Best Patch Management Software for 2026: Who Each of 11 Tools Fits

Updated: October 2026

Patch management software deploys operating system and third-party app fixes on a schedule, before a known CVE becomes your incident report. This guide covers 11 tools: what each patches well, where it falls short, who it fits and who should skip it. Prices, ratings and catalog counts come from vendor pages and review sites read on 5 October 2026.

TL;DR

• Short answer. Pick by fleet and policy: Action1 or PDQ Connect for lean Windows-first teams, ManageEngine or Automox for mixed-OS depth, Intune plus an add-on for Microsoft 365 shops, NinjaOne, Atera or Kaseya VSA inside an RMM, and OpenFrame for one system built around automations (free trial, no contract or sales call).
• Third-party apps. Vendor-stated catalogs run from 350+ to 6,000+ titles. Test your own top 25.
• Rollback. Ask about it. Few vendor docs we read document it.

Prefer to watch? In Conrad Did the Homework, Conrad Lunderstedt, Solution Architect at Flamingo, takes the 11 tools through five questions in about 15 minutes.

Patch Management Software Comparison at a Glance

Ratings are context, not a ranking. Several of these G2 pages cover a bigger product than patching: Heimdal's is the whole platform, Atera's is its RMM listing, Intune's is the Enterprise App Management listing, and Ivanti's is its broader endpoint management product. Trustpilot profiles are company-wide, and where a profile has a handful of reviews we left the score out.

What Patch Management Is, and How the Process Works

Patch management is the routine of finding missing updates on every device, testing them, installing them on a schedule and proving they landed. Patch management software automates the repetitive parts, and the process runs as a loop.

It matters because a published patch is also a published description of the weakness it fixes. The days between a fix shipping and your fleet installing it are the patch window attackers work in.

The 11 Patch Management Tools

Action1: Free Start, Cloud Patching

Action1's first 200 endpoints are free, with no feature limits. That's a free tier, not a trial, and support for it runs through a community Discord. Above 200 endpoints, pricing is quote only.

It's a cloud-native agent with no VPN, peer-to-peer distribution and built-in remote desktop. It covers Windows 10 and 11 and Server, macOS and Linux, with a Linux agent that arrived in December 2025 (check the distro list for your servers). Policies run by severity, vendor and app, with reboot deferral and enforced deadlines, and patches land when an offline device returns. Help Net Security described update rings in March 2026. The vendor lists SOC 2 Type II and ISO 27001:2022.

The limits: the pages we read don't publish a third-party catalog count, the Mac library is narrower than Windows, and there's no automatic rollback (uninstall and redeploy by hand, per ExpertInsights).

Fits: small IT teams and lean MSPs that want a free start and cloud patching on three operating systems.

Skip it if: you need automatic rollback, a very large app catalog or phone-first support.

An official overview and an independent full demo:

Atera: One Per-Technician License

Atera bundles RMM, PSA and patching under a per-technician price. Patching sits in Pro and above, and Mac and Linux support starts at Growth. Atera's MSP pricing page lists $129 per technician per month for Pro, $159 for Growth and $209 for Power when billed annually (October 2026). Monthly billing is $139, $189 and $249. Endpoints are unlimited, so a one-person shop managing 500 devices pays the same as one managing 50.

Patches run through automation profiles that can be one-time, weekly or monthly. Each profile sets approval, time zone and offline-agent behavior, and a "reboot if needed" option restarts the device afterward. Optional Windows updates can't be patched through profiles, only manually. Third-party apps go through package managers (WinGet and Chocolatey on Windows, Homebrew on macOS, per secondary sources) instead of a curated catalog, and we found no documented rollback.

Fits: small to mid MSPs and IT teams that want RMM, PSA and patching in one per-technician license.

Skip it if: you only need patching, want a curated third-party catalog, or need Mac and Linux on the lowest plan. See our NinjaOne vs Atera comparison for the wider trade-offs.

