What Is Patch Management Software?
Mix (15 tools)
- License: 1 open source · 14 proprietary
- Hosting: 0 self-hosted · 8 SaaS · 7 both
Patch management software automates the process of identifying, acquiring, testing, deploying, and verifying software updates (patches) across operating systems and third-party applications. It is a specialized discipline focused on keeping endpoints and servers current with security fixes, bug fixes, and feature updates.
Unlike broad endpoint management (MDM/UEM) tools that cover device enrollment, configuration profiles, app distribution, and compliance policies, patch management tools focus specifically on the patch lifecycle:
- OS patching – Windows updates (replacing WSUS), macOS softwareupdate, Linux package updates (apt, yum, dnf, zypper)
- Third-party app patching – keeping browsers, runtimes, productivity apps, and utilities updated across the fleet
- Vulnerability-based patching – prioritizing patches based on CVE severity, CVSS scores, and active exploit intelligence
- Patch testing and staging – deploying patches to test groups before production rollout
- Compliance reporting – proving patch status against frameworks (CIS, NIST, PCI-DSS, HIPAA)
- Rollback – reverting problematic patches when updates cause regressions
- Scheduling and maintenance windows – deploying patches during approved change windows to minimize disruption
- Agent-based vs agentless – agent-based tools install a lightweight daemon on each endpoint; agentless tools use existing protocols (WMI, SSH, WinRM) for remote patching
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Feature Matrix – Open Source / Free
| Feature | WSUS | Uyuni | Patch My PC |
|---|---|---|---|
| OS patching | Win | Linux | Via SCCM |
| 3rd-party apps | No | Custom | 900+ |
| Vuln prioritization | No | CVE audit | Via SCCM |
| Patch testing | Groups | Lifecycle | Via SCCM |
| Scheduling | GPO | Yes | Via SCCM |
| Rollback | Limited | Yes | Via SCCM |
| Compliance reports | Basic | OpenSCAP | Via SCCM |
| Agent | Built-in | Salt | SCCM client |
| Multi-tenant | No | Basic | SCCM hierarchy |
Feature Matrix – Cloud / MSP-Focused
| Feature | Automox | NinjaOne | CW Automate |
|---|---|---|---|
| OS patching | Yes | Yes | Yes |
| 3rd-party apps | 400+ | 200+ | 300+ |
| Vuln prioritization | Scanner int. | CVSS | Basic |
| Patch testing | Groups | Workflows | Groups |
| Scheduling | Yes | Yes | Yes |
| Rollback | Yes | Yes | Yes |
| Compliance reports | Yes | Yes | Yes |
| Agent | Lightweight | Combined RMM | Combined RMM |
| Multi-tenant | Yes | MSP-grade | MSP-grade |
| Feature | Datto RMM | Action1 | ME Patch Mgr | Heimdal |
|---|---|---|---|---|
| OS patching | Yes | Yes | Yes | Yes |
| 3rd-party apps | 300+ | 350+ | 950+ | 200+ |
| Vuln prioritization | Basic | CVE/CVSS | CVE/CVSS | Threat intel |
| Patch testing | Policies | Groups | Groups | Groups |
| Scheduling | Yes | Yes | Yes | Yes |
| Rollback | Yes | Yes | Yes | Yes |
| Compliance reports | Yes | Yes | Pre-built | Yes |
| Agent | Combined RMM | Lightweight | Standalone | Shared sec. |
| Multi-tenant | MSP-grade | Yes | Enterprise | MSP-grade |
Feature Matrix – Enterprise
| Feature | Ivanti | Intune | BigFix | SCCM | Qualys |
|---|---|---|---|---|---|
| OS patching | Yes | WUfB | Yes | Yes | Yes |
| 3rd-party apps | 400+ | Add-on | Fixlets | Add-on | Security apps |
| Vuln prioritization | RBVM | Defender | CyberFOCUS | Defender | TruRisk |
| Patch testing | Groups | Rings | Baselines | ADR/Collections | Jobs |
| Scheduling | Yes | Yes | Yes | Yes | Yes |
| Rollback | Yes | Limited | Fixlets | Limited | Yes |
| Compliance reports | Pre-built | Defender | Strongest | SSRS | Unified |
| Agent | Agent/less | MDM ext. | 15 MB | ~100 MB | ~5 MB |
| Multi-tenant | Limited | Lighthouse | Limited | No | MSSP |
OS Support Comparison
| Tool | Windows | macOS | Linux | UNIX |
|---|---|---|---|---|
| WSUS | Yes | No | No | No |
| Uyuni | No | No | Yes | No |
| Patch My PC | Yes | Intune | No | No |
| Automox | Yes | Yes | Yes | No |
| NinjaOne | Yes | Yes | Yes | No |
| CW Automate | Yes | Limited | Limited | No |
| Datto RMM | Yes | Limited | Limited | No |
| Action1 | Yes | Yes | Yes | No |
| ME Patch Mgr | Yes | Yes | Yes | No |
| Heimdal | Yes | Yes | Limited | No |
| Ivanti Patch | Yes | Neurons | Neurons | No |
| Intune | Yes | Limited | No* | No |
| BigFix | Yes | Yes | Yes | Yes |
| SCCM | Yes | Limited | Limited | No |
| Qualys Patch | Yes | Yes | Yes | No |
* = Intune supports Linux compliance policies but not patch deployment
Best cross-platform: BigFix (includes AIX and Solaris), Automox, Action1, and ManageEngine Patch Manager Plus offer the broadest cross-platform support for modern OS environments.
