Patch Management Pricing 2026: Per-Endpoint Costs Compared (Tools vs Managed)

Short answer: Patch management is priced per endpoint (laptop, desktop or server) per month. Self-run patching tools sell a licence and leave the work — testing, chasing failed installs, proving compliance — to your team. A managed service puts that work inside the price: Brocent's managed patching starts from US$3.00 per endpoint per month on the patch management pricing page, with a monthly compliance report. Compare the licence plus your own time, not the licence alone.

Patch management software pricing looks simple: a number per device per month. The trouble is that the number buys very different things. One quote is a licence for a console you run yourself. Another is a service in which someone else deploys the updates, follows up the failures and hands you a report your auditor will accept. A third bundles patching inside a wider remote-management platform priced per technician. Put them side by side without unpicking what each includes and the cheapest line on the spreadsheet is often the most expensive programme.

This guide explains how patch management pricing is built in 2026, what the hidden costs per endpoint are, how a managed service compares with running a tool yourself, and what budgets look like for 25, 100 and 250 endpoints. It uses only prices Brocent publishes and Microsoft's own published figures; anything else is described by model, not by number.

What does patch management cost per endpoint?

Almost every patching product and service is priced per endpoint per month, or per endpoint per year. An endpoint is any device that receives updates: a Windows or Mac laptop, a desktop, a physical or virtual server. Three things move the rate:

• Fleet size: per-endpoint rates usually fall as the number of devices rises, and many vendors sell in seat bands.
• Scope of software: operating-system patching only, or operating system plus third-party applications such as browsers, PDF readers, Java and collaboration tools.
• Who does the work: a self-run tool where your staff operate the console, or a managed service where the provider deploys, remediates and reports.

Brocent's own managed figure is published: patching for Windows and macOS plus commonly exploited third-party applications, with a monthly patch-compliance report, from US$3.00 per endpoint per month. Larger fleets are scoped into higher tiers with expanded third-party catalogues and failed-patch remediation follow-up; the current tiers and their rates are on the patch management pricing page, which is the only place we keep the numbers so they never go out of date in an article.

Patch management software pricing: what a tool licence includes

A self-run patching tool typically gives you:

• An agent on each device that reports missing updates and installs approved ones.
• A console where you set policies: which updates, which devices, when, and how reboots are handled.
• A catalogue of third-party patches, which varies widely in size between products and tiers.
• Dashboards and exportable reports showing patched, pending and failed devices.

What a tool licence usually does not include is anyone to operate it. Your team decides what to approve, tests updates on a pilot group, watches the dashboard after every release, investigates devices that failed or never checked in, and produces the evidence when an auditor or insurer asks for it. Some vendors also charge a separate support fee on top of the headline per-device rate. If you want to compare named self-run platforms, the patch and RMM tools page lists the ones Brocent resells, with their own pricing.

Managed patch management cost: what a service includes

A managed patch management service is priced per endpoint in the same way, but the price covers the operation as well as the tooling:

• Deployment on a schedule: updates approved, piloted and rolled out in maintenance windows that suit your business.
• Third-party application patching: browsers, Java, PDF tools and other commonly exploited software, not just Windows Update.
• Failure follow-up: someone chases the devices that failed, were offline or need a reboot, rather than leaving them red on a dashboard.
• Prioritisation by severity: critical and actively exploited vulnerabilities go first.
• A monthly compliance report: patched, pending and failed counts, and what exposure was closed — the document an auditor or insurer actually asks for.

The monthly report is the part that turns patching from a task into evidence. If a quote cannot show you a sample, ask for one before you compare prices. Our guide to the patch management process walks through each of these steps in more detail.

What are the hidden costs per endpoint?

A low per-device licence rate can hide four costs that land on your side of the ledger:

• Administrator time. Reviewing each month's releases, piloting, approving, rebooting stubborn devices and investigating failures. Even a few hours a month is a real cost at your team's loaded hourly rate, and it does not stop when that person is on leave.
• Failed and missed devices. Laptops that are off the network on patch day, devices whose agent stopped reporting, servers that cannot reboot in office hours. A tool shows them; someone still has to fix them.
• Out-of-support operating systems. Devices that can no longer receive security updates at all, or only through a paid extension (see the Windows 10 section below).
• Evidence on demand. Producing a dated, audit-ready report from a tool can take an afternoon each time an insurer, auditor or client questionnaire asks for it.

To compare like with like, estimate the hours your team spends on patching each month, multiply by their loaded hourly cost, divide by the number of endpoints, and add the result to the licence price. That is your real per-endpoint cost of self-running.

What does Windows 10 add to patching costs in 2026?

Windows 10 reached end of support on 14 October 2025. Devices still running it receive no further security updates unless the organisation buys Extended Security Updates (ESU). Microsoft's published commercial ESU price is US$61 per device for the first year, doubling each year — US$122 in the second year and US$244 in the third and final year. Because the first ESU year ran from late 2025 to October 2026, any business device still on Windows 10 today is in the second-year price band.

For patch budgeting, that means two things. First, every remaining Windows 10 device carries an annual cost on top of any patching fee. Second, the cheaper long-term answer is usually to upgrade or replace those devices, and a patch inventory is the quickest way to see how many there are. Microsoft also publishes discounted ESU routes for some organisations that manage devices through its cloud services, so confirm the price that applies to your licensing before you budget.