An official workshop and an independent how-to:

Atera's plans now include its AI Copilot, and MSPs are discussing what that does to the price:

Automox: Cloud-Only, Priced Per Endpoint

Automox is a cloud-native endpoint management platform. One agent per device checks in over the internet, so there's no server to host. Beyond patching it runs Worklets, scripts with an evaluation block and a remediation block, in PowerShell on Windows and Bash on macOS and Linux.

Automox covers Windows, macOS and Linux, with 630+ third-party titles (vendor-stated). Policies come in six types: manual approval, patch all, severity, patch only, patch all except and advanced, each on a schedule. The docs we read don't cover reboot control, maintenance windows or rings, and they don't document rollback. Ask about all three.

Pricing is more open than most. Patch OS is $1 per endpoint per month on an annual commitment and covers OS patching on all three platforms. Third-party patching sits in Automate Essentials, which is a custom quote. There's a free trial, and annual billing saves 25% over monthly.

If you're weighing Automox alternatives from this list, Action1 is the closest in shape: cloud-native, three operating systems, and free up to 200 endpoints. ManageEngine covers the same operating systems with an on-prem option, and NinjaOne puts patching inside a full RMM.

Fits: mixed Windows, macOS and Linux fleets that want cloud-only patching.

Skip it if: you need an RMM or PSA in the same tool, offline or air-gapped patching, or rollback.

We couldn't verify an official Automox demo from 2025 or 2026, so this is an independent tutorial:

Heimdal Patch and Asset Management: Compliance-Led Patching

Heimdal's page lists Windows, macOS and Ubuntu Linux with 350+ third-party apps (vendor-stated), schedules by user group, the option to uninstall unstable versions, and peer-to-peer distribution. Reports cover GDPR, NIS2 and Cyber Essentials, and the vendor claims patches go out within four hours of release. The page is thin on reboot handling and rollback.

Capterra reviewers mention complex Group Policy setup, limited reporting and customization, and slow support at times. Heimdal has no price page. Capterra lists it from $16 per user per year, so check how Heimdal counts a "user" before you quote it.

Fits: small and mid-size shops, especially EU buyers that want patching tied to compliance reports.

Skip it if: you need deep reporting or a large app catalog.

Ivanti Neurons for Patch Management: Risk-Based Patching

Ivanti's product is cloud-based and covers Windows, macOS, Linux and third-party apps, with 800+ titles (vendor-stated). Patch Intelligence ranks patches by a Vulnerability Risk Rating that combines threat data, exploit validation and crowd-sourced patch reliability, and "Deploy by Risk" acts on it. It also offers ring deployment with automatic or manual promotion, automatic reboots for critical patching and exposure-based compliance reports.

Ivanti's 2026 release notes add Continuous Compliance in April, which auto-deploys missing updates outside maintenance windows, plus Ubuntu 22.04 and 24.04 and RHEL 10 support, and Oracle Linux 10 in July. Pricing is a platform fee plus device-based licenses, with no published rates.

Ivanti has several products on CISA's Known Exploited Vulnerabilities list since 2024, including Connect Secure, EPMM and Endpoint Manager. None of those entries is the cloud patch product, so check which Ivanti products you'd actually run.

Fits: security-led and enterprise IT teams that want exploit-informed prioritization and rings across three operating systems.

Skip it if: you need published pricing, MSP multi-tenant simplicity or a small-team purchase.

Kaseya VSA: Policy-Based Patching for the Kaseya Stack

VSA patches through policies. OS rules are approve and install, skip and review, or reject and hide. Schedules run daily, weekly or monthly, with an "ASAP if missed" option, a randomized 30-minute spread and the device's local time zone. Reboots can follow the OS's active hours, run immediately with an optional five-minute notice, or wait for a scheduled time with up to 23 hours of warning. Results show per policy run under Patch Management History.

