Patch tools are bought on a device count and a long list of supported applications.
This guide ranks twelve of them on first-ninety-day setup hours, which operating systems the price covers, how much third-party coverage sits behind a higher tier, and whether you can buy and run the product without a partner or sales call.
Vendors can pay for visibility on this page. It never changes what an entry
says about a product, including the criticism, and we earn nothing when you click through to a
vendor. How that works.
In short
What patch management software does
Patch management software finds missing operating system and application updates on servers and workstations, deploys them on a schedule, and reports which devices remain exposed or failed to install.
In this order: setup effort, what it really costs, how your data comes back out, whether
you can leave, and who each patch management tool is built for. One rule sits on top of those tests:
Places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Why those five, and why there is no
score out of ten, is on the how we work page.
Large enterprises patching Windows, Linux and Mac at very high device counts
Small teams or buyers wanting a published price
Country is where the vendor is headquartered or contracts from, which is a
different question from where your data is hosted. Where the two tell different stories, the
entry says so.
Cloud patching for Windows and macOS, priced per device per year
Ranked #1 of 12 in Best Patch Management Software in 2026.
Published pricingNorth America
PDQ Connect is the cloud product of PDQ.com Corporation, based in South Salt Lake, Utah. Basic covers patching and inventory, Plus adds automated deployments and remote desktop, and Premium adds vulnerability scanning and one-click CVE resolution.
Volume discounts are mentioned but not quantified. The same company sells PDQ Deploy & Inventory for on-premises use, so a team that prefers to keep servers in-house stays with one supplier.
What stands out
Published price
Windows and macOS
14-day trial
Where it costs you
The product pages describe Windows and macOS devices only, so Linux servers need a second tool.
Every tier carries a 100-device minimum, which raises the entry cost for very small fleets.
Vulnerability scanning and priority support are reserved for the Premium tier.
Right for
Sysadmins running mixed Windows and Mac fleets who want a published price
Wrong for
Anyone patching Linux servers or fewer than one hundred devices
United StatesPer device per year, three published tiers; 14-day trial
Third-party application patching that plugs into Intune, ConfigMgr and WSUS
Ranked #2 of 12 in Best Patch Management Software in 2026.
Published pricingNorth America
Patch My PC, LLC states that its services are operated from the United States. Enterprise Plus covers Windows and macOS patching across ConfigMgr and Intune, and Enterprise Premium adds analytics, CVE scores and true update compliance for Intune.
The pricing page cites a catalogue of 3878 supported products. A trial is offered, and invoices run on net 30 terms, which suits purchasing departments that cannot pay by card.
What stands out
Needs Microsoft stack
Published price
Third-party catalogue
Where it costs you
It works through Intune, Configuration Manager or WSUS, so it is not a standalone patching console.
Advanced reporting, CVE scores and true update compliance sit in Premium, not in the cheaper Plus tier.
Enterprise tiers are bought through a quote form with a yearly minimum, not a card checkout.
Right for
Organisations on Intune or Configuration Manager that lack third-party patching
Wrong for
Teams without Microsoft endpoint tooling or any Linux estate
United StatesPer device per year, published; trial available
German device-management server with patching in its no-cost core
Ranked #3 of 12 in Best Patch Management Software in 2026.
Free tierSelf-hostablePublished pricingEurope
opsi is made by uib GmbH, Bonifaziusplatz 1B, Mainz. The pricing page splits the product into Community, Basic, Professional and Enterprise editions, plus a cloud option with managed hosting of the server. Basic is free up to 30 devices.
Professional and Enterprise are priced per device per year, with lower education prices, and a six-week test licence is offered. Directory Connector, License Management and Audit Log are listed extensions in the higher tiers.
What stands out
Free Community edition
On-premises server
Per-device extensions
Where it costs you
The Community edition is an on-premises server you install and maintain yourself.
Paid Professional and Enterprise tiers have a 100-device minimum and require licensing every managed device.
The macOS agent is listed only in the Enterprise tier, and the Linux agent needs at least the Basic licence.
