Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for cybersecurity update deployments. One of the methods includes scanning the network of computing devices to access respective tags assigned to each computing device; processing results of said scanning in accordance with a decision-tree based logic that accords weights to a plurality of factors when identifying an indication of malware presence or absence, on each computing device; and responsive to identifying an indication of malware presence or absence, rescheduling an update for at least one computing device of the network of computing devices.