Third-party coverage is where the detail is. The VSA 10 help lists 400+ apps and documents catalog SLAs: tier 1 apps (Chrome, Firefox, Edge, Java 8, TeamViewer) within one business day, tier 2 (Office 365, Teams, Zoom, Acrobat Reader DC) within five, and tier 3 within ten. Updates rated CVSS 9.0 or higher move into the one-day tier. Ask every vendor for that kind of number. One catch: the VSA 10 help says third-party patching is available for Windows devices, while Kaseya's marketing page lists Windows, Mac and Linux. Confirm which applies to your fleet. We found no documented rollback or deployment rings.

Fits: MSPs already on VSA who want policy-based patching for Windows and the common apps. Our Kaseya VSA review covers the contract side.

Skip it if: you need non-Windows third-party patching, or documented rings and rollback. Pricing is quote only.

A partner walkthrough (in Italian) of VSA 10 patch policies:

VSA X, the newer generation, is still finding its audience:

ManageEngine Patch Manager Plus: The Depth Pick

The product page lists Windows, macOS and Linux with 1,100+ third-party apps (vendor-stated), plus driver and BIOS patches. It claims patch decline, test-and-approve groups, deployment policies, rollback and flexible reboot scheduling, and real-time compliance reports. It patches machines across LAN, WAN, DMZ and remote locations without a VPN, includes a self-service portal, and runs in the cloud or on-prem. It integrates with Tenable, Rapid7, ServiceDesk Plus and CrowdStrike, and there's a 30-day trial.

Published prices: 50 workstations cost $245 a year on-prem (annual) or $345 a year in the cloud. 1,000 workstations cost $2,795 on-prem or $3,795 in the cloud. Ten servers cost $95 a year, and extra technicians are $195 a year. Confirm the edition (Professional or Enterprise) before you quote these.

Fits: IT teams that want on-prem control, already use Zoho or ManageEngine, or need a low per-endpoint price.

Skip it if: you want a lightweight, cloud-first tool.

Microsoft Intune: The Default for Microsoft 365 Shops

On Windows, Intune gives you update rings (deferrals, deadlines, restart behavior), feature, quality and driver policies, hotpatch (on by default, with an opt-out), Autopatch groups and reports. Devices need to be Entra joined or hybrid joined. On macOS, declarative device management policies cover macOS 14 and later. Microsoft's Autopatch overview covers Windows, Microsoft 365 Apps, Edge and Teams, and we found no Linux update management in the docs we read.

Third-party apps are the gap. The Enterprise App Catalog is a Windows-only paid add-on at $2 per user per month. It auto-updates apps assigned as Required, and it has no rollback and no rings. The catalog is cached for up to an hour, and Microsoft publishes a list, not a count. Patch My PC is the common add-on, and it lists $3.50 per device per year (minimum $3,500) or $5 per device per year. Intune Plan 1 is $8 per user per month standalone and is included in Microsoft 365 E3 and E5.

Fits: Microsoft 365-centric organizations, and MSPs already on Business Premium or E3.

Skip it if: you run Linux, or need broad third-party coverage without paying for an add-on.

An official walkthrough and an independent hotpatch how-to:

NinjaOne: Patching Inside a Full RMM

NinjaOne lists Windows, macOS and Linux patching with 6,000+ third-party apps (vendor-stated), plus a "Patch AI" feature that flags unstable updates. Approval works per category with three states: approve, manual and reject. Reboot behavior is configurable for logged-in users (prompt, notify then reboot, delay, or do nothing) and for unattended devices. Status views filter by pending, approved, rejected, installed and failed.

The docs also list limits. There are no patch scans or installs while a reboot is pending, scan and update schedules must sit at least an hour apart, and WSUS group policies override NinjaOne policy. Pricing covers the RMM: Ninja publishes $1.50 per endpoint at 10,000 endpoints, rising to $3.75 at 50 or fewer, and everything between is a quote. See our NinjaOne pricing guide for the fleet-size math.

Fits: MSPs and internal IT teams that want patching inside a full RMM.

Skip it if: you want a standalone patching tool.

PDQ Connect and Deploy: Windows-First Patching

PDQ sells two products. Connect is a cloud agent for Windows and macOS with patching, deployment, vulnerability management and remote desktop, and no VPN. Deploy and Inventory is on-prem and Windows-only.

