixes and restarts services outside your working hours. You read a short log in the morning.
| 22:14 | scan | 3 hosts, 412 packages | |
| 22:14 | found | openssl, high severity | |
| 22:15 | found | nginx, medium severity | |
| 01:00 | window | quiet hours open | |
| 01:02 | patch | openssl 3.0.13 → 3.0.15 | ok |
| 01:03 | patch | nginx 1.24.0 → 1.26.2 | ok |
| 01:05 | restart | web-01, back in 38 s | ok |
| 01:06 | check | health endpoints 3/3 | ok |
| 05:00 | window | closed, nothing left open |
How it works
Set it up once. After that the work happens at night.
-
Connect your servers
Install a small agent on each machine. It reports what is installed and which versions are running.
-
Pick your quiet hours
Tell us when nobody is working. Patches and restarts only happen inside that window.
-
Read the morning log
Every scan, patch and restart is written down. If something needs your decision, it is at the top.
What we watch
Scanners tell you what is wrong. Shepard also fixes it.
New high-risk advisories now land almost daily. Reading them is a job. Applying them at 1 a.m. is a worse one.
- System packages
- Kernel, OpenSSL, SSH and the rest of the base system on your Linux servers.
- Web and data services
- Web servers, databases and caches, restarted in the right order.
- Runtimes
- Language runtimes and the dependencies your applications ship with.
- Restarts
- Services and reboots scheduled for your quiet hours, with a health check after each.
Pricing
€2per server, per day
- Continuous vulnerability scanning
- Automatic patching in your quiet hours
- Morning log by email
- No contract. Stop any day.
About the price of a coffee. And you only pay for quiet days: a day with a security incident on a server we watch is a day we do not charge for.
Before you start, we run a free Datenschutz and exposure check on your setup and send you what we find. Keep the report whether you sign up or not.
Questions
What people ask before handing over the keys
What access does Shepard need?
The agent needs permission to install package updates and restart services on the machine it runs on. It does not read your application data.
What if a patch breaks something?
Each restart is followed by a health check. If a service does not come back, we stop, leave the remaining patches untouched and alert you right away.
Can I approve patches myself?
Yes. You can let everything go through automatically, or hold back chosen packages until you approve them.
How does billing work?
You pay €2 per server for each day of watch. There is no minimum term, and you can stop from your account on any day.
Book a call
Twenty minutes on your setup, with a straight answer.
Pick a free slot. We call you, go through your servers and tell you what we would patch first. Times are Berlin time.
Be among the first servers on watch.
We are onboarding a small first group. Leave your email and we will write when a place opens. Add a server and we check it for free first.