Secunia PSI

Antivirus catches the malware. It does nothing about the hole the malware came through, which is almost always a program you forgot to update, a PDF reader two releases behind or a media codec nobody has touched since it was installed.

Secunia PSI was built to close that gap. It inventories every executable, library and control on the disk, compares the file versions against a database of known security advisories, and tells you which programs are insecure, which are patched and which have reached end of life and will never be patched again.

The idea was simple and the execution unusually hands-off. Where UCheck hands you a list and a download button, Secunia PSI repackaged the patches itself and installed them silently in the background, so a neglected machine drifted back toward current without anyone clicking through a setup wizard.

One thing to know before anything else, though. The service behind the program has been retired, and the client is only as useful as the servers it talks to.

How the scan decided what was insecure

The engine read metadata inside EXE, DLL and OCX files rather than the list of installed programs, which is why it found portable apps and leftover runtimes that never appeared in the uninstall list. By default it scanned the system drive and the drive holding the Program Files folder, with other drives selectable and an exclusion list for folders you wanted skipped. The first pass finished in about a minute. Plug in an external drive full of portable tools and rescan, and every one of them landed in the results.

Each hit came with a state (insecure, end of life or patched), the detected version, a threat rating and a recommended fix. A Secure Browsing panel checked the browser plugins that accounted for most drive-by infections and flagged which ones were exploitable.

The output was a system score as a percentage, blunt enough that a single ancient codec dragged it down as hard as an unpatched browser.

Automatic patching, with caveats

Setup offered three modes. Install silently, download and notify, or leave everything manual. In silent mode Secunia PSI pulled its own repackaged installers over an encrypted connection and ran them without prompts, the feature that made it worth running on a relative’s PC.

Two groups of programs always needed a human. Operating system components were handed off to the system’s own update service, and anything whose publisher required a visit to a web page or a licence step could only be flagged, not fixed. The success check was thin too.

Cancel an installer halfway and the dashboard still reported the update as applied, because the tool never read the exit status, so we would rescan after every automatic round.

Simple view, advanced view

The default screen listed programs that needed attention next to those already current, with red and green icons and little else. The advanced view exposed the version numbers, the path on disk, the link to the advisory and the actions the tool had taken, plus a history of past scans and installed updates. Colour-blind users had a hard time with the red and green scheme, since nothing but colour separated the two states in the simple view.

The ignore rules lived here too, and excluding an end-of-life program was the only sane way to stop an old scanner driver tanking the score every scan.

What the retired service means today

Every scan depended on a live lookup against the vulnerability database and every patch came from the same servers. With that back end gone, the client installs and launches, then sits at a connection check or aborts the scan. Most people searching for this program today are asking why it will not run, and that is the answer.

For the same job today, Patch My PC silently updates a long list of common applications from a portable executable, and UCheck covers the scan-and-list half with a far broader catalogue. Neither grades your machine or tracks end-of-life software, the one thing Secunia PSI did that nobody picked up.

Conclusion

Secunia PSI was the rare security tool that reduced work instead of adding it, and its combination of file-level detection, silent patching and end-of-life tracking has not been matched in one free program since.

With its service retired, though, the client is a historical artefact that can no longer protect anything. Anyone searching for it now wants Patch My PC or UCheck, and should know going in that the score and the end-of-life list are the two features they will miss.