The default preconfigured dynamic patch baselines poll an external, internet-accessible repository for updates and to download the updates that are required for remediation. For vSphere environments without access to the internet, the Update Manager Download Service (UMDS) can be used to download the patches and updates and then export the updates and patch information to a repository that's accessible by the isolated network.