CrowdStrike Patch Management: How Falcon Does It and Where an RMM Still Fits

Does CrowdStrike do patch management? Since September 2025 the answer is yes, through risk-based patching inside the Falcon for IT module, with conditions that decide whether it replaces your patch tool or sits in front of it. This guide covers how Falcon patches, what it publishes about scope, and where an RMM's patch engine still does the work.

The Short Answer, and the Date It Changed

For most of Falcon's life the answer was no. CrowdStrike's own older messaging said it was not a patch management vendor and pointed customers at partners such as Automox, ManageEngine and Adaptiva, whose tools read Falcon Spotlight's vulnerability findings and deployed the fixes. In October 2024 a CrowdStrike employee on r/crowdstrike put it plainly to an MSP asking for patching guidance: Falcon for IT "does not provide any patching capabilities today".

That changed on 17 September 2025, when CrowdStrike announced Risk-based Patching for Falcon for IT at Fal.Con, first labelled "coming soon" and by 2026 sold as part of the module. The mechanism is the subject of the next section. The condition is the subject of the rest of this post: Falcon ranks and patches the vulnerabilities its sensor can see and act on, and CrowdStrike's public pages stop short of publishing the application catalog or the offline-host behaviour that a patch tool buyer normally checks first.

How Risk-Based Patching Works Inside Falcon

The patching workflow is built on three pieces that already existed in the platform plus one that is new. Falcon Spotlight, now part of Falcon Exposure Management, assesses vulnerabilities from the sensor's telemetry without a scan. ExPRT.AI, CrowdStrike's exploit-prediction model, scores each finding by how likely it is to be exploited, using observed adversary activity and attack paths rather than the CVSS number alone. Those two pieces produce a ranked list. The new piece, inside Falcon for IT, acts on it.

Acting on it means two things, per CrowdStrike's launch post. A Patch Safety Score, built from Falcon telemetry across the install base combined with vendor insights, estimates before deployment how likely a specific update is to cause trouble. Then ring-based deployment rolls the update out in progressive waves, monitors impact in real time and, in CrowdStrike's words, "automatically optimize[s] installation timing". All of it runs across Windows, macOS and Linux through the one sensor and the one console the security team already uses.

What that buys you is sequencing. Instead of a monthly cycle that patches everything with a high CVSS score, the queue starts with the findings adversaries are using this week, and the deployment holds back the updates the safety score flags. The point CrowdStrike makes hardest is organisational: security and IT no longer trade spreadsheets or tickets to agree on what gets patched, because the ranking and the rollout are in the same place.

What Falcon Ranks Against What Falcon Patches

Here is where the evaluation gets specific. Spotlight's assessment covers the operating systems and applications the sensor can see, and its findings feed every partner patch tool on the CrowdStrike Marketplace. The patching side of Falcon for IT publishes a narrower statement: Windows, macOS and Linux endpoints, through a single agent. No CrowdStrike page we read in November 2026 lists which third-party applications risk-based patching can update, and the platform page still carries a footnote that the text "may include discussion of unreleased services or features".

Practitioners have noticed the seam from the other direction. In a December 2024 r/crowdstrike thread about a recurring Spotlight finding, one admin wrote that "lots of little softwares" never make the Spotlight vulnerability list, so the ranking is only as complete as the sensor's application coverage. ManageEngine's integration documentation for Patch Manager Plus, one of the Spotlight partners, states that it does not patch user-installed applications. Adaptiva's OneSite Patch data sheet claims more than 1,500 third-party applications alongside Windows updates, which is the kind of catalog number CrowdStrike itself has not published for Falcon for IT.

The practical ask is a written list. Before you move any patch ring into Falcon, get the supported-application catalog for risk-based patching from your account team, in writing, with the date. Then compare it line by line against the applications your RMM's catalog already covers. The gap between the two lists is the work that stays in the RMM.

What Falcon Does Not Auto-Apply

Risk-based patching is gated by design, and the gates are the part to understand before a CISO reads "AI-powered" as "hands-off". A finding with a high ExPRT.AI score enters the queue, but a low Patch Safety Score holds the update back. Rings mean the first wave hits a small group of hosts and the rest wait on the impact data. That is three decision points, and each one is a place where a human sets the policy.

Three further things are outside what CrowdStrike publishes, and each of them is a routine job in a patch tool. Offline and air-gapped hosts: no statement on how an endpoint that cannot reach the Falcon cloud receives or reports a patch. Reboot and end-user coordination: the launch material describes rollout timing and impact monitoring, not deferral prompts, maintenance windows per client, or a user-facing countdown. Reporting for an auditor: Falcon reports exposure and remediation state, while the per-client, per-month compliance evidence an MSP contract names is something to verify in a demo rather than assume. One G2 reviewer, a cybersecurity administrator at an enterprise, rated the product 5/5 in December 2025 and still noted that Linux patching "requires some tuning" to get successful runs.

None of this is a mark against the module. It is a security team's patching workflow, built to close the exploited-in-the-wild findings fast, and it should be judged on that. The jobs above belong to the tool that already has them, which is the next section.

Where an RMM Still Fits

An RMM's patch engine earns its place on four jobs Falcon does not claim. It carries a maintained catalog of third-party applications with per-application approval policies. It owns the maintenance window, the reboot prompt and the deferral limit the user sees. It runs per-client, so an MSP can patch one customer's accounting server on a different schedule from another's. And it produces the compliance report, which is where the last few percent of patch coverage gets chased down, as our guide to patch compliance explains.

The pairing that works is a division by urgency and by scope. Falcon takes the findings ExPRT.AI marks as actively exploited and patches them in a fast ring across the hosts it supports, because nobody else has the sensor's view of what adversaries are doing this week. The RMM takes the monthly cycle, the third-party catalog, the reboot choreography and the per-client reporting. Both read the same Spotlight findings, so the handoff is a filter rule, not a spreadsheet. An open RMM such as OpenFrame runs the routine rings and the reporting while Falcon's exposure data decides what jumps the queue. Flamingo builds OpenFrame, which competes with some of the tools covered here.

If you are choosing or replacing the RMM side, our patch management software comparison ranks 11 tools by fleet size, catalog depth and price. If you are weighing Falcon as a whole rather than the patching feature alone, start with the CrowdStrike Falcon review for MSPs, which covers the bundles, the MSP program minimums and the multi-tenant console.

Pricing and What to Ask For

Risk-based patching is not a line on CrowdStrike's public price list. You need a Falcon bundle, Falcon Exposure Management for the ranking, and the Falcon for IT module for the patching, with the module quoted per endpoint or inside a Falcon Flex commitment. Ask for four things in the quote: the Falcon for IT line itemised on its own, the supported-application list for risk-based patching with a date on it, the written answer on offline hosts, and the per-tenant reporting you will show a client or an auditor. With those in hand the comparison against your RMM's per-endpoint patching price is a two-column spreadsheet, and the decision is usually obvious by the third row.

Who Should Run Patching Through Falcon

Run the fast ring through Falcon if you already own Exposure Management, your security team is the one chasing exploited vulnerabilities, and your fleet is Windows, macOS and Linux endpoints the sensor sees every day. Keep the monthly cycle in the RMM if your clients need per-tenant schedules, third-party catalog depth, reboot handling and a compliance report with their name on it. Do both if you can get the catalog list in writing, and set the filter so an exploited finding never waits for the monthly window.

The short answer, one more time: CrowdStrike does patch management now, for the findings that matter most and the hosts it can see. The rest of the patch job still has an owner, and it should be the tool your technicians already run.