Third-Party App Patching Breadth
| Tool | Catalog Size | Notes |
|---|---|---|
| ME Patch Mgr | 950+ | Largest catalog |
| Patch My PC | 900+ | SCCM/Intune only |
| Automox | 400+ | Growing catalog |
| Ivanti Patch | 400+ | Enterprise focus |
| Action1 | 350+ | Growing rapidly |
| CW Automate | 300+ | Windows focus |
| Datto RMM | 300+ | Windows focus |
| NinjaOne | 200+ | Growing catalog |
| Heimdal | 200+ | Security-critical focus |
| BigFix | Fixlets | Custom authoring |
| Qualys Patch | Security apps | CVE-driven |
| WSUS | 0 | Microsoft only |
| Uyuni | Custom | RPM/DEB channels |
| SCCM | Add-on | Via catalogs |
| Intune | Add-on | Via Patch My PC |
Best third-party catalog: ManageEngine Patch Manager Plus (950+) and Patch My PC (900+) lead in catalog breadth. Patch My PC requires SCCM/Intune infrastructure.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol; the notes below flag which tools integrate with Authentik.
| Tool | OIDC | SAML | LDAP | AD | Authentik Notes |
|---|---|---|---|---|---|
| WSUS | No | No | No | Win | Windows auth only |
| Uyuni | No | No | Yes | Yes | LDAP via Authentik |
| Patch My PC | N/A | N/A | N/A | SCCM | Inherits SCCM auth |
| Automox | Yes | Yes | No | No | Full OIDC/SAML |
| NinjaOne | No | Yes | No | No | SAML via Authentik |
| CW Automate | No | Yes | Yes | Yes | SAML/LDAP via Authentik |
| Datto RMM | No | Yes | No | No | SAML via Authentik |
| Action1 | Yes | Yes | No | Entra | Full OIDC/SAML |
| ME Patch Mgr | Yes | Yes | Yes | Yes | Full OIDC/SAML/LDAP |
| Heimdal | No | Yes | No | Entra | SAML via Authentik |
| Ivanti Patch | Yes* | Yes | Yes | Yes | Full (Neurons) |
| Intune | Yes* | Yes* | No | Entra | Via Entra ID federation |
| BigFix | Yes | Yes | Yes | Yes | Full OIDC/SAML/LDAP |
| SCCM | No | No | No | AD | AD auth only |
| Qualys Patch | No | Yes | No | No | SAML via Authentik |
* = via Entra ID or cloud platform; not direct
Best SSO support: Automox, Action1, ManageEngine Patch Manager Plus, and BigFix offer the broadest SSO protocol support including OIDC.
