Questions and Answers

AutoPackager keeps the applications on your Intune-managed devices on a tested, current version. It watches for new versions every day, builds the Intune package, test-installs it on your own build machine, waits for your approval, and rolls it out ring by ring. Every update shows which known vulnerabilities it closes.

Outdated applications are a known attack surface. AutoPackager keeps them current.

No. AutoPackager does not scan devices and does not detect attacks. It reads the application versions that Intune already reports and matches them against public vulnerability data from the US National Vulnerability Database (NVD). When it shows no known vulnerability for an application, that is not a guarantee that there is none.

No. AutoPackager publishes to Microsoft Intune and needs it. Windows Update and Autopatch stay in place for the operating system. A Windows package can also be downloaded as an .intunewin file.

Windows and macOS applications on Intune-managed devices. Windows applications are published as Win32 apps (.intunewin) or MSIX. macOS applications are published to Intune as PKG or DMG packages. The operating system itself is not in scope: Windows Update, Autopatch and Apple's updates stay as they are.

Patch My PC is a catalog of prepackaged applications with per-device pricing. It covers the popular titles well. AutoPackager is a packaging and rollout pipeline. The main differences:

• Any installer. Upload an MSI, EXE, MSIX, PKG or DMG, or paste a download link. AutoPackager finds the silent switches and the detection rule. Hard installers go through Heisenberg mode, which uses AI, PSADT and screen recognition and asks you when it needs an answer. An installer with no silent switch can be installed by hand on your build machine, recorded, and replayed on the device.
• A test install. Every Windows package is installed, detected and uninstalled on your own build machine before it is published. A package that fails its test is never published.
• Rings with an automatic stop. Ring 0 first, then 10, 30, 60 and 100 % of devices. When more than 20 % of finished installs fail, the rollout stops and rolls back by itself.
• Known vulnerabilities on every update card, with every plan.
• Drivers in the same pipeline. Dell, HP and Lenovo drivers and printer drivers use the same rings and the same approval as applications.
• Price per working package, not per device.

If every application you manage is in that catalog, a catalog tool is enough. Check which of your applications are not in it.

WinGet is a public package source. Intune Enterprise App Management, part of Microsoft 365 E5 since July 2026, is Microsoft's catalog of prepackaged applications. Neither of them packages your own applications or niche applications. Neither test-installs a package on your machine before it reaches a device. AutoPackager uses WinGet as one of its version sources. A WinGet deployment inside AutoPackager has no test install.

Two points decide this: what your tool does with applications outside its catalog, and how it rolls out updates. AutoPackager packages any installer, tests it, and rolls it out in rings that stop by themselves. It changes only the applications it built, so it can run next to your existing tool.

On Windows: MSI, EXE and MSIX, by upload or download link. Six installer families have a standard silent switch: MSI, Inno Setup, NSIS, WiX Burn, Microsoft bootstrapper and Advanced Installer. Per-user applications are packaged and tested as a standard user. On macOS: PKG and DMG.

Drivers: Dell, HP and Lenovo driver updates from the vendor catalogs, and printer drivers from a ZIP or the vendor's installer. The shared catalog has more than 130 ready recipes.

Yes, in Heisenberg mode. You install the application by hand on your build machine. AutoPackager records the files, registry keys and shortcuts that the install adds. It then builds a package that writes the same files, registry keys and shortcuts on the device. The installer itself does not run on the device. The recorded package goes through the same test as every other package: install, detect, uninstall.

Services and drivers that the install adds are recorded too, and the package installs them on the device. Changes in the user profile are applied for each user who signs in to the device.

No. Unattended mode tries up to three known recipes without AI. AI helps only when they fail. Every package still needs its test install, and an update job started by the daily version check always waits for a person's approval before it is published.

The package is installed, detected and uninstalled on your own build machine. All three steps must pass. A package that fails is never published, and the job shows what failed.

An update goes to Ring 0 first: your test devices or a small group. The next ring opens only after a gate: at least 2 business hours in the ring, enough finished installs, and 90 % success. You can also require an approval before the next ring. With 100 or more devices the rings are Ring 0, 10 %, 30 %, 60 %, 100 %. Fewer devices get fewer steps.

An admin can skip the rings and roll an update out to all devices at once. AutoPackager never skips a ring by itself.

When more than 20 % of finished installs fail, after at least 5 have finished, the rollout stops and rolls back to the previous version by itself. The check runs every 15 minutes.

It depends on the installer. One real example from 25 October 2026, TreeSize Free: about 4 minutes from start to published. This is one example. Other installers take longer.

Every day: the publisher's release feed, the WinGet catalog, the fixing version named in NVD, and an AI version check. A version from the AI check is marked when its source is not confirmed.

An app registration in your own Microsoft Entra ID, which you own, with 5 Microsoft Graph permissions. Each permission is listed in the console with the reason it is needed. The client secret is stored encrypted (AES-256-GCM) and never shown again. AutoPackager changes only the applications it built. Hand-made Intune assignments are kept.

A Windows 11 VM or PC that you provide. It connects outward only, on HTTPS port 443. Nothing connects in. You download the agent and enroll it with a one-time key.

In the EU by default, on Google Cloud in europe-west4 (Netherlands). If your data must stay in the United States, we also run an instance in the US East region. Package files are deleted after 30 days by default and after 90 days at the latest. The Help Center page "Security and data" lists what is stored, where, and for how long.

SOC 2 certification is in progress. We expect it to be complete soon. There is no ISO 27001 certificate today.

From public sources (NVD), matched against the application versions Intune reports. For each application you see the CVE numbers, the severity as the source publishes it, the CISA known-exploited date, and the version that fixes it. Each update card says how many known vulnerabilities it closes. It covers the applications AutoPackager knows, not the operating system.

Yes, with every package and every plan.

It supports the vulnerability-handling and patch-management controls: NIS2 (section 30 (2) no. 5 BSIG), ISO 27001 Annex A 8.8 and A 8.32, DORA Delegated Regulation 2024/1774 Article 10, and BSI IT-Grundschutz OPS.1.1.3. The audit log shows who approved what and when, and it exports to CSV. A Read-only Auditor role sees everything and changes nothing. AutoPackager supports the control. It does not make a company compliant.

On request we provide evidence for regulators and auditors: the record of each package's install, detection and uninstall test on the build machine, and the approval and rollout history of each version.

Yes. AutoPackager is multi-tenant. One team manages packaging for many client tenants from one console. Each client keeps its own rings, approvals and audit log. A recipe in the shared catalog serves every client; a recipe from an untrusted workspace must first pass a validation run on a clean machine.

You pay per package, not per device. There are two prices. A standard package is an installer with a silent switch. A smart package is built in Heisenberg mode: a hard installer, a recorded install, a per-user installation, an answer file or custom steps built by the agent. The smart package has the higher price.

You pay only for a package that AutoPackager builds, tests and publishes successfully. A failed build costs nothing. There is no fee per tenant. The known-vulnerabilities view is included with every package. We send an offer after a 30-minute call.

English, German and Czech.