PDQ's 2026 changes: a Windows Updates view with missing KBs and installs from the console, one-click device reboot, a Windows package library of 700+ packages, and macOS support that launched in November 2025. The macOS library starts with 15 apps, and we found no Linux support on PDQ's pages.

Connect costs $12 (Basic), $18 (Plus) or $28 (Premium) per device per year, with a 100-device minimum. Premium adds vulnerability scanning and one-click CVE resolution. Deploy and Inventory is $1,950 per admin per year, and there's a 14-day trial for up to 250 devices.

Fits: Windows-heavy sysadmin teams and MSPs that want quick patching and software deployment.

Skip it if: you need Linux, deep macOS, approval rings or a PSA.

OpenFrame: Patching Built From Primitives

OpenFrame is an open, AI-native infrastructure layer for IT and security, and patching is one of its Gen1 modules. It works differently from the dedicated patchers above: there's no built-in catalog, approval screen or deployment ring. Patching is assembled from inventory, policy checks and scheduled scripts, and the agents write the pieces.

OpenFrame by Flamingo costs $1 per device per month, or $0.80 billed yearly, with AI tokens included and a 14-day free trial (no card, no contract). Windows and macOS patching runs as scripts (Windows Update commands, softwareupdate, winget, Chocolatey, brew), and Linux hosts show up in inventory through osquery. The full workflow is in How Patching Works in OpenFrame below.

Fits: teams that already live in scripts and want inventory, execution and reporting in one place, with an agent doing the assembly. Read more on what an MSP platform should include.

Skip it if: you need a catalog, approval rings and a reboot orchestrator working on day one.

The r/msp thread where MSPs picked the platform apart:

What Patching Costs at 100 Endpoints

Only some of the 11 publish a rate. Here they are with the arithmetic shown: rate x 100 x 12 months.

Kaseya VSA and Ivanti are quote only. ManageEngine's list prices are per workstation count and edition, so scale them from the table above. Heimdal's only public figure is a Capterra listing of $16 per user per year.

Price is the smaller part of the bill. Third-party patching, add-ons and the hours your team spends building packages decide the total. Intune looks free if you already pay for Microsoft 365, until you add a catalog for Chrome, Adobe and Zoom. For a deeper take on the rest of the stack, here's a guide on how to reduce IT costs without cutting controls.

Pick by Your Situation

You're mostly Windows and lean on budget. Start with Action1 (free to 200 endpoints) or PDQ Connect. Both are quick to roll out.

You run Windows, macOS and Linux and want cloud-only. Automox or Action1. If you need on-prem control, ManageEngine.

You already pay for Microsoft 365. Intune and Autopatch cover Windows. Decide early how you'll patch third-party apps: the Enterprise App Catalog or a tool like Patch My PC.

You already run an RMM. Use the patch module inside it (NinjaOne, Atera or Kaseya VSA) and test your top 25 apps against the catalog before you buy another tool.

You're security-led or enterprise. Ivanti's risk-based approach is built for fleets where blanket patching isn't possible.

You want patching inside one system built around automations. OpenFrame, if you're comfortable assembling the workflow from scripts and policies.

Whichever you shortlist, ask three things before you sign. Which of our top 25 apps are in the catalog, and how fast do their updates land? Is rollback automatic, manual or missing? What's the renewal uplift cap, in writing? Multi-year terms with auto-renewal catch more IT teams off guard than any product flaw does, and switching costs a quarter of rebuilt automations and retrained technicians.

Then run a pilot. Pick three tools that match your OS mix, deploy to 50 endpoints for 30 days, and time how long a critical patch takes from release to done. Compare the reporting each one gives you for an audit-style evidence request. The winner is the tool your team trusts at 2 a.m. when CISA adds an entry to KEV and you need the patch out by morning.

Patch Management for In-House IT Teams

An in-house team patches one company: one tenant, one change calendar and a few people. The time goes into third-party apps and into proof for auditors and insurers, more than into Windows itself.