Deployment Comparison
| Tool | Type | On-Prem | Cloud | Hybrid |
|---|---|---|---|---|
| WSUS | Server role | Yes | No | No |
| Uyuni | Self-hosted | Yes | No | No |
| Patch My PC | Service | Yes | Intune | Yes |
| Automox | SaaS | No | Yes | No |
| NinjaOne | SaaS | No | Yes | No |
| CW Automate | SaaS/On-Prem | Yes | Yes | Yes |
| Datto RMM | SaaS | No | Yes | No |
| Action1 | SaaS | No | Yes | No |
| ME Patch Mgr | SaaS/On-Prem | Yes | Yes | Yes |
| Heimdal | SaaS | No | Yes | No |
| Ivanti Patch | On-Prem/Cloud | Yes | Yes | Yes |
| Intune | SaaS | No | Yes | Co-mgmt |
| BigFix | On-Prem/Cloud | Yes | Relay | Yes |
| SCCM | On-Prem | Yes | CMG | Yes |
| Qualys Patch | SaaS | No | Yes | Gateway |
Pricing Comparison
| Tool | Model | Approximate Cost |
|---|---|---|
| WSUS | Free | Included with Windows Server |
| Uyuni | Free | Open source (GPL-2.0) |
| Patch My PC | Per-device/yr | ~$3/device/year (enterprise) |
| Automox | Per-device/mo | ~$3/device/month |
| NinjaOne | Per-device/mo | Contact vendor (bundled RMM) |
| CW Automate | Per-device/mo | Contact vendor (bundled RMM) |
| Datto RMM | Per-device/mo | Contact vendor (bundled RMM) |
| Action1 | Per-device/mo | Free (200 ep); ~$2/device/mo |
| ME Patch Mgr | Per-device/yr | From ~$345/yr (50 endpoints) |
| Heimdal | Per-device/mo | Contact vendor |
| Ivanti Patch | Per-device/yr | ~$15–30/device/year |
| Intune | Per-user/mo | Included in M365 E3/E5 |
| BigFix | Per-device/yr | ~$30–60/device/year |
| SCCM | Per-user or server | ~$67/user or $120/server |
| Qualys Patch | Per-asset | Contact vendor (bundled VMDR) |
Licensing Comparison
| Tool | License | Type |
|---|---|---|
| WSUS | Included (Win Svr) | Free |
| Uyuni | GPL-2.0 | Open source |
| Patch My PC | Proprietary | Freemium |
| Automox | Proprietary | SaaS |
| NinjaOne | Proprietary | SaaS |
| CW Automate | Proprietary | SaaS/On-Prem |
| Datto RMM | Proprietary | SaaS |
| Action1 | Proprietary | Freemium SaaS |
| ME Patch Mgr | Proprietary | Freemium |
| Heimdal | Proprietary | SaaS |
| Ivanti Patch | Proprietary | Perpetual/Sub |
| Intune | Proprietary | SaaS (M365) |
| BigFix | Proprietary | Perpetual/Sub |
| SCCM | Proprietary | Perpetual/Sub |
| Qualys Patch | Proprietary | SaaS |
Tools
15 tools.
Action1
Action1 is a cloud-native patch management and endpoint management platform that has gained rapid market adoption due to its generous free tier (200 endpoints) and modern, intuitive interface.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
Automox
Automox is a cloud-native IT operations platform that pioneered the shift from on-premise patch management (WSUS, SCCM) to a fully cloud-hosted model.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
ConnectWise Automate Patch Management
ConnectWise Automate (formerly LabTech) is a comprehensive RMM platform with built-in patch management capabilities.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
Datto RMM Patch Management
Datto RMM is a cloud-native RMM platform with integrated patch management, widely used by MSPs for endpoint management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
HCL BigFix
HCL BigFix is an enterprise endpoint management platform with extremely powerful patch management capabilities.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Directory / LDAP
Heimdal Patch & Asset Management
Heimdal Patch & Asset Management is a cloud-based patch management solution that is part of Heimdal’s broader cybersecurity platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
Ivanti Patch for Endpoints
Ivanti Patch for Endpoints (formerly Shavlik Patch, then Ivanti Security Controls) is an enterprise-grade patch management solution with deep roots in Windows patching.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Directory / LDAP
ManageEngine Patch Manager Plus
ManageEngine Patch Manager Plus is a comprehensive patch management solution that supports Windows, macOS, and Linux patching along with third-party application updates.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on · Directory / LDAP
Microsoft Intune Patch Management
Microsoft Intune is a cloud-based unified endpoint management (UEM) platform that includes patch management capabilities as part of its broader device management feature set.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
NinjaOne Patch Management
NinjaOne is a unified IT management platform that includes comprehensive patch management as a core feature of its RMM (Remote Monitoring and Management) solution.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
Patch My PC
Patch My PC is a third-party patch management solution that specializes in extending Microsoft SCCM (MECM) and Intune with comprehensive third-party application patching.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Qualys Patch Management
Qualys Patch Management is a cloud-based patching solution that is uniquely positioned in the market as a vulnerability-driven patch management tool.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
SCCM / Microsoft Endpoint Configuration Manager
Microsoft Endpoint Configuration Manager (MECM), still widely known as SCCM (System Center Configuration Manager), is Microsoft’s on-premise endpoint management platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Directory / LDAP
Uyuni
Uyuni is an open-source systems management solution that evolved from Spacewalk, the upstream project for Red Hat Satellite.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: saas, direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Directory / LDAP
WSUS (Windows Server Update Services)
Windows Server Update Services (WSUS) is Microsoft’s on-premise patch management solution for Windows environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Directory / LDAP