Right for
IT teams with their own servers who want no per-device fee for core patching
Wrong for
Offices wanting a hosted console with no server to maintain
GermanyFree Community edition; per device per year for paid tiers, published; test licence
Cloud patching billed per endpoint, with third-party titles in higher plans
Ranked #4 of 12 in Best Patch Management Software in 2026.
Published pricingNorth America
Automox Inc. gives an address in Austin, Texas. Patch OS covers Windows, macOS and Linux operating system patching. Automate Essentials adds 730+ third-party titles, software deployment, device configuration and API access, and Automate Enterprise adds multi-organisation management, FixNow immediate execution and AI-assisted automation.
A paid Resolve module for remote access, powered by Splashtop, is sold separately. The pricing page states a full-platform trial.
What stands out
Cloud console
Per-endpoint price
Trial available
Where it costs you
Third-party application patching starts at Automate Essentials, not in the entry Patch OS plan.
Automate Essentials and Enterprise are quoted through sales with volume discounts for 200 or more devices.
Core Remote Control is listed as an early preview on the pricing page.
Right for
Teams wanting cloud OS patching for all three platforms at a stated price
Wrong for
Buyers whose main exposure is third-party applications on a small budget
United StatesPer endpoint per month, published for OS patching; quoted for upper plans; trial available
Risk-ranked patching from an Indian vendor, sold via sales or marketplaces
Ranked #5 of 12 in Best Patch Management Software in 2026.
Pricing on requestAsia-Pacific
SecPod gives its India headquarters as Bengaluru, with research and development offices in Bangalore, Poland and Vietnam. Saner Risk-based Remediation combines patch management, configuration hardening against CIS, NIST, PCI DSS, HIPAA and STIG benchmarks, endpoint control and cloud remediation.
A 30-day trial is offered, and the Buy Now page lets you purchase through cloud marketplaces or contact sales for licensing and deployment models.
What stands out
Risk-based ranking
30-day trial
Bengaluru HQ
Where it costs you
The pages show no prices, so the cost is only visible after talking to sales.
Patching is sold inside a wider remediation platform, which adds scope to a purchase that may only want patching.
Cloud marketplace purchase is offered, which suits some buyers and ties billing to a cloud account for others.
Right for
Security teams that want vulnerability ranking and patching in one console
Wrong for
Small teams that only need scheduled operating system updates
IndiaSales-led licensing or cloud marketplace; 30-day trial
Patch scanner and deployer that is bought through resellers
Ranked #6 of 12 in Best Patch Management Software in 2026.
Pricing on requestNorth America
GFI Software lists an Austin, Texas address. LanGuard discovers computers, printers, routers and virtual machines, scans for missing patches in operating systems, browsers and third-party software, and deploys patches centrally or through agents.
Reports export to PDF, HTML, XLS and CSV and map to PCI DSS, HIPAA and SOX. The buy-now form asks about deployment size and passes you to a GFI partner rather than a checkout.
What stands out
Partner-sold
Vulnerability scanning
30-day trial
Where it costs you
Pricing is given only after a request routed to a certified partner or reseller.
The third-party patch examples on the product page are old products such as Flash Player and QuickTime.
Multiple sites need multiple installed instances, joined through a single web console.
Right for
Small networks that want scanning, auditing and patching from one installed tool
Wrong for
Buyers wanting a published price or a cloud console
United StatesSold through partners and resellers; 30-day trial
Ubuntu-only patching and compliance, bundled with an Ubuntu Pro subscription
Ranked #7 of 12 in Best Patch Management Software in 2026.
Self-hostablePublished pricingEurope
Landscape monitors machines through an agent on each Ubuntu system and lets you update, upgrade and manage users and permissions remotely. Canonical offers the server as a managed service, as software-as-a-service, or self-hosted.
The Ubuntu Pro page lists a workstation tier and a server tier priced per machine per year, with a personal tier for up to five machines. Canonical's terms are governed by the laws of England.
What stands out
Ubuntu estates only
Self-host or SaaS
Bundled with Pro
Where it costs you
The pages describe Ubuntu machines only, leaving Windows and macOS devices to another tool.
