Protect

TechBag’s count of 20 RMM and patch products on price, Linux and third-party catalogues, the breach statistic behind the why, and the 2022 five, as of September 2026.

By TechBag

10 December 2024 · 7 min read · Facts checked September 2026

Illustration: The TechBag Journal

Our March 2022 post on patch management listed four benefits and five tools. The benefits were security, uptime, compliance and “product innovation”; the tools were Automox, LogMeIn Central, Patch My PC, NinjaOne and Acronis Cyber Protect Cloud. The question an Indian IT manager actually brings to us is narrower: which tool patches what I run, what does it cost per endpoint in rupees, and will it satisfy the auditor. So we counted the 20 products on TechBag’s RMM and patch guide on exactly those lines, and went back to the 2022 five. TechBag is an authorised NinjaOne partner; read the price section with that in mind.

01Why patch, in one number: 31%

Verizon’s 2026 Data Breach Investigations Report, covering incidents from 1 November 2024 to 31 October 2025, found that exploitation of a vulnerability was the first step in 31% of breaches, overtaking stolen credentials as the most common initial access for the first time in the report’s nineteen years.² ¹⁷ A vulnerability that is exploited is, by definition, one that was known and unpatched on the day. The 2022 post called this “security issues”. It is now the single largest door.

31%

of breaches in Verizon's 2026 report began with an exploited vulnerability, the most common first step for the first time in nineteen years

Verizon's global dataset, incidents from November 2024 to October 2025; not Indian incidents.

The patch cadence is no longer yours to set: three Indian clocks

Reporting and testing intervals in Indian regulation, as of September 2026

6 hours

Window to report a cyber incident to CERT-In

CERT-In Directions, 28 April 2022

6 months

Vulnerability assessment interval for banks' internet-facing systems

RBI Directions, 31 July 2026

12 months

Penetration test interval for the same systems

RBI Directions, 31 July 2026

Source: CERT-In Directions 2022; RBI Directions 2026 via practitioner summary · as of 30 September 2026

The first two tiles are why “compliance” moved from a benefit to a constraint. A bank that finds a critical vulnerability in its six-monthly assessment and cannot show it was fixed has an audit finding; a company that is breached through it has six hours to tell CERT-In.¹³ ¹⁴ The patch tool is the evidence either way, which is why reporting is the fourth stage below and not an afterthought.

02What the tool has to do: four stages, not one button

Every product on the guide describes itself as “automated patching”. What separates them is how many of the four stages they do on every operating system you run. The 2022 post’s checklist, “Windows, Linux and Mac; PCs, laptops and servers; automation; real-time reports”, was the right list; the tags on TechBag’s guide are those four items made testable.¹

Patching is a pipeline: detect, approve in rings, deploy in a window, prove it

The four stages TechBag tags every RMM and patch product against, August 2026

01
1. Inventory and detect
Every device, every OS, every third-party application, and which of them is missing what. The gap most tools hide is the application catalogue.
02
2. Approve in rings
A pilot group gets the patch first; the fleet follows after a set interval. The CrowdStrike update of 19 July 2024 is the case for rings.
03
3. Deploy in a window
Maintenance windows per site or client, reboot handling, failed-patch retries, and a rollback when the patch itself breaks something.
04
4. Prove it
A compliance report an auditor accepts: which devices are current, which are not, and why. This is the artefact the six-monthly RBI assessment asks for.

Source: TechBag RMM & Patch guide, architecture section · as of 30 September 2026

Stage one is where the money is. Operating-system patches are a solved problem on every product here. Third-party applications, browsers, PDF readers, Java runtimes, video-call clients, are where the exploited vulnerabilities live, and the products split three ways on how they handle them: a curated catalogue the vendor maintains across Windows, macOS and Linux; a catalogue for Windows and macOS only; or a hand-off to package managers such as WinGet, Chocolatey, Homebrew and APT, which is Atera’s approach.¹

