Patch management systems for IT teams

A patch management system is the tooling and process that finds missing updates across your estate, tests them, deploys them on a schedule and proves afterwards which machines took them. Most teams arrive at this search after an audit asked for patch compliance evidence that Windows Update and a spreadsheet cannot produce.

For a Windows and macOS estate under about 500 endpoints, Automox at $1 per endpoint per month billed annually for OS patching is the cheapest credible starting point, and PDQ Connect at $12 per device per year is cheaper still if you can meet its 100-device minimum. If patching is one job inside a wider endpoint management mandate, ManageEngine Endpoint Central at $795 a year for 50 endpoints does patching, software deployment and asset inventory in one product.

Below: what a patch management system has to do, the four pricing units vendors use, verified prices with their check dates, and the questions that decide the purchase.

What a patch management system does

Five functions, in the order they run. Discovery builds an inventory of endpoints and the software versions on them, because you cannot patch what you have not found. Assessment compares installed versions against vendor advisories and CVE data to produce a missing-patch list. Testing applies updates to a pilot ring before production. Deployment pushes approved patches on a maintenance window with reboot handling. Reporting produces the compliance evidence, which is the part auditors ask for and the part most home-grown processes cannot supply.

Two capabilities separate real products from Windows Update with extra steps. Third-party patching is the first: Microsoft's own tooling patches Microsoft software, and the vulnerabilities that get exploited sit in Chrome, Zoom, Acrobat, Java and the rest of the long tail. Automox covers more than 580 third-party applications on its Automate tiers. The second is ring deployment with automatic rollback criteria, because a patch that breaks a line-of-business application at 500 endpoints simultaneously is a worse outcome than the vulnerability was.

Patch management also overlaps heavily with endpoint management, and the overlap is where buyers overspend. Our guide to patching software against endpoint management software covers which one you need; the short version is that if you also want software deployment, remote control and asset inventory, buy the broader product once rather than two tools.

Features that decide the purchase

OS coverage, stated per platform

This is the first disqualifier and it is often buried. SolarWinds Patch Manager is Windows only. PDQ Connect covers Windows and macOS. Automox covers Windows, macOS and Linux on every tier including the $1 Patch OS plan. ManageEngine Endpoint Central covers Windows, macOS and Linux and adds mobile management at the UEM tier. If you have a Linux fleet, check whether the tool patches packages or only reports on them, and our Linux endpoint management guide covers what distro support means in practice.

How the price unit behaves

Four units are in use and they are not comparable without conversion. Per endpoint per month (Automox), per device per year (PDQ Connect), per node with tiered bands (SolarWinds Patch Manager), and per endpoint per year bundled with a technician count (ManageEngine). The unit matters more than the rate: PDQ Connect's $12 per device per year reads cheaper than Automox's $1 per endpoint per month until you notice they are the same $12 a year, and then the 100-device minimum decides it for a 40-device estate.

Minimums and floors

PDQ Connect requires 100 devices on every tier, which means a 30-device business pays for 100. Automox applies volume discounts above 200 endpoints and charges roughly 25% more for monthly billing with no commitment. ManageEngine's published prices are quoted at 50 endpoints and one technician, so a second technician is a separate line. Ask for the quote at your own counts rather than reading the pricing page.

Third-party catalogue size and update latency

Every vendor claims third-party patching. The questions that separate them are how many applications are in the catalogue, how quickly a new vendor release appears in it, and whether you can package something that is not. Automox cites over 580 applications on Automate Essentials and provides Worklets for anything outside that. PDQ Connect ships prebuilt and custom packages and adds custom scanners at the Plus tier. SolarWinds Patch Manager works through WSUS or SCCM, which means it inherits whatever your existing Microsoft infrastructure can reach.

Vulnerability context, not patch state

Knowing a patch is missing is different from knowing it matters. PDQ Connect Premium at $28 per device per year adds vulnerability scanning with CVSS scoring and one-click CVE resolution. ManageEngine's Security edition adds vulnerability assessment, application control and disk encryption management. If your driver is a security finding rather than an IT hygiene goal, that is the tier you are buying, not the entry one.

Patch management systems compared

Starting prices are the lowest paid tier with the unit stated. The last column is the one that decides the purchase: how the bill behaves as endpoint count grows and what the minimum commitment is.

Read the minimum column before the price column. A 40-endpoint business pays $480 a year on Automox Patch OS and $1,200 a year on PDQ Connect Basic, because PDQ charges for 100 devices whether you have them or not. Above 100 devices the two converge, and above 250 the comparison becomes about catalogue depth and automation rather than rate.

Cloud-first patch management picks

These suit teams with no on-premises patch infrastructure and endpoints that are often off the corporate network, which since 2021 is most teams.