Landscape is not sold alone; it comes with an Ubuntu Pro subscription priced per machine per year.
Server-grade Pro subscriptions are priced far above the workstation tier.
Right for
Linux-heavy teams running Ubuntu on servers, desktops or edge devices
Wrong for
Organisations patching Windows, macOS or other Linux distributions
United KingdomBundled with Ubuntu Pro, priced per machine per year, published; 30-day trial
Danish security platform with patching sold as a bundled module
Ranked #8 of 12 in Best Patch Management Software in 2026.
Pricing on requestEurope
Heimdal Security A/S names Copenhagen as its address in its licence agreement. The patch page claims automated OS and third-party patching for Windows, macOS and Linux, scheduling, and delivery of custom software.
The navigation also lists vulnerability management, privileged access and endpoint detection, which is where a buyer can end up. A free trial button and a get-pricing link both appear on the page.
What stands out
Platform module
Third-party apps
Copenhagen HQ
Where it costs you
Price is given on request, and the site offers bundles rather than a single patching price.
The third-party catalogue is 350+ applications, below the 1100+ that ManageEngine lists.
The patching module sits inside a larger platform, so extras may be pulled into the quote.
Right for
Mixed-OS companies wanting patching alongside other security modules from one vendor
Wrong for
Buyers who want only patching at a published price
DenmarkPrice on request through a form, sold as bundles; trial available
Microsoft's own update server role, now deprecated but still supported
Ranked #9 of 12 in Best Patch Management Software in 2026.
Pricing on requestNorth America
Microsoft lists WSUS as a server role for Windows Server 2016, 2019, 2022 and 2025. The overview says it continues to be supported for production deployments and receives security and quality updates as per the product lifecycle.
Since March 2023 it handles Unified Update Platform updates for Windows 11 version 21H2 clients, which required a server update or manual MIME type additions in IIS. Microsoft Corporation gives an address in Redmond, Washington.
What stands out
Microsoft updates only
Deprecated
Server role
Where it costs you
Microsoft says WSUS is deprecated and is not adding new features.
The documentation covers Microsoft product updates, with nothing on third-party applications or macOS and Linux.
It runs on a Windows Server machine you maintain yourself, including IIS changes for newer update formats.
Right for
Windows-only networks with a server already running and a tight budget
Wrong for
Fleets with third-party applications, Macs or Linux machines
United StatesWindows Server role; no separate price on the documentation page
Per-computer patching with perpetual, annual or monthly cloud licensing
Ranked #10 of 12 in Best Patch Management Software in 2026.
Self-hostablePublished pricingAsia-Pacific
The pricing page lists separate tables for workstations and servers, each with annual, perpetual and monthly cloud columns, plus technician add-ons.
Enterprise adds drivers, BIOS and antivirus updates, scheduled remote shutdown, Wake on LAN, automated patch testing and approval, and bandwidth optimisation. The site says ManageEngine is the enterprise IT management division of Zoho Corp. and a 30-day trial needs no credit card.
What stands out
Perpetual licence
1100+ applications
30-day trial
Where it costs you
Each additional technician is a separate priced line, so the quote grows with the support team.
Patch testing, approval and bandwidth optimisation sit in the Enterprise edition, not Professional.
The wider Endpoint Central suite is a separate product, so adding vulnerability or device control means a second purchase.
Right for
Teams wanting a perpetual on-premises licence with a published price table
Wrong for
Buyers who want to avoid a large vendor portfolio
IndiaPer computer per year, perpetual or monthly cloud, published; 30-day trial
Cloud patching ranked by Ivanti's own vulnerability risk rating
Ranked #11 of 12 in Best Patch Management Software in 2026.
Pricing on requestNorth America
Ivanti, Inc. gives South Jordan, Utah, as its data protection address. The page describes risk-based prioritisation, patch reliability insights from anonymised deployment data, ring deployment, and continuous compliance that re-remediates offline devices when they return.
It also describes exposure-based compliance reporting that calculates exposure time per update, and three granted patents with five pending. The product is part of the wider Ivanti Neurons family.