03Price: 12 of 20 quote, 8 publish, two vendors give it away

Twelve of the 20 products are quote-only, including every ConnectWise, Datto, N-able and Qualys entry and LogMeIn Central.¹ Eight publish something. Six of those publish a number you can multiply: SuperOps at US$1.50 an endpoint a month on its internal-IT plans with a 100-endpoint floor, falling to US$1.20 above 1,000; ManageEngine Endpoint Central at the equivalent of US$1.33 to US$2.83 an endpoint a month, sold per 50 endpoints a year; NinjaOne at a published band of US$3.75 a device a month at 50 or fewer endpoints down to US$1.50 at 10,000, with the exact rate quoted; and Atera at US$149 a technician a month for unlimited devices.⁵ ⁶ ⁴ ⁷ Splashtop AEM states a ceiling of “under US$1” with a 100-endpoint minimum; LogMeIn Resolve draws its per-endpoint figure in the browser.¹

Published patch pricing runs from free to US$3.75 an endpoint a month; 12 of 20 products will only quote

Published per-endpoint list price, US$ per month, five RMM and patch products, September 2026

Action1, first 200 endpoints free, no feature limitsUS$0

Splashtop AEM vendor ceiling: under US$1US$1

ManageEngine Endpoint Central, fromUS$1.33

SuperOps, at 100 endpointsUS$1.5

NinjaOne, 50 or fewer endpoints US$1.50 at 10,000US$3.75

Table view

	Value (US$)
Action1, first 200 endpoints	0
Splashtop AEM	1
ManageEngine Endpoint Central, from	1.33
SuperOps, at 100 endpoints	1.5
NinjaOne, 50 or fewer endpoints	3.75

Source: Vendor pricing pages (Action1, SuperOps, NinjaOne) and TechBag's ManageEngine and Splashtop pages · as of 30 September 2026 · Action1 is free to 200 endpoints and quoted above; NinjaOne shows its highest published tier; Atera (US$149 a technician) is omitted as a different unit

Two free tiers change the arithmetic for a small company. Action1 is free for the first 200 endpoints with no feature limits, then priced per endpoint on an annual Growth plan plus a support subscription; ManageEngine Endpoint Central’s free edition stops at 25 endpoints.³ ⁶ A 150-device company can therefore patch Windows, macOS and Linux for nothing on Action1 today, and the question becomes whether it also needs the ticketing and remote control an RMM adds.

04Coverage: 11 patch Linux, 9 carry a cross-OS catalogue

Eleven of the 20 document Linux patching, meaning the tool deploys Linux updates rather than merely offering a remote shell to a Linux box.¹ Nine do not, and the nine include products a Windows-first buyer would never suspect: Splashtop AEM, LogMeIn Central and Resolve, TeamViewer Remote Management, both ConnectWise products and Datto RMM. If your estate has twenty Ubuntu servers, that list is eliminated before the demo.

Only 9 of 20 patch tools carry a curated third-party catalogue across Windows, macOS and Linux

Third-party application patching mechanism, share of 20 RMM and patch products (five squares a product), vendor documentation August 2026

45%

Curated catalogue, Windows + macOS + Linux

9 of 20

50%

Curated catalogue, Windows + macOS only

10 of 20

Package managers (WinGet, Chocolatey, Homebrew, APT)

1 of 20: Atera

Source: TechBag RMM & Patch guide, third-party mechanism tag · as of 30 September 2026

The catalogue is the test to run in the trial. Write down the twenty applications your users actually have installed, then check each one against the vendor’s list. NinjaOne’s catalogue is the broadest on the guide; SuperOps’s is thinner; and Action1’s macOS catalogue is about 30 applications against a far longer Windows one.¹ A miss on that list is not a gap in the demo. It is a device someone patches by hand, every month, forever.

05The 2022 five, four years on

Two of the five tools we recommended in 2022 are not on TechBag’s guide at all, and we say so rather than rate them. Of the three that are, one is quote-only with no Linux, one publishes a band and became a Gartner Leader, and one sells patching as an add-on pack to a backup product.

Of the 2022 five, one is now a Gartner Leader with a published band, one is quote-only without Linux, two are unassessed

The March 2022 shortlist against each product's documented standing, September 2026

As pitched in March 2022

Automox: closes the attack aperture by more than 80%
LogMeIn Central: remote access, patching, automation in one
Patch My PC: automated third-party patching for enterprises
NinjaOne: #1-rated ease of use, quickest implementation
Acronis Cyber Protect Cloud: backup, anti-malware and patching in one

