Ivanti Alternatives: Which Product Are You Replacing?

Updated: September 2026

Ivanti sells under one name what are really five separate replacement decisions: ITSM, endpoint management, mobile device management, patch, and secure access. Nine of its products reach end of life on 31 December 2026, and Connect Secure support ends a month after that. This guide routes you by the product you run today, with published prices where they exist and public contract records where they don't.

TL;DR

• Start with the product. Neurons for ITSM, Endpoint Manager, EPMM, patch management and Connect Secure each need a different replacement.
• 31 December 2026. Nine Ivanti products hit end of life that day, Cherwell and Service Desk among them.
• 31 January 2027. Almost every Connect Secure release loses support, and staying current means buying new ISA hardware.
• No list price exists. Ivanti publishes none, so the only public unit price is a US federal contract at $45.45 per device.

The Replacement Map

Find the product on your invoice. The rest of this page follows the same order.

One correction before you go further, because several competing guides get it wrong. Ivanti Service Manager on-premises is not end of life. It was renamed Neurons for ITSM and still ships an on-premises 2026 release, with documentation updated on 4 August 2026. Cherwell is the product with the December date, not Ivanti's ITSM line as a whole.

The Calendar Doing the Work

Nobody shops for a replacement because a feature list disappointed them. They shop because a date landed in the budget cycle.

Ivanti's own End of Life index, last modified on 21 September 2026, lists nine products reaching end of life on 31 December 2026: Cherwell Service Management, Cherwell Asset Management, Service Desk (Powered by LANDESK), Desktop & Server Management, Endpoint Security (Powered by HEAT), PatchLink, Workspace Control, Virtual Desktop Extender and Browser Manager.

The sharpest detail sits inside that list. DSM 2026.1 shipped on 13 January 2026 and its full support ends on 31 December 2026. A version released in January loses support in December of the same year.

Connect Secure runs on its own clock. Per Ivanti's Granular Software Release EOL matrix, releases 22.7, 22.8, 25.1.0.x, 25.1.1.x and 25.1.2.x all end support on 31 January 2027. Only 25.1.3.x reaches 30 April 2027. Ivanti's N-2 policy gives each minor release roughly nine months.

There's a hardware clause underneath it. Ivanti states that ICS 25.1.2.x "is supported only on new ISA hardware (ISA 6500 and ISA 8500)," and that 25.1.3.x and later run only on that hardware plus supported virtual and cloud environments. Staying current on Connect Secure means a purchase order, not a download.

Ivanti isn't retiring Connect Secure. Its own VPN modernisation post, updated 12 February 2026, says the company "firmly believes that a zero trust architecture is the path forward but realizes at the same time that VPN won't be going away anytime soon." The forcing function here is the support calendar and the hardware refresh.

Ivanti Neurons for ITSM: Where Service Desks Land

This is the busiest lane, because Cherwell's December date pushes a large installed base at once.

A school district running 196,932 tickets a year posted about exactly this in January 2026. What makes the thread useful is that they evaluated Ivanti's own upgrade path first and passed on it.

The recurring theme in that thread is customization debt. The original poster describes a Cherwell instance with "so many customizations to the point it didn't resemble the out-of-box Cherwell anymore," and says managing it "takes up so much of my time". That's the thing to price when you move: configuration you can rebuild in a weekend, or customization you'll be re-implementing for a quarter.

Published prices, checked 22 September 2026:

For reference, Ivanti Neurons for ITSM carries 4.2 across 331 Gartner reviews, and Cherwell Service Management sits at 4.3 across 856 under a listing Gartner itself flags as Legacy.

Two things to budget for. Atlassian repackaged Jira Service Management in 2026 and the pricing page now serves Atlassian Service Collection rates, so confirm which bundle a quote covers. And Halo's US band opens at $99 per agent monthly for the first 24 agents, which is higher than the converted sterling figure suggests.

On data, set expectations early. Atlassian's own community confirms there's no dedicated Cherwell-to-JSM migration tool, so you're looking at CSV import or a partner toolkit. Wayne State University, moving Cherwell to TeamDynamix, published the blunt version: "Current tickets will not be migrated." Agents closed what they could and the legacy system stayed read-only.

If you're weighing the wider field rather than just the Ivanti exit, our ITSM software comparison prices the same tools against different incumbents.

The ServiceNow alternatives guide covers the enterprise end of that field, where several Cherwell refugees land.

Ivanti Endpoint Manager: The Rebuild Nobody Documents

EPM is the LANDesk lineage, and it's the hardest lane to leave cleanly.