On Microsoft 365 Business Premium, E3 or E5, start with Intune and Autopatch for Windows and add a third-party catalog. Without Microsoft 365, Action1, PDQ Connect, Automox and ManageEngine all fit a single-company fleet. Our Intune review covers where Intune runs out.

Patch Management for MSPs

An MSP patches many clients from one console, so the questions change. Can one policy cover every client while each keeps its own maintenance window? Can each client get its own compliance report for a QBR? Does a failed install open a ticket in the PSA? And does the price scale per endpoint or per technician?

Atera charges per technician rather than per device, NinjaOne per endpoint, and Action1 is free to 200 endpoints, which suits an MSP's first clients. Kaseya VSA fits MSPs already on the Kaseya stack, and OpenFrame runs patch policies for one company or many clients.

Enterprise Patch Management

At enterprise scale the hard parts are distribution and governance, not detection. Look for rings with automatic promotion, role-based access so regional teams patch only their own devices, maintenance windows per site, peer-to-peer distribution that keeps updates off the WAN, and a hook into change approval.

Ivanti's risk-based rings, ManageEngine's on-prem depth and Intune with Autopatch are the enterprise fits on this list. For the server estate behind them, our server management guide covers monitoring, patching and access.

Automated Patch Management

Automated patch management means rules decide what installs and when, instead of a technician approving each update. Every tool on this list automates some of it. The difference is how much you can leave running unattended.

On this list, Ivanti promotes rings automatically or manually, Intune and Autopatch run rings and deadlines natively, Automox runs scheduled policies by severity, and NinjaOne approves by category. AI agents are the newest layer. In OpenFrame, the Mingo agent writes and schedules the patch scripts, covered in How Patching Works in OpenFrame below.

Windows Patch Management: Intune, Autopatch and WSUS

Microsoft ships Windows security fixes on Patch Tuesday, the second Tuesday of each month, plus out-of-band releases when something can't wait. Our Patch Tuesday breakdown shows what one month looks like.

Microsoft's own tooling splits three ways. Intune update rings and Windows Autopatch manage Windows clients from the cloud, with deferrals of up to 30 days for quality updates and 365 days for feature updates. WSUS, the on-premises server, was deprecated in September 2024: it still ships in Windows Server 2025 and still carries updates, but Microsoft stopped adding features and points server patching to Azure Update Manager. Our guide to what replaces WSUS covers the move.

Two gaps send teams to a third-party tool. WSUS and Intune update rings carry Microsoft's code only, so Chrome, Zoom and Adobe need Intune's paid Enterprise App Catalog, a third-party tool, or Patch My PC publishing on top. And Autopatch covers Windows clients, not servers. Windows Server 2025 can hotpatch through Azure Arc, and other servers patch through WSUS, Azure Update Manager, Configuration Manager or an RMM.

Microsoft's deferral advice is short: keep quality update deferral under three days. When someone needs updates held back on a few machines, our guide to pausing Windows Update covers the safe ways.

Patching Third-Party Applications

The operating system updater patches the operating system and stops there. Windows Update, Autopatch and macOS Software Update handle the vendor's own code. The browser, the PDF reader, the Java runtime, the conferencing client and the developer tooling are yours to cover, and each ships on its own schedule.

Catalog size is the number vendors put on the datasheet, and the least useful one for comparing them. Vendor-stated counts above run from 350+ to 6,000+. A big catalog is worth nothing if the line-of-business application your client depends on isn't in it. Before signing anything, export your installed software inventory, take the 25 titles with the highest install count, and check each one against the vendor's published catalog. That list picks the tool. The headline number doesn't.

Speed matters as much as coverage. Kaseya's VSA 10 help is one of the few places that publishes it: one business day for the tier 1 apps, five for tier 2, ten for tier 3. Ask every vendor for the equivalent.

Three failure modes are worth knowing before you commit. Per-user installations are the most common: Chrome, Teams and Zoom often install into a user profile rather than Program Files, and an agent running as SYSTEM can't see or update them unless the product handles that case deliberately. Repackaging lag is the second, because vendors that sandbox and re-sign every update buy you safety at the cost of hours or days between the upstream fix and your fleet. The third is everything outside the catalog, where you're back to building and maintaining your own packages.

