The tier-1 admin that never sleeps.
Sessionwright is an AI admin agent for Citrix®, NetScaler® and Azure Virtual Desktop. You approve, it executes, everything is logged.
Change plan NP-0142
gw-ha-01: NetScaler HA pair upgrade
Reason: CVE-2026-88779 (CISA KEV), CVE-2026-107406
Window: Sat 22:00 to 02:00, rollback armed
- T0
Preserve evidence
Config snapshot and techsupport bundle, before anything changes
- T1
Full backup, copied off the box
create system backup -level full
- T2
Upgrade the secondary node
gw-b: 14.1-73.37 to 14.1-73.46
- T2
Fail over, then run health gates
HA sync, vservers UP, test logon
- T2
Upgrade the former primary
gw-a, only if every gate is green
- T1
Post-checks and evidence pack
Session kills only if the bulletin asks
Needs a Change Approver and a second approver
dry-run: 7/7 pre-checks passed
One agent, three jobs it takes off your plate
Read-only by default. Changes run only from a plan that a named admin approved.
Nightpatch
NetScaler Gateway upgrades in your window, after you approve
Watches vendor bulletins and the CISA KEV list, plans an HA-aware upgrade, and runs it secondary first, with health gates and rollback.
- 1Bulletin watch
- 2Plan and dry-run
- 3Your approval
- 4Secondary, failover, primary
- 5Post-checks and evidence
For Citrix environments
Daily health checks that explain themselves
Unregistered VDAs, image drift, StoreFront, licensing and Cloud Connector health, each finding tied to a named rule and the evidence behind it.
Learn moreFor Azure Virtual Desktop
Host pools that stay healthy and stop wasting money
Session host health, scaling plans, FSLogix and cost leaks, across one tenant or many through Azure Lighthouse.
Learn moreNetScaler patching has become a weekly job
CISA added six NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog in 2026, five of them between August 26 and October 4, each with a three-day federal deadline.
Teams on 14.1 had to install three fixed builds in eleven days: 14.1-73.37 on September 27, 14.1-73.41 on October 3 and 14.1-73.46 on October 8. The second fix answered attacks on boxes already patched to the first.
Latest exploited NetScaler CVEs
- NetScaler CVEs added to CISA KEV in 2026
6
NetScaler CVEs added to CISA KEV in 2026
Source: CISA KEV catalog
- required on 14.1 between Sep 27 and Oct 8, 2026
3 builds
required on 14.1 between Sep 27 and Oct 8, 2026
- exposed, potentially vulnerable instances counted on disclosure day of CVE-2026-88771
50,277
exposed, potentially vulnerable instances counted on disclosure day of CVE-2026-88771
Source: Unit 42
Plan, dry-run, approve, execute, verify, roll back
The language model explains and drafts. Deterministic code finds the problems and runs the change. You sign off in between.
01
Plan
Findings come from a rule engine with evidence. The agent turns them into a typed plan.
02
Dry-run
Every action shows its diff, blast radius and the approvals it needs.
03
Approve
A named admin signs the plan. The model can never mint an approval.
04
Execute
The runner checks the signature, the change window and live state, then acts.
05
Verify
Health gates after every step. Nothing proceeds unless they are green.
06
Roll back
A failed gate triggers the action's rollback and halts the plan.
Built to pass your security review
SOC 2 is on the roadmap. Until then, the architecture does the work: the runner lives in your environment and none of your data reaches us.
Runs in your environment
A runner you host, as a Windows service or container. No inbound connections, and no customer data reaches us in v1.
Read-only by default
Collectors use read-only roles and documented APIs. Write access is scoped, separate and granted per action tier.
Signed approvals
The executor accepts only an Ed25519-signed approval token, minted through the CLI or console by a person.
Tamper-evident audit log
Every read, plan, approval and step is written to a hash-chained log you can verify and export to your SIEM.
It replaces toil, not people
The admin who evaluates Sessionwright stays in charge of it. The agent takes the 2 a.m. upgrade, the morning health check and the checklist nobody has time for. You keep the judgment calls, the approvals and the credit at the audit.
Sessionwright takes
- The 2 a.m. NetScaler upgrade, run in your window after you approve it
- Daily health checks across Citrix and AVD, with evidence
- Drift and CVE alerts that name the rule and the fix
- Evidence packs for change boards and auditors
You keep
- Which changes happen, and when
- Who may approve what, and the four-eyes rule
- Credentials, in your own vault
- The final call on anything disruptive
Start free, then read-only, then hands-on
Prices are public. Design partners get 50% off.
Questions
Does Sessionwright change anything on its own?
No. It is read-only by default. Changes run only from a plan that a named admin approved with a signed token, inside a change window you set. Disruptive actions need a Change Approver and can require a second approver.
Where does it run, and does our data leave our network?
The runner runs in your environment as a Windows service or container, with no inbound connections. In v1 no customer data reaches Sessionwright. Model calls go to the endpoint you choose: your Claude seats, your Anthropic API key, or Claude in Microsoft Foundry.
Is this a replacement for our Citrix or AVD admin?
No. It takes the repetitive tier-1 work: health checks, triage, patch planning and evidence. Your admins keep control of approvals, credentials and every decision that matters.
Which platforms does it work with?
Citrix Virtual Apps and Desktops, Citrix DaaS, NetScaler ADC and NetScaler Gateway, and Azure Virtual Desktop. It uses documented vendor APIs only.
How do we start?
Check your NetScaler build with the free checker, or book a fixed-price, read-only assessment. The assessment fee is credited toward a subscription if you continue within 60 days.
Start read-only. Decide with evidence.
A drop-in assessment shows what the agent finds in your own environment, with nothing changed. The fee is credited toward a subscription if you continue within 60 days.