Automox

Automox is the default recommendation for a mixed estate. Patch OS is $1 per endpoint per month billed annually and covers OS patching for Windows, macOS and Linux, which is the cheapest published rate in this group and genuinely enough if Microsoft, Apple and distro updates are all you need. Best fit: 50 to 1,000 endpoints, no WSUS to preserve, and a team that wants patching to happen without a server to maintain.

The limit is the entry tier's scope. Patch OS does not include third-party patching, Worklets or software deployment: those need Automate Essentials, which Automox prices on request. ITCommons records buyer estimates of $3 to $5 per endpoint per month for that tier, which are estimates rather than vendor rates, so get the figure in writing. Automate Enterprise adds remote control, FixNow and multi-org management, also quoted. Volume discounts apply above 200 endpoints and monthly billing costs roughly 25% more than annual. Verified against Automox's pricing page on 17 March 2026. The Automox and PDQ Connect comparison is the head-to-head most buyers at this size are running.

PDQ Connect

PDQ Connect publishes three per-device annual tiers and is the clearest pricing in the category: Basic at $12 per device per year, Plus at $18 and Premium at $28, each with a 100-device annual minimum. Basic covers device inventory, prebuilt and custom packages, custom fields and basic reporting. Plus adds automated deployments, remote desktop, role-based access control and custom scanners. Premium adds vulnerability scanning with CVSS and PDQ risk scoring, one-click CVE resolution and API access.

Two constraints. Windows and macOS only, so a Linux fleet rules it out. And the 100-device minimum is a floor, not a discount threshold, so below 100 devices your effective per-device rate rises as your estate shrinks. Nonprofit and education discounts are available, and the trial runs 14 days for up to 250 devices with no card. Verified 17 March 2026.

Action1

Action1 belongs on a shortlist for small Windows estates because it operates a free tier, and it is one of the higher-volume searches in this category at 9,900 a month for the brand name. ITCommons holds no verified pricing snapshot for its paid tiers, so this guide states no rate for it: request a quote and confirm the free tier's endpoint ceiling and feature scope directly, because both have changed before. It is Windows-focused, which is the constraint to check first against a mixed estate.

On-premises and enterprise picks

These suit estates with existing Microsoft patch infrastructure, air-gapped segments, or a procurement process that requires on-premises deployment.

SolarWinds Patch Manager

SolarWinds Patch Manager is the right answer in one specific situation: you already run WSUS or SCCM, you want third-party patching layered onto it, and the estate is Windows. It patches through that existing infrastructure rather than replacing it, which preserves the approval workflows and reporting your team already uses.

Pricing is by node across eleven bands from 250 to 110,000. A 250-node subscription is about $1,584 a year; 500 nodes about $2,700, so the per-node rate falls as you grow. A perpetual licence with first-year maintenance for 250 nodes is about $3,617, with maintenance renewal at roughly 20% to 25% of licence cost annually, which makes perpetual cheaper than subscription from about year three at a stable node count. Above 1,000 nodes you are quoted. Windows only, 30-day trial. Verified 17 March 2026. If you are comparing it against cloud-first tooling, the PDQ Connect and SolarWinds Patch Manager comparison covers the architectural difference.

ManageEngine Endpoint Central

ManageEngine Endpoint Central is the pick when patching is one requirement inside a broader endpoint management brief, and it publishes real prices, which is rare at this end of the market. At 50 endpoints with one technician: Professional is $795 a year (about $15.90 per endpoint), Enterprise $945, UEM $1,095 and Security $1,695. A free edition covers up to 25 endpoints with no time limit and includes patch management, software deployment, remote control and asset inventory.

Choose the tier by what forces it. Professional gives you patching, software deployment, asset inventory and basic remote control. Enterprise adds patch testing and approval, which is the ring-deployment capability most audited environments need. UEM adds Windows modern management and macOS MDM. Security adds vulnerability assessment, application control and BitLocker or FileVault management. Add-ons for malware protection, ransomware protection and OS deployment are priced separately, and technician count is a separate line from endpoint count. 30-day trial. Verified 17 March 2026.

BigFix and Ivanti Neurons

BigFix is the option for large heterogeneous estates, covering Windows, macOS, Linux and Unix from one agent, and it is quote-only. ITCommons holds no verified pricing snapshot for it, so this guide states no figure: the quote drivers are endpoint count and which modules you take.

Ivanti Neurons is modular and also quote-only, licensed per managed endpoint for UEM, per concurrent analyst for ITSM and per asset for ITAM. Third-party reseller guides put individual module entry points around $25 to $59 per user annually and those are estimates, not vendor rates. Enterprise multi-module bundles reach five and six figures annually, and on-premises deployment is reported at three to five times the cloud equivalent. A 45-day trial is available. Figures recorded 17 March 2026, and the estimated ones are labelled as such on Ivanti's ITCommons profile.

