Endpoint update coverage describes how far your updates actually reach: which endpoints run current versions of their applications, drivers and operating system, and which do not. IT teams usually already own the data behind it, because the endpoint inventory records what every machine runs. What they rarely own is a routine that turns that inventory into a short list of machines to fix this week.
An inventory answers the question “what do we have?”. Update coverage answers a different one: “where do our updates not reach?”. The second question decides your exposure, and answering it means reading the same inventory in a different way. Coverage breaks in four places: outdated applications and failed patches, drivers with an available update, Windows versions nearing their end-of-updates date, and endpoints too quiet to scan.
Why an Inventory Alone Doesn’t Give You Endpoint Update Coverage
Raw inventory data describes. By itself, it tells you what each endpoint reported the last time it checked in. The work begins when you filter that data into exceptions that need action, and three things keep teams from getting there.
Averages hide the gap. A fleet-wide patch figure can look healthy while one group of machines has missed every update since spring. The average tells you that most endpoints are fine. It does not tell you which ones are not.
Each gap sits in a different view. Application versions live in one place, drivers in another, Windows versions on a dashboard and quiet endpoints in the device list. Nobody opens all four views on the same day, so nobody sees one machine that shows up in three of them.
Nobody owns the list. Without a fixed filter and a fixed day, the review happens when an incident or an audit forces it. By then the gap has had months to grow.
Four Places Where Endpoint Update Coverage Breaks
The gaps fall into four groups, and each one shows up in the inventory in its own way.
Outdated Applications and Failed Patches
Outdated software builds up when an update fails, when a device misses a deployment window, or when nobody schedules the application at all. Some of those endpoints have an update waiting that nobody has installed yet. Others have a failed patch: an update tried to land and did not. We cover how application versions drift, and how a live application inventory exposes it, in a separate post. For update coverage, the point is simpler: every endpoint whose software is not up to date belongs on this week’s list, and the ones with failed patches deserve a closer look.
Outdated Drivers with an Available Update
Drivers drift by hardware model. One laptop model receives a new driver package, another keeps last year’s version, and nobody notices until a docking station stops working or a security advisory names the driver. A driver gap rarely announces itself, which is why it needs its own filter rather than a support ticket. Keep hardware models that your driver tooling does not support in a separate group, so “an update exists” never mixes with “nobody can tell for this model”.
Windows Versions That Fall Behind
Each Windows release follows a servicing lifecycle with an end-of-updates date that depends on the edition, and a device that stays on a release past that date stops receiving its monthly security updates. Microsoft’s Windows 11 release information lists November 10, 2026 as the end of updates for version 23H2 on Enterprise and Education editions. Pro editions follow a shorter cycle: version 24H2 Home and Pro reached end of updates on October 13, 2026. The upgrade itself usually belongs to whatever delivers Windows updates in your environment. The first step belongs to the inventory: knowing which endpoints still run the older version, and how many there are.
Endpoints Too Quiet to Scan
An inventory scan needs the endpoint to be online. A device that has gone quiet keeps the record it last sent, so it can look current while it runs software from months ago. These endpoints need their own routine, and stale devices covers how to find and sort them. On the weekly list, they mark the machines whose data you cannot yet trust.
Turning Your Inventory into a Weekly Work List
The work list is one saved view that shows every endpoint with at least one of the four gaps. In the CapaOne Endpoint Management Platform, you build it in the Windows endpoint list.
Five steps get you there:
- Build one filter per gap. Software Up-to-Date negated for applications; add Failed Patch Count above zero when you want to isolate failed deployments. Driver Up-to-Date negated for drivers. OS Version set to the Windows release you want to retire, such as 23H2. Last Check-in older than your threshold for quiet endpoints.
- Combine them with OR. Switching the word between two filters from AND to OR turns four narrow lists into one: every endpoint that has at least one problem. Build narrower lists as separate saved filters with AND: for example endpoints that have a failed patch and are online right now, so you can fix them today, or Driver Up-to-Date negated together with Driver Supported, so a known driver update never mixes with a model CapaOne cannot assess.
- Save the filter and mark it as a favorite. The filter also lives in the page URL, so you can bookmark it or share it with a colleague who covers the list while you are away.
- Refresh the relevant inventory before you act. Request a software scan for application gaps, a driver scan for driver status, or a security scan for Windows update data. If the endpoint is offline, CapaOne queues the request and runs it when the endpoint reconnects.
- Prioritize by risk, then export. Start with the endpoints you can act on immediately, then rank the rest by risk and deadline. A failed security update or a Windows release close to its end-of-updates date may belong at the top. Select every endpoint that matches the filter and export the list to CSV at the end of the review, so next week’s list has something to compare against.
Keep the review on a fixed weekday. A list that shrinks tells you the routine works. A list that grows points to a cause worth finding, such as a driver package that keeps failing on one model or an application that never made it into the update schedule.
One Agent Behind All Four Gaps
All four gaps trace back to one agent. The CapaOne agent on each endpoint reports software, hardware and drivers into one inventory, and the endpoint list shows the update status next to each machine. The software badge in the Updates column comes from Application Manager, and a red badge on the endpoint name shows how many patches failed. The driver badge and the driver updates on each endpoint’s Drivers tab come from Provision Manager. Security Monitor adds the security side, including a report on OS versions and missing Windows updates.
Because the data comes from one agent, every filter describes the same machines in the same terms. That consistency is what makes endpoint asset management useful day to day: the coverage figures you report upward and the list you work from describe the same fleet. The few endpoint numbers leadership can use build on exactly this data.
Where Intune Fits into the Work List
CapaOne works with Microsoft Intune, or entirely without it. In environments where Intune delivers Windows updates, the CapaOne work list shows which endpoints still run a Windows release you want to retire, and Security Monitor reports which ones miss Windows updates. Applications, drivers and the operating system then sit side by side in one routine. Where CapaOne runs on its own, nothing about the list changes: the same filters, the same weekly review.
What Changes When the List Runs Every Week
Coverage stops being a percentage in a report and becomes a named list of machines. A failed update gets a second attempt within days instead of surfacing during an incident. A Windows version approaching its end-of-updates date shows up as a count you can plan around, not as a deadline you discover. And when someone asks which endpoints your updates do not reach, you can answer with a list instead of an estimate.
Building the first list takes one filter per gap and one saved view. Book a demo of CapaOne Endpoint Management Platform for a walkthrough of the filters on a live fleet, or start a free trial and build your own work list hands-on.