Intune deserves its own note, since so many teams arrive there by default. It patches Microsoft's applications cleanly and hands you the rest, through Win32 app packaging, a paid catalog add-on or a second product running alongside it. That work is recurring and never appears on the price sheet. This is also the seam where patching meets vulnerability management: the scanner reports the outdated runtime, and the patch tool has to be able to close it.

Patching Linux Fleets

Linux is where the shortlist above thins out. NinjaOne, Automox, ManageEngine and Ivanti list Linux. Atera adds it from the Growth plan, Heimdal covers Ubuntu, and Action1 added a Linux agent in December 2025. PDQ Connect doesn't list it, and OpenFrame shows Linux hosts in inventory but runs patch scripts on Windows and macOS. A single "Linux" column hides a lot of variation underneath.

The model is different too. On Linux the package manager already does the patching, whether that's apt, dnf or zypper. The question is not whether a tool can apply updates. It's whether it can orchestrate them across a fleet, sequence the reboots and produce evidence afterward.

Four things are worth confirming with the vendor rather than assuming, because the answers change release to release: which distributions and versions carry a supported agent, how kernel updates and the reboot that follows are handled, whether live patching is available for hosts that can't reboot on schedule, and whether reporting is per CVE or only per package.

The arrangement many mixed environments settle on is two tools: an endpoint product for Windows and macOS laptops, and configuration management such as Ansible, or distribution-native tooling, for the Linux servers. That's a reasonable architecture, and it's worth pricing both halves before deciding a single vendor is cheaper. Teams that would rather run the self-hosted route can compare the open-source options on OpenMSP.

Linux Patch Management Tools at a Glance

Where a kernel reboot needs a change window, the distributions sell live patching: Canonical Livepatch with Ubuntu Pro, kpatch on Red Hat Enterprise Linux, and SUSE Linux Enterprise Live Patching. It buys time between reboots rather than replacing them.

Patching macOS

macOS updates come from Apple through Software Update, and the MDM decides when they install. With declarative device management, which Intune supports from macOS 14, the MDM sets a target version and a deadline and the Mac enforces it. Third-party Mac apps are the same problem as on Windows, with smaller catalogs.

Of the 11 tools, Automox, ManageEngine, Ivanti, NinjaOne, Heimdal and Action1 list macOS patching, and Atera adds it from the Growth plan. PDQ Connect launched macOS in November 2025 with a 15-app library, Intune's Enterprise App Catalog is Windows-only, and OpenFrame runs softwareupdate and brew as scripts. Apple-heavy fleets can pair one of these with an Apple-specialist MDM such as Jamf or Mosyle.

Server Patching Is Change Management

Patching a laptop is close to fire and forget. The user reboots when it suits them and nobody notices. Patching a server is an outage with a date on it, and the requirements are different enough that a product that's excellent on workstations can be dangerous on servers.

A server-capable tool has to offer maintenance windows defined per group rather than globally, reboot orchestration that sequences nodes instead of restarting them together, dependency ordering so the database tier lands before the application tier, integration with snapshots or checkpoints taken before the window opens, and a rollback path somebody has tested.

The failure that catches teams out is subtle. A group in most consoles means a shared policy, not a shared sequence, so a cluster whose nodes all sit in one group can be patched simultaneously and taken down together. Clustered and highly available systems need one node at a time with a health check between each, and that's a configuration decision, not a default.

Servers are also where patching meets your recovery commitments. A maintenance window that overruns is an unplanned outage, and the numbers in the contract are the ones you'll be measured against, so read the patch schedule next to your RTO and RPO targets.

Patching Cloud and Hybrid Environments

Cloud changes the shape of the job in two ways.