How patch management pricing works

Per endpoint per month is the cloud-native model, used by Automox. It is predictable, scales linearly and bills for machines that exist rather than machines you licensed last year. Annual commitment typically saves around 25% against month-to-month.

Per device per year is PDQ Connect's model and the same arithmetic with a different presentation, plus a device minimum. Per node with bands is SolarWinds Patch Manager's, where the per-node rate falls as you cross a band boundary and the perpetual option changes the five-year total. Per endpoint per year bundled with technician seats is ManageEngine's, where two variables move the price and only one of them is on the pricing page.

The cost nobody prices is the time. A patch management system that reports well but needs a human to approve every deployment ring consumes a few hours a week permanently. One that automates ring promotion with rollback criteria consumes setup time once. Model that before you compare subscriptions, because at a 300-endpoint estate the difference between four hours a week and four hours a month is larger than the gap between any two products here. The patch management ROI calculator puts a number on it, and our incident postmortem template is what you will reach for the first time a patch breaks something.

One more line item: policy. An auditor asking for patch compliance evidence usually wants a documented standard behind it, which is a different artefact from the tool's report. Our patch management policy template covers the SLA windows, exception process and reporting cadence that a tool report has to map onto.

Frequently asked questions

What is a patch management system?

It is the tooling and process that discovers endpoints and their software versions, identifies missing updates against vendor advisories and CVE data, tests them on a pilot group, deploys them on a maintenance schedule with reboot handling, and reports which machines are compliant. The reporting step is what distinguishes a system from running Windows Update.

What does patch management mean in cybersecurity?

It is the control that closes known vulnerabilities before they are exploited. Security frameworks treat it as a baseline requirement and usually specify a time window by severity, such as critical patches within 14 days. The security-relevant part is third-party coverage, because the long tail of browsers, PDF readers and runtimes is where most exploited vulnerabilities sit.

Does Microsoft have a patch management tool?

Yes, several, and all of them patch Microsoft software. WSUS distributes Microsoft updates on-premises, Intune handles update policy for cloud-managed devices, and Configuration Manager does both at enterprise scale. None patches third-party applications natively, which is why tools such as SolarWinds Patch Manager exist to layer onto WSUS and SCCM rather than replace them.

How much does a patch management system cost?

Published rates run from $12 per device per year (PDQ Connect Basic) to about $34 per endpoint per year (ManageEngine Security edition). Automox starts at $1 per endpoint per month billed annually for OS patching only. Expect the tier that includes third-party patching and ring approval to cost two to three times the entry rate. Prices verified March 2026.

What is the best patch management tool for Windows?

If you already run WSUS or SCCM, SolarWinds Patch Manager layers third-party patching onto that infrastructure from about $1,584 a year for 250 nodes. If you do not, PDQ Connect at $12 per device per year is the cheapest credible option above its 100-device minimum, and Automox at $1 per endpoint per month is the cheapest below it.

Do I need patch management if I have endpoint protection?

Yes. Endpoint protection detects and blocks exploitation attempts; patching removes the vulnerability being exploited. They are different controls and most security frameworks require both. An endpoint protection product that reports missing patches is reporting, not patching.

How long should patching take after a vendor release?

Set the window by severity in policy rather than by what the tool defaults to. A common standard is critical and actively exploited vulnerabilities inside 7 to 14 days, high severity inside 30 days, and everything else on the monthly cycle. The constraint is usually your testing ring, not the tool, which is why ring deployment with automatic promotion matters more than raw deployment speed.

Choosing a patch management system

Four questions, in order. Which operating systems are in scope, because that alone removes SolarWinds Patch Manager from a Linux estate and PDQ Connect from a mixed one. How many endpoints, because PDQ Connect's 100-device minimum and Automox's 200-endpoint volume threshold both sit inside the range most teams fall in. Whether third-party patching is required, because it is the difference between an entry tier and a tier two or three times the price. And whether you need ring testing with approval, because that is gated above entry on almost every product here.

The shortlist that results is usually two products, not six: Automox or PDQ Connect for a cloud-first estate, SolarWinds Patch Manager or ManageEngine Endpoint Central if you have existing Microsoft infrastructure or a broader endpoint management brief. Trial both against your own worst case, which means a patch that needs a reboot on a machine that is off the network, and confirm the compliance report satisfies whoever asked for it before you sign. The full vendor list sits in the patch management category, and the endpoint management category covers the broader products if patching turns out to be one requirement among several.