No vendor publishes an import path from Ivanti EPM. ManageEngine's migration-paths page, updated 26 August 2026, lists Ivanti DSM, Ivanti EPMM and Ivanti Neurons as supported sources and omits EPM. NinjaOne and Microsoft don't document one either. Patch policies, provisioning templates, LANDesk scripts, inventory history and custom fields get rebuilt.

Watch the product names here. Ivanti DSM is a different product from Ivanti EPM, and much of the migration tooling content floating around targets DSM. Tooling written for one won't help you with the other.

The uninstall deserves its own line in the plan. Ivanti's agent removal article, last modified 21 September 2026, documents four constraints:

The utility reboots each device by default. Ivanti Antivirus has to come off separately, first. Removal leaves behind registry values and keys carrying the Ivanti and LANDESK GUID. And the device record stays in the core database, so a machine you redeploy comes back as a new record and your old inventory won't reconcile by identity.

The Intune line has a 2026 wrinkle worth checking against your licence position. Microsoft's pricing page states that from July 2026, select advanced capabilities are included in Microsoft 365 E3 and E5 at no additional cost. If you already hold E3, part of the replacement may be sitting in an entitlement you own.

Ivanti Endpoint Manager itself has no usable public review aggregate. Gartner now carries an Ivanti Autonomous Endpoint Management listing at 4.3 across 1,059 reviews, but that volume suggests several legacy endpoint listings merged into it, so it isn't a clean read on EPM.

On that last row, since we build it: OpenFrame puts a native RMM agent, remote access, device inventory and ticketing in one place, open source and self-hostable, and its Gen1 modules cover large areas of those categories rather than the whole of any one. It is not a Connect Secure replacement and we would not put it in that lane. The reason it belongs in this table is the same reason this section exists. If no vendor documents an import path and you are rebuilding EPM's automations from scratch, the question worth asking is what you rebuild them into.

Here is the platform walkthrough, so you can judge it before you shortlist it:

For the two destinations EPM teams pick between most often, NinjaOne vs Intune puts them head to head.

Ivanti EPMM: The Apple Question Has a 2026 Answer

Every EPMM migration plan opens with the same question. Do we have to wipe the fleet?

As of 2026, no, with conditions. Apple's device migration documentation supports moving managed devices between management services without wiping, and Jamf Pro's own guidance from 15 April 2026 confirms eligible devices "can be moved from one MDM server to another without wiping or manually re-enrolling them."

The conditions are where plans go wrong:

One claim to verify before you build a plan on it: several MDM vendors state that devices enrolled in Apple Business Manager on a pre-26 OS need a one-time reset to re-register before they qualify. That appears in vendor material, not on an Apple page. If it holds, an existing EPMM fleet still faces a reset cycle, so confirm it with your own account team.

And where Apple and Ivanti disagree, follow Apple. Ivanti's blog says existing configurations "will automatically be applied during migration." Apple's planning page says plainly that you need to re-create your enrollment profile and configurations in the new service.

A healthcare group moving 1,500 devices off Ivanti across six hospitals documented what the work looks like:

The replies carry the numbers a vendor deck won't. One admin who ran the same migration used a two-month transition window, pre-pushed the Intune app through MobileIron, bulk-uploaded serials as Corporate Device Identifiers so devices landed as company-owned, and recorded a walkthrough video that got over 75% of users through the move unassisted. Another ran both MDMs in parallel for one to two years on roughly 2,000 devices, using Apple Business Manager to repoint everything so any factory reset landed in Intune automatically. Their hard-won gotcha: don't restore an iCloud backup from an Ivanti-enrolled device onto an Intune-enrolled one.

Note the rename: Kandji became Iru in October 2025, and the product is now called Endpoint. Note the spread on its ratings too, 4.3 against 4.9 on the same product, which is why the review count matters as much as the score.

Like EPM, Ivanti EPMM and Neurons for MDM have no public review aggregate on Gartner, Capterra, G2 or TrustRadius. That absence is worth stating rather than filling with a number from a neighbouring product.

For the Apple side specifically, Apple MDM for business compares the enrollment paths in detail.

If Intune is the likely destination, our Microsoft Intune review covers where it falls short on third-party patching.

Ivanti Patch Management: The Cheapest Swap on the Board

Patch is the lane where leaving costs least and the published prices are the clearest.

Cost is also what practitioners raise first when they post about leaving. A sysadmin managing multiple disconnected networks put it directly: "We use Ivanti for patching mainly, and its just to expensive currently."

