Bridge Agent distribution & updates

The Workstation Bridge Agent runs on your endpoints. Your appliance is its update authority: installers are stored on the appliance, admins choose the version their organization runs, and endpoint users stay in control of when their machine updates.

How distribution works

New agent versions flow through three stages, each an explicit human decision — nothing updates silently:

Innovexus publishes a release→ your appliance mirrors it→ admin sets it active→ endpoints are offered the update

Published on innovexus.io. Your appliance's daily call-home notices a new published agent release and raises a bell notification for administrators (“Bridge Agent X is available”). Use Check now in Settings → Updates to poll immediately.
Downloaded to your appliance. In Settings → Updates, the Workstation Bridge Agent card shows the published release — one click downloads the installers (Windows/macOS/Linux) into the appliance's own store, checksums verified. From here on, your endpoints never need to reach the internet for the agent.
Set active. Marking a stored version active makes every user download serve it, and offers the update to every running agent in your organization on its next check-in (agents check in about once a minute).

What endpoint users see

When their agent is older than the active version, a prompt appears at login: “Your organization has released Bridge Agent X — Update now / Later.”
Later is always respected for that session; the prompt returns at the next login, so a deferred update is never forgotten — and never forced.
The agent's tray icon menu carries Update Bridge Agent… at all times, so users can update on their own schedule (it also confirms “up to date” when there is nothing to do).
Choosing Update downloads the installer from your appliance and runs it; on Windows the agent restarts itself when the installer finishes.

Downloading the agent for new machines

Endpoint Security → Settings → Install links mints time-limited share links a user can open on the new machine — the download is served from your appliance's store (active version).
The pre-login agent download on the console pages serves the same stored installer.

Compliance: requiring the active version

Every endpoint reports its agent version on check-in; the Endpoints view shows it per machine, flagged when it is behind the active release. The Bridge Agent Version posture check compares each endpoint against the active version, and Endpoint Security → Settings → Bridge Agent version policy decides what being behind means:

Policy	Effect on an outdated endpoint
optional (default)	The Bridge Agent Version check warns; the endpoint's compliance verdict is unaffected.
mandatory	The check fails and the endpoint reports non-compliant until its agent is updated.

Agents learn a policy change on their next check-in — no reinstall, no push, no waiting for a scan schedule.

Rollback. Set an older stored version active and the fleet's expectation follows it instantly — downloads serve the older installer and newer agents simply report current (updates are only ever offered forward).

Installer authenticity

Windows installers are Authenticode-signed (publisher: Innovexus) with an RFC-3161 timestamp; macOS packages are Developer-ID signed and notarized by Apple. Endpoint protection products and SmartScreen / Gatekeeper verify these signatures automatically.
Every transfer in the chain — innovexus.io → your appliance → the endpoint — is additionally SHA-256 verified, so a corrupted or tampered installer is refused before it ever runs.
To check by hand: signtool verify /pa <installer>.exe on Windows, or pkgutil --check-signature <pkg> on macOS.