What stands out
Risk-based ranking
Cloud-native
Neurons platform
Where it costs you
The product page gives no price and offers a demo or sales contact instead of a trial.
Device discovery uses the Neurons platform, so the patching product does not stand alone.
The risk rating is Ivanti's own scoring, which makes prioritisation harder to compare with CVSS-based tools.
Right for
Security-led teams that want exposure-based prioritisation delivered from a cloud console
Wrong for
Small teams wanting a quick start with a published price
United StatesSales-led; no prices on the product page
One-client enterprise patching for Windows, Linux and Mac at large scale
Ranked #12 of 12 in Best Patch Management Software in 2026.
Pricing on requestNorth America
Tanium Inc. gives its address as 2100 Powell Street, Emeryville, California. The page promises patching across Windows, Linux and Mac, advanced rule sets and maintenance windows, deployment status per patch, patch histories per machine and reboot status.
It claims patching without separate relay or database servers at branches. Metrics shown on the page include patch coverage as a percentage of endpoints and the share of outstanding critical patches.
What stands out
Single client
Enterprise scale
Demo only
Where it costs you
The product page shows no price and no trial, only a demo request and a data sheet.
It is built for enterprise scale, which is more than a small fleet needs.
Patching is one product on a wider platform, so a purchase may widen into other modules.
Right for
Large enterprises patching Windows, Linux and Mac at very high device counts
Wrong for
Small teams or buyers wanting a published price
United StatesSales-led demo; no prices on the product page
Patch management software finds missing operating system and application updates on servers and workstations, deploys them on a schedule, and reports which devices remain exposed or failed to install. The differences that matter are rarely in the feature list, so this is
the order we would work through them.
01
Decide whether you need a published price
6 of the 12 tools here publish what they cost; the other 6 quote per organisation. The ones you can compare without a sales call: PDQ Connect, Patch My PC, opsi, Automox, Canonical Landscape, ManageEngine Patch Manager Plus.
02
Decide how much the jurisdiction matters
These 12 vendors are established in 5 countries across 3 regions (North America 7, Europe 3, Asia-Pacific 2). That decides whose disclosure law applies to what the vendor holds, wherever the servers are.
Which devices does your patch management software price actually cover?
The first thing that goes wrong in this market is a quote that covers a smaller estate than the one you own. PDQ Connect lists Windows and macOS devices, so Linux servers fall outside it. Canonical Landscape describes Ubuntu machines only. Windows Server Update Services documents Microsoft product updates, and Microsoft calls it deprecated.
Automox covers Windows, macOS and Linux operating systems in its entry plan but moves third-party applications to a dearer one. Tanium states Windows, Linux and Mac. Before you request prices, list your operating systems, your server count and your applications, and ask each vendor in writing whether every line is inside the quote. A tool that covers eighty percent of the estate leaves you running two tools.
List every operating system and distribution you run, including servers and kiosks.
Ask whether servers are priced at the same rate as workstations.
Get the supported platforms in writing for the tier you are quoted.
Third-party applications decide the real price of patch management software
Operating system updates are the easy part; applications are where the catalogues differ widely. ManageEngine Patch Manager Plus lists 1100+ third-party applications, Heimdal lists 350+, Patch My PC cites 3878 supported products, and Automox lists 730+ third-party titles in Automate Essentials rather than its entry plan.
GFI LanGuard shows Flash Player and QuickTime among its examples, which suggests a catalogue that needs checking. Ask each vendor for the list, then compare it against what is installed on your machines today, not against a marketing count. The count matters less than whether your ten most used applications are inside it.
Export your installed application inventory before the trial and compare it to the catalogue.
Ask which applications need a higher tier or a custom package.
Check how quickly new application versions appear in the catalogue.
Buying patch tools through a sales call, a partner or a card
Patch management software splits into three buying routes, and the route decides the first ninety days. PDQ Connect, Patch My PC, ManageEngine and opsi publish per-device prices, so a manager can budget before any call (opsi also has a free tier). GFI LanGuard routes every enquiry to a certified partner, SecPod Saner sells through sales or cloud marketplaces, and Ivanti and Tanium show demos and sales contacts with no prices on the product pages.