Read that thread for the constraints as much as the recommendations. Air-gapped networks and Linux coverage rule out several cloud-only tools before price enters the conversation, and one commenter makes the case for staying, reporting that Ivanti Security Controls deploys into mostly-offline environments and covers Red Hat and Oracle Linux at reasonable cost. Both positions are worth weighing.

Action1's free tier is the outlier. Two hundred endpoints, no feature restrictions, no expiry. For a team under that count, the patch line goes to zero.

PDQ Deploy is the one to model carefully if you're large. At $1,950 per admin per year with unlimited endpoints, the maths inverts the usual per-device curve: at 3,000 endpoints across two admins, that's $3,900 a year against $36,000 for a $1 per endpoint monthly tool.

This walkthrough covers what patch approval, deployment rings and reporting look like day to day in an on-premises-capable tool, which is the shape an on-premises or disconnected Ivanti estate needs:

Our patch management software guide prices the wider field.

Many patch projects pick up an adjacent control on the way, which endpoint privilege management covers.

Ivanti Connect Secure: A Hardware Bill With a Date on It

This lane is different from the other four. You're not just changing tools, you're changing the model, from a standing network tunnel to per-application brokered access.

Published prices here are unusually clear, because the challengers publish and the incumbents don't:

Cloudflare Access carries 4.5 across 209 Gartner reviews. Tailscale and Twingate have no meaningful analyst-review base as of September 2026, with one and three reviews respectively, so treat their scores as absent rather than high.

One documented capability separates them for contractor and BYOD access. Cloudflare Access supports browser-rendered SSH, VNC and RDP with no client software on the device. Twingate requires its client for private resources. Tailscale offers a browser-based SSH console, but SSH only. If unmanaged devices are part of why you still run a VPN, that difference decides the shortlist.

Expect a help-desk conversation about reauthentication. Cloudflare Access session length is configurable per policy, from immediate timeout to a month, which means users can hit different prompts for different apps instead of one VPN login a day. Worth scripting before cutover, not after.

Two caveats to raise in a proof of concept rather than take from us. Agentless ZTNA is generally described as offering less device-posture visibility, and per-application models are said to struggle with anything relying on network-level discovery. Both claims appear in competing vendors' material and we found no named, dated source documenting either in practice. What we can source is an absence: there is no published practitioner report of an Ivanti Connect Secure cutover. The ZTNA case studies in circulation are OpenVPN migrations. Plan from your own inventory.

What Ivanti Costs When Nobody Publishes a Price

ivanti.com/pricing returns a 404. Every product page we checked on 22 September 2026 carries a "Contact Sales" button and no figure.

Public procurement records fill some of that gap, and they're the most concrete pricing anyone can cite:

That first row divides to $45.45 per device. The record doesn't state the term, and the SKU string implies one year, so treat it as a reseller contract price on a federal vehicle rather than list. It is still the only public unit price for an Ivanti product we could find anywhere.

The second and third rows are worth sitting with. Two US federal agencies published contracts whose stated purpose is leaving Ivanti products, one of them naming the end-of-life date as the reason.

Note on the Vendr figure: several 2026 blog posts cite "Vendr 2026 data" as a $6,395 median. The live page on 22 September 2026 reads $11,212. The lower number is a stale snapshot.

The Three-Year Math

Here's a worked comparison for a 500-endpoint, 10-technician team replacing patch management and service desk. All figures are the published prices above, and the Ivanti column uses the $45.45 per device federal record as its only available anchor.

The endpoint line is the one that moves. The service desk line is closer than it looks once you account for implementation, which is why the customization question from the Cherwell thread matters more than the per-seat rate.

How to Choose

Four constraints decide this faster than any feature matrix:

Air-gapped or disconnected networks. This rules out cloud-only patch tools immediately. ManageEngine on-premises and PDQ stay in; Action1 and Automox don't.

Linux coverage. Ask for it explicitly. Several tools that market broad OS support mean Windows and macOS.

Apple fleet on pre-26 OS. Your migration window stretches, and you should budget for a reset cycle until the vendor claim above is confirmed either way.

On-premises requirement. If you need on-premises, you're choosing between ManageEngine, PDQ and self-hosted open source. That's the shortlist, and it's short.

One disclosure, since we publish this: Flamingo builds OpenFrame, the open, AI-native infrastructure layer listed in the endpoint table above. It sits in the endpoint, patch and ticketing lanes, not the secure access one.

Start with the row on your invoice. The December and January dates are fixed, the prices in the tables above are published and dated, and the migration work is larger in the EPM lane than anywhere else on this page. Price that lane first.