The first is that in an auto-scaled or immutable estate you don't patch running instances at all. You rebuild the machine image, roll it out and let the old instances terminate. Patching a host that will be destroyed within the hour is wasted effort, and the fix belongs in the image pipeline. Teams running both models need to be clear about which servers are rebuilt and which are maintained, because applying the wrong process to either is where drift starts.

The second is the shared responsibility line. In IaaS you own the guest operating system and everything above it. In PaaS and SaaS the provider patches the platform and you still own your own code and its dependencies. That boundary moves by service, and an assessor will ask you to state it precisely.

There's a practical trap here as well. Cloud instances often never touch the corporate network, so any product relying on LAN discovery or a VPN path won't see them at all. Cloud-native agents that check in over the internet exist for this reason, and the major providers ship native patch services for their own IaaS that are worth pricing against a third-party agent before you standardize.

Cloud-Based Patch Management Tools

"Cloud-based" means two things in a shortlist. The first is a cloud console with agents that check in over the internet, so laptops get patched wherever they are and there's no server to host. Action1, Automox, Ivanti Neurons, NinjaOne, PDQ Connect, Intune and OpenFrame work that way, and ManageEngine offers a cloud edition next to its on-prem one.

The second is patching servers that live in the cloud. There the providers' own services are AWS Systems Manager Patch Manager, Azure Update Manager and Google Cloud's VM Manager. Price the native service for IaaS hosts before adding endpoint licenses for them.

Patch Management vs Vulnerability Management

The two terms get used as synonyms. They're two halves of one loop.

Vulnerability management finds and ranks the risk. A scanner or agent compares installed software and configuration against known CVEs, scores each finding and tells you what to fix first. Patch management closes the risk. It tests the fix, pushes it on a schedule and proves it landed.

The handoff between them is where things slip. The scanner flags a CVE and nobody owns the ticket. Or the patch dashboard shows green while the scanner still sees the one internet-facing server that missed the window.

Some findings have no patch at all: an end-of-life OS, a default password, an open port. Those belong to change management, not the patch tool.

Close the loop in two steps. Feed scanner findings into the patch queue, then re-scan after every patch window to confirm the fix. For the scanning half, our vulnerability scanner comparison covers 12 tools.

Security Patch Management and Patch Compliance

Security patch management is the slice of patching that closes known vulnerabilities, and it runs on deadlines rather than convenience. Rank by exploitation, not CVSS alone. CISA's Known Exploited Vulnerabilities catalog lists the CVEs attackers are using now, and each entry carries a due date that US federal agencies must meet under Binding Operational Directive 22-01. FIRST's EPSS score estimates the chance a CVE gets exploited in the next 30 days, which helps sort the long tail. Our CVE and CVSS explainer covers how the scores work.

Patch compliance is the number that proves it: the share of devices with every approved patch installed within the deadline for its severity. Report it per severity band and per group, because a fleet-wide 97% can hide a whole server group running weeks behind.

What a Patch Management Policy Should Contain

A patch policy used to be an internal document. It's now something you hand to an insurer, an assessor or a client running a security questionnaire, and the wording gets read closely. This is the part of patch management that no tool ships for you.

The failure is almost always vagueness. A policy stating that patches are applied promptly tells an assessor nothing and comes back with questions. A policy that names severities, day counts, an approver and an evidence trail is one you can defend.

The commercial reason to write it down properly is that the document now gates money. Cyber insurance applications ask directly about patch cadence and evidence, and the answers form part of the underwriting, which makes this worth reading alongside the cyber insurance requirements carriers now set.

Audited frameworks want the same thing in more detail. If you're working toward attestation, build the policy and its evidence trail once and reuse it each cycle for SOC 2.

A Patch Management Policy Template

Use the table above as the outline and put numbers in each section. The example values below are a starting point to adjust, not a standard.

ISO 27001 and PCI DSS Patching Requirements

ISO/IEC 27001:2022 covers patching in Annex A control 8.8, management of technical vulnerabilities, while control 8.32 on change management governs how patches reach production. Neither sets a day count, so your policy supplies one and the evidence trail proves you meet it. PCI DSS 4.0 is more specific: requirement 6.3.3 says critical and high-security patches are installed within one month of release.

