"Automation is not the same as acceleration," writes Gene Moody, Field CTO at Action1.
Gene Moody's core argument: speed without brakes creates risk
Moody lays out a straightforward dilemma: the pace of software change is accelerating while the time IT teams have to evaluate those changes is not. New vulnerabilities are disclosed every day and vendors release fixes on their own schedules, yet teams face limited staff, competing priorities, and increasingly complex environments. The predictable result, he says, is a growing backlog that compresses testing and pushes updates directly into production. "Automation can produce failure at least as quickly as success," Moody warns — if automation is measured only by speed.
Update Rings and staged deployment as the brakes
Moody proposes a simple control mechanism: staged deployment, or "update rings." Rather than a binary deploy-or-not choice, organizations create a progression of increasingly larger groups and govern movement through predefined criteria. He points to Action1's features — "Update Rings for sequential endpoint deployment, with criteria that determine whether an update moves forward or stops," plus manual approval workflows and endpoint groups — as an example of how platforms can combine acceleration with automatic braking.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleControlled production deployment: start small and define success
The article rejects the notion that a test lab alone can validate every environment. Moody argues for "controlled production deployment" as part of validation: start with IT staff, a representative collection of endpoints, or systems that mirror complicated configurations. Success must be defined up front. Did the update apply successfully? Did endpoints remain healthy? Did applications continue functioning? Did failure rates stay within an acceptable threshold? Only when those conditions are met, Moody writes, should the update move to a larger group.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Automate decisions you can define and keep humans in the loop where judgment matters. Moody counsels that "anything you do the same way more than twice is just wasted time," and that automation should stop problematic updates and let proven ones progress without manual intervention.
- Procurement and IT leaders: Look for platforms that support staged deployments, manual approvals, and flexible endpoint grouping. Moody highlights Action1's model and notes an entry-level offer — "Action1 for up to 200 endpoints free forever" — as a means to pilot the approach before scaling.
- End users and operators of business-critical systems: Treat domain controllers, production databases, ERP systems, and similar workloads differently. Moody emphasizes these systems may "deserve different treatment from a standard employee workstation," implying focused safeguards and human oversight where the consequences justify it.
The efficiency dividend and practical prescription
Beyond safety, Moody argues the principal benefit is time. By establishing groups and success criteria once, administrators avoid repeating routine steps. The result is not elimination of oversight but "reduc[ing] unnecessary intervention." The practical prescription: test where it provides value, start small, define success, let proven updates progress, and stop problematic ones. "The goal is not to eliminate human judgment so much as to use it where it matters," he writes.
Action1 is presented throughout as a tool to implement this model, offering Update Rings, predefined deployment criteria, and manual approvals, and inviting teams to "Start with 200 endpoints free forever and scale when you're ready."
Moody's closing counsel is direct: "The practical answer is controlled automation: make it work consistently, then work to make it faster." For organizations wrestling with growing update volumes and constrained teams, that prescription frames a clear operational choice — accelerate deployments where safe, and build deliberate brakes where they are not.
