Scale is where
rollouts go to die.
A pilot on 150 endpoints doesn't tell you what happens at 14,000. Eleven OS variants, three regions, a handful of legacy ghosts. Panaptico runs the rollout as a wave pipeline — segmented, gated, and learning from every failure before the next wave starts.
Wave Board· FALCON-ROLLOUT-0003 · Day 24Pilot · mixed BUs
Day 0 – 3
IT · SRE · DevTools
Day 3 – 8
Engineering fleet
Day 8 – 24
Finance · Sales · RevOps
Day 24 – 36
Field Ops · Manufacturing
Day 36 – 60
Pre-flight checks
14 / 14 gating
Rollback budget · W3
3% · 68 of 3,204
Pending exceptions
138 hosts · 7 classes
Next gate
W3 → W4 · CISO sign
The gap
Pilot success predicts almost nothing.
01
The vendor hands you a pilot
A hundred fifty endpoints and a green dashboard. That's not a plan for fourteen thousand. The SOW ends where the hard part begins.
02
The fleet is nobody's idea of homogeneous
Eleven OS variants, three regions, six business units, and a handful of legacy ghosts nobody admitted to owning. Every one of them deploys differently.
03
Failures scale faster than waves
2% failure at Wave 1 is three hosts. At Wave 5 it's a hundred and fifty-seven. Without wave-over-wave learning, rollouts end with a week of manual triage.
Fleet segmentation
Every OS is its own rollout.
Panaptico splits the 14,112 endpoints by OS and deploy path — then reports progress per segment, not as a single misleading average. The legacy sixteen that would have broken Wave 5 surface on Day 1.
FALCON-ROLLOUT-0003 · 8 segments · 14,112 hosts
- 6,20432%
Windows 10 Enterprise
- 3,11236%
Windows 11 Enterprise
- 1,9020%
Windows Server 2019/2022
- 1,41829%
macOS Sonoma (14.x)
- 81210%
macOS Ventura (13.x)
- 50623%
Ubuntu 22.04 LTS
- 1420%
Amazon Linux 2
- 160%
Legacy (Win 7 · macOS ≤12)
Wave handshake
Every wave teaches the next one.
Panaptico binds every failure class to a pre-flight adjustment. What Wave 2 discovered about SCCM becomes a gate Wave 3 has to pass through. Learnings don't live in a retro doc — they live in the pipeline.
What broke
MSI signing cert not trusted on 3 hosts
What got added
Added cert push to pre-flight Ansible role
What broke
SCCM agent conflict on 4 IT admin boxes
What got added
Agent-conflict check added to pre-flight gate
What broke
Ubuntu AppArmor blocks sensor ring (11 hosts)
What got added
Playbook updated · profile exemption signed by Platform Lead
Exception lane
What breaks — classified, routed, owned.
Wave 3 · 138 hosts · 7 classes
- recoverable42
Offline > 30 days
Quarantine · auto-notify owner
IT Ops
- sequenced31
Existing EDR conflict (SentinelOne)
Sequenced uninstall · then deploy
SecOps
- sequenced24
Intune enrollment drift
Re-enroll before deploy · CHG-7418
IT Ops
- blocker16
Unsupported OS (legacy)
Exception granted · compensating control signed
CISO
- recoverable11
Disk space < 2 GB free
Cleanup task queued · auto-retry
IT Ops
- blocker8
FileVault sealed · no recovery key
Help-desk touch required
Help-desk
- scheduled6
Linux sudo broken
Re-image scheduled · Wave 4 window
Platform
Control surface
Pause a wave. Roll a segment back. Sign the exception.
A rollout is not a one-way door. Panaptico gives you a governed control surface — rollback budgets per wave, pause conditions the graph enforces, signed exceptions for the hosts that can't go today.
01
Rollback budget
3% per wave · auto-halt at threshold
If failure exceeds the signed budget, the next wave is gated until root-cause is recorded.
02
Pause conditions
6 conditions · graph-enforced
Endpoint health regression, SOC alert spike, vendor CVE advisory — any of them pauses the pipeline.
03
Signed exceptions
16 legacy · CISO signed · 90d expiry
The unsupported hosts don't vanish from the record — they carry a compensating control until retired.
A hundred fifty endpoints
is not a plan for fourteen thousand.
Panaptico turns your rollout into a graph of waves, segments, exceptions, and decisions — so scale doesn't become surprise.