How Patching Works in OpenFrame

The dedicated patchers above ship a patch module: a catalog, an approval screen, deployment rings and a reboot orchestrator, all built for that one job. OpenFrame lists Patching among its Gen1 modules and builds it differently. There's no catalog, approval screen or ring interface. The pieces are inventory, policy checks and scheduled scripts, and you can see and edit every one of them.

Visibility comes from osquery through Fleet MDM. Scheduled and live queries return the installed OS build and version, Windows patch state and Windows Update history, installed applications, and package inventories for deb, rpm and Homebrew. Fleet policies turn that into pass or fail checks evaluated on every host, of the form "macOS at 14.6 or above", "Windows build at 22631.4169 or above", "Chrome at 129 or above". The same queries and policies run across every customer at once, or scope down to a single client.

Execution comes from OpenFrame RMM as saved scripts on a schedule. On Windows that means driving UsoClient through scan, download and install, or the PSWindowsUpdate module, or winget upgrade for third-party applications. On macOS it's softwareupdate, with brew upgrade for anything Homebrew manages. Chocolatey, winget, brew and vendor silent installers cover the third-party layer. A script is saved once and then scheduled, either on a fixed window such as Sunday at 02:00 UTC, or triggered when a device next comes online, which suits laptops that are never connected at two in the morning.

What OpenFrame doesn't have here is worth stating plainly. There's no built-in patch catalog, approval workflow, CVE-to-KB mapping, deferral rings or reboot-orchestration interface of the kind the dedicated patchers above ship. Those either get assembled from the primitives, or they come from a separate tool running alongside.

The workflow that results has five stages:

1. Inventory. A scheduled query capturing OS version and missing updates across a client.
2. Compliance gate. A Fleet policy that fails any host behind the target build.
3. Remediation. A saved RMM script per platform, whether that's Windows Update, softwareupdate, winget or brew.
4. Rollout. A script schedule targeting a pilot tag first, then the full fleet.
5. Verification. Re-run the policy or query and report the delta.

Those are the same stages a patch module performs. The difference is that each one is visible, editable and yours, and that Mingo, the AI agent, writes and schedules the pieces instead of your team hand-rolling them each time. The trade is control and transparency in exchange for a ready-made catalog.

Where that trade lands depends on your team. A team that already lives in scripts, and wants inventory, execution and reporting in one place with an agent doing the assembly, gets something the dedicated tools don't offer. A team that needs a catalog, ring definitions and an approval trail working on day one should take one of the dedicated patchers above and revisit this later.

Flamingo's published ROI table prices four patching tasks (patching, fixing CVEs on a device, reporting patch compliance and checking for missing updates). Done by hand they take 140 minutes and $147.00 of technician time. With Fae and Mingo they take 14 minutes and $0.80 of AI cost.

Patch Management Best Practices

1. Keep inventory live. An agent can't patch a device it doesn't see, so reconcile device counts against your directory every month.
2. Rank by exploitation. A KEV listing or a high EPSS score goes first, and CVSS breaks ties.
3. Ring every update. Pilot, broad and remainder, with a soak period between stages.
4. Set deadlines users can't snooze forever. Active hours protect the working day, and a deadline protects the fleet.
5. Check third-party apps weekly. Chrome, Zoom and Adobe Reader follow their own release schedules, not Patch Tuesday.
6. Treat servers as change management. Maintenance windows per group, sequenced reboots and a snapshot first.
7. Plan for out-of-band fixes. Patch Tuesday is the routine, and a KEV listing on a Thursday is the test.
8. Re-scan and report after every window. Compliance by severity, sent to whoever owns the risk.

The Tool Matters Less Than the Practice

A patch tool without a cadence is a dashboard nobody reads. What keeps a fleet patched is a Tuesday at 9 a.m. with a defined ring, an approval workflow and a person whose job it is to look at the report. Pick a tool from this list that fits your OS mix and budget, then build the practice around it. The CVE you patch on schedule is the one that never makes it into your incident report.