What's new 
Keeping Macs secure often means racing to deploy Apple’s latest updates the moment they drop. But bleeding-edge minor updates can just as easily introduce day-one bugs, break compatibility with business-critical apps, and flood your helpdesk with tickets — long before you’ve had a chance to validate them.
Until now, the only way around this was manual: tracking Apple’s release cadence, holding back updates by hand, and hoping nothing slips through the cracks. That doesn’t scale across a fleet.
With this release, you can now define patching strategies during auto-patch deployment that target the N-1 (or N-2) OS versions, giving your macOS devices a vetted, stable baseline instead of the latest untested release.
What’s New
When configuring an Auto Patch automation for deploying patches and updates for macOS devices, you can now choose from two patching strategies:
-
All Applicable Patches: Deploys the latest available update along with any older missing updates — the standard approach for keeping devices on the newest OS version.
-
Superseded Only: Deploys superseded updates instead of the latest release, giving you control over exactly how far behind the fleet stays and under what conditions it should catch up.
Stay in Control, Without Staying Exposed
Superseded Only gives you a few ways to define exactly how far behind the fleet should stay:
-
N-1 holds devices on the version immediately preceding the latest release
-
N-2 holds devices two versions behind the latest release
-
Advanced Control lets you define a custom target using a regex pattern, test it before it goes live, and choose whether the highest or lowest matching version gets deployed when more than one qualifies
And to make sure holding back doesn’t turn into an open-ended risk, you can set a vulnerability threshold, allow patches for actively exploited vulnerabilities to jump the queue regardless of your target, and define a force-update window so devices are never left behind indefinitely.
Why It Matters
-
Fewer surprises: Avoid day-one bugs and compatibility issues from bleeding-edge releases
-
Less manual effort: Automate what used to be a manual, fleet-wide tracking exercise
-
Security without recklessness: Stay on a known-good baseline while still catching critical, actively exploited vulnerabilities as they arise
Head to your Hexnode UEM portal to configure the patch deployment strategy for your macOS devices.
12 Views