Heimdal sells bundles on request. None of these is wrong, but the sales-led route adds conversations and a negotiated price that you cannot compare in advance. Decide which route your procurement can handle, and ask what the invoice will include after modules are added.
Ask for a written quote that names the modules, minimums and technician seats.
Check whether a reseller or partner is required to buy.
Ask what the price becomes when you add servers or a second site.
Plan the exit before the first agent goes out
Patch tools put an agent on every machine, so leaving one means touching every machine again. Windows Server Update Services is deprecated with no new features, which makes a migration plan a question of when, not whether. opsi and ManageEngine Patch Manager Plus can run on your own server, and ManageEngine sells a perpetual licence as well as subscriptions.
Canonical Landscape can be self-hosted, which keeps the management server under your control. Cloud tools such as Automox hold the patch policy and history on the vendor side. Before signing, ask how you export patch history and compliance reports, and what happens to the agent when the contract ends.
Ask for an export of patch history and compliance reports in a standard format.
Check whether the agent can be removed centrally.
Confirm what stays usable if you stop paying for updates.
What goes wrong most often when buying patch management software
Buying on the operating system count alone and discovering later that servers, Linux machines or macOS devices sit outside the quoted tier.
Counting a headline number of supported applications without checking whether your own ten most-used applications are in the catalogue.
Running a trial on a handful of test laptops, then deploying to production without a staged ring of pilot machines and a rollback plan.
Leaving Windows Server Update Services in place because it works today, even though Microsoft calls it deprecated and adds no features.
07
Frequently asked questions
7 answers
What is the best patch management software in 2026?
PDQ Connect leads our ranking of 12. PDQ.com has built sysadmin tools since 2001 and sells three per-device tiers with the prices on the page, so a buyer can work out the bill before speaking to anyone.
Setup is a cloud console plus an agent. The catches: the pages list Windows and macOS devices only, every tier has a 100-device minimum, and vulnerability scanning sits in the top tier.
Which patch management tools publish their pricing?
6 of the 12, with the pricing model each one publishes:
PDQ Connect: Per device per year, three published tiers; 14-day trial.
Patch My PC: Per device per year, published; trial available.
opsi: Free Community edition; per device per year for paid tiers, published; test licence.
Automox: Per endpoint per month, published for OS patching; quoted for upper plans; trial available.
Canonical Landscape: Bundled with Ubuntu Pro, priced per machine per year, published; 30-day trial.
ManageEngine Patch Manager Plus: Per computer per year, perpetual or monthly cloud, published; 30-day trial.
The other 6 quote per organisation.
Is there a free patch management tool?
opsi offer a free tier or a free self-hosted edition.
Where are these patch management software vendors established?
In 5 countries across 3 regions: North America 7, Europe 3, Asia-Pacific 2.
PDQ Connect: United States.
Patch My PC: United States.
opsi: Germany.
Automox: United States.
SecPod Saner: India.
GFI LanGuard: United States.
Canonical Landscape: United Kingdom.
Heimdal Patch & Asset Management: Denmark.
Windows Server Update Services: United States.
ManageEngine Patch Manager Plus: India.
Ivanti Neurons for Patch Management: United States.
Tanium Patch: United States.
Which patch management tools can you host yourself?
opsi, Canonical Landscape, ManageEngine Patch Manager Plus. The other 9 are hosted by the vendor only.
What should you use instead of PDQ Connect?
Patch My PC and opsi are the next two on this page. Patch My PC is for Organisations on Intune or Configuration Manager that lack third-party patching; opsi is for IT teams with their own servers who want no per-device fee for core patching.
Who should not buy PDQ Connect?
Anyone patching Linux servers or fewer than one hundred devices. The product pages describe Windows and macOS devices only, so Linux servers need a second tool..
If your patch management software product belongs among these 12, tell us what it does and who it is for. Inclusion is an editorial call; what a listing is and is not is set out under software advice.