Managed vs self-run patching compared

Comparison: three ways to buy patch management

• Self-run tool: lowest licence price per endpoint. Who does the work: your IT team operates the console, chases failures and produces reports. Hidden costs: administrator time, separate support fees on some products, gaps when the person who runs it leaves. Fits: firms with a capable internal IT person who has time every month.
• Remote-management platform with patching inside: patching is one module of a wider toolset, often priced per technician rather than per device. Who does the work: your team or your IT provider. Fits: IT teams or providers who need remote control, scripting and monitoring as well as patching.
• Managed patch management service: a per-endpoint price that includes deployment, third-party patching, failure follow-up and a monthly compliance report. Who does the work: the provider, with you approving policy and reviewing the report. Fits: firms of roughly 25 to a few hundred devices without spare IT time, or any firm that needs audit-ready evidence every month.

There is also a fourth option for firms already on a Managed IT plan: add patch management to the plan as an add-on. On Brocent's plans it is priced per endpoint per month, and you can select it alongside the plan in the homepage quote tool.

What would patch management cost for 25, 100 and 250 endpoints?

The figures below use only Brocent's published entry rate of US$3.00 per endpoint per month, to show the arithmetic. Larger fleets fall into higher tiers with their own published rates, so for 100 and 250 endpoints check the current figure on the pricing page and replace it in the same formula.

• 25 endpoints, managed (entry tier): 25 × US$3.00 = US$75 a month, or US$900 a year, including the monthly compliance report.
• 100 endpoints, managed: 100 × the published per-endpoint rate for that fleet size × 12 months.
• 250 endpoints, managed: 250 × the published per-endpoint rate for that fleet size × 12 months, with multi-site policies scoped in the quote.
• Any fleet, self-run: licence per endpoint × endpoints × 12, plus (monthly admin hours × loaded hourly cost × 12), plus any separate support fee.
• Any remaining Windows 10 devices: add the ESU price per device for the current year, or the cost of replacing them.

As an illustration of the self-run line only: if patching takes your administrator five hours a month at a loaded cost of US$40 an hour, that is US$200 a month of time — US$8 per endpoint for a 25-device office, before the licence. Replace these assumptions with your own.

What should you ask before you buy?

Use the same questions for every quote so that price differences trace back to real differences in scope:

• Which operating systems and which third-party applications are covered? Ask for the catalogue, not a sample list.
• What happens when a patch fails or a device is offline? Is follow-up included, or reported and left to you?
• How are critical and actively exploited vulnerabilities handled? Is there a faster path outside the normal monthly cycle?
• What does the monthly report show, and can we see a sample? Patched, pending, failed and exposure closed, by device and by site.
• Who approves updates, and how are reboots scheduled? Especially for servers and shared devices.
• Are there support fees, minimum terms or seat bands on top of the per-endpoint price?
• How does patching connect to vulnerability scanning? A scan shows what is still exposed after patching; see the security services pricing page for how the two are priced.

Frequently asked questions

How much does patch management cost per endpoint?

Self-run tools charge a licence per endpoint per month or year, with rates falling as the fleet grows. Brocent's managed patch management starts from US$3.00 per endpoint per month, including third-party application patching and a monthly compliance report; larger fleets are priced in higher tiers on the pricing page.

What is the difference between patch management software pricing and a managed service price?

Software pricing buys the tool; you operate it. A managed service price includes the people and process: approving, deploying, following up failures and reporting. Compare a tool's licence plus your team's time with the managed price.

Is patch management cheaper than the cost of a breach?

Patching is one of the most basic controls, and unpatched software is a common entry point in incidents. The honest comparison, though, is between ways of patching — a tool your team runs or a managed service — because doing nothing is not an option an insurer or auditor will accept.

Does patch management include third-party applications?

It depends on the product and tier. Many tools patch the operating system well but have limited third-party catalogues. Brocent's managed tiers cover operating-system updates and commonly exploited third-party software such as browsers, Java and PDF tools.

What are the hidden costs of patch management?

Administrator time, devices that fail or miss updates, separate support fees on some tools, out-of-support operating systems such as Windows 10 that need paid extended updates, and the time it takes to produce evidence for audits.

How much do Windows 10 extended security updates cost?

Microsoft's published commercial price is US$61 per device for the first year, US$122 for the second and US$244 for the third and final year. Business devices still on Windows 10 in November 2026 are in the second-year band.

Is patch management included in a Managed IT plan?

On Brocent's plans it is an add-on priced per endpoint per month, selectable in the quote tool. It is also included in the Security Starter Bundle; see the pricing pages for current figures.

How does patch management relate to security awareness training?

They cover different risks — software flaws versus people being tricked — and insurers often ask about both. If you are budgeting for both, our guide to security awareness training cost per user uses the same per-unit approach.

Next steps

Start with an inventory: how many endpoints, which operating systems, and how many are still on Windows 10. Then compare quotes on the same basis — licence plus time, or an all-in managed price with a monthly report. See the current managed tiers on the patch management pricing page, read how Brocent approaches cybersecurity services more broadly, or send us your endpoint count for a fixed quote.