Documented standing, September 2026

Automox: not assessed on TechBag's guide; the 80% claim was the vendor's and is not repeated
LogMeIn Central: still sold, quote-only per device; Windows and third-party patching, no Linux, no PSA
Patch My PC: not assessed on TechBag's guide
NinjaOne: published US$1.50 to US$3.75 a device a month; Leader, Gartner Magic Quadrant for Endpoint Management Tools, 5 January 2026
Acronis Cyber Protect Cloud: patching is the Advanced Management pack on a backup base, sold per client through providers

Source: TechBag RMM & Patch guide and product pages; NinjaOne press release, 7 January 2026 · as of 30 September 2026

LogMeIn Central is the instructive one. It is a mature Windows-fleet manager with genuine remote-access depth, and its patching is competent for Windows and third-party applications; it has no documented Linux patching, no mobile management and no PSA, and it is quote-only.⁸ In 2022 it was a reasonable all-in-one. In 2026 a patch-first buyer gets more coverage for a published price from Action1 or NinjaOne, which is what the guide says and what we say here. NinjaOne, for its part, publishes a band and quotes the exact rate, and was named a Leader in Gartner’s Magic Quadrant for Endpoint Management Tools dated 5 January 2026; TechBag is an authorised NinjaOne partner, so weigh that sentence accordingly.⁴ ¹⁰ Acronis is a different purchase: a provider buys the backup base and adds the Advanced Management pack for patching and RMM per client, so it suits an MSP that already sells Acronis backup more than an IT team buying a patch tool.⁹

If you are buying this in India

In rupees, at ₹83 to the dollar and before GST, SuperOps’s US$1.50 is about ₹125 an endpoint a month, ManageEngine’s US$1.33 about ₹110, NinjaOne’s band about ₹125 to ₹311, and Action1 is ₹0 until the 201st endpoint; every invoice adds 18% GST.⁵ ⁶ ⁴ ³ Where the console runs matters as much as the price. ManageEngine is Chennai-headquartered with data centres in Chennai and Mumbai and a full on-premises edition; Action1 committed to Indian data residency by 1 April 2026 and TechBag could not find it live by September 2026; NinjaOne’s approved sub-processors list hosting on AWS in the USA, Canada, Germany and Australia; SuperOps hosts in the US or Europe.⁶ ¹¹ ¹² ¹

Three obligations set the cadence. The CERT-In Directions of 28 April 2022 require incident reporting within six hours and 180 days of logs within Indian jurisdiction, and a patch tool’s deployment log is part of that record.¹³ The RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026require banks to run a vulnerability assessment every six months and a penetration test every twelve on internet-facing systems; the patch compliance report is the evidence that findings were closed.¹⁴ The DPDP Rules, notified on 13 November 2025, bring the security-safeguard duties into force on 13 May 2027, and the 2023 Act’s schedule sets penalties of up to ₹250 crore for failing to keep reasonable safeguards; an unpatched known vulnerability is the simplest failure of that test to prove.¹⁵ ¹⁶

How we did this

Figures as of 30 September 2026

All counts are TechBag’s, from the 20 product rows on the RMM and patch decision guide (12 vendors). Each row’s tags (documented Linux patching, third-party mechanism, pricing model, free tier, on-premises option) were set from vendor documentation on 22 August 2026; remote control to a Linux device does not count as Linux patching. “Published” means a figure or band printed on the vendor’s own pricing page; “a number you can multiply” excludes a ceiling (Splashtop) and a figure drawn only in the browser (LogMeIn Resolve). Prices were read from Action1 (August 2026), NinjaOne and SuperOps (mid-2026), and Atera (September 2026) and from TechBag’s ManageEngine page; INR uses ₹83 to the dollar. The breach statistic is Verizon’s 2026 DBIR as summarised by Descope and Help Net Security; the report PDF was not fetched. The RBI Directions are cited through a practitioner summary. Automox and Patch My PC are not on TechBag’s guide and are not rated.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

Related on TechBag: the RMM and patch management guide holds the 20 rows counted here and the cost table at 200, 500 and 2,000 endpoints; the Action1 Patch Management page covers the free tier; the NinjaOne Patch Management page has the trial questions for the catalogue test.

Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Keep reading

Endpoints & devicesWindows 10 still runs 41% of India's Windows PCs a year after its end; world 28%14 October 2026 · 7 min

Endpoints & devicesTwo NinjaOne case studies, five numbers, and no baseline3 September 2026 · 3 min

Endpoints & devicesThree Gartner Leaders skipped MITRE's latest test: what AI endpoint security measured25 August 2026 · 9 min