# RMM & Patch — a TechBag decision guide

*Last reviewed 2026-10-03.*

- Canonical: https://www.thetechbag.com/browse/endpoint-management/rmm-patch
- Products compared: 25

The full narrative — hero claim, boundary section, decision variables, cost analysis and
failure modes — is on the page itself at https://www.thetechbag.com/browse/endpoint-management/rmm-patch.
This file carries the product data and the complete narrowing logic.

## The 25 products

### Qualys Patch Management — Qualys

- **Who it's for:** Estates where patching is driven by VULNERABILITY RISK rather than by a monthly update cycle. Qualys finds the vulnerability and fixes it from the same agent and the same console, so the prioritisation and the remediation share one risk model instead of being reconciled across two tools — which is the handover where most remediation programmes actually leak. The India platform is Pune-engineered, which matters for a residency conversation.
- **The honest limitation:** This is not an RMM: no PSA, no ticketing, no remote-control-led workflow, no mobile management. If you want one console for helpdesk and endpoint operations, look at NinjaOne or Atera instead. It is also quote-only and sold as part of a platform, so the sizing conversation is about the whole TruRisk entitlement rather than a per-device patch price.
- **Price:** Quote — per asset / year, quoted — sold on the Qualys Enterprise TruRisk Platform alongside VMDR rather than as a standalone RMM; TruRisk Eliminate adds mitigation where no patch exists
- **Details:** https://www.thetechbag.com/qualys/qualys-patch-management

### NinjaOne Patch Management — NinjaOne

- **Who it's for:** Teams that want patching with real deployment discipline — approval rings so updates reach a pilot group before the fleet, scheduling that respects maintenance windows, and reporting an auditor will accept. Cross-platform including Linux, with a third-party application catalogue, which is the part most native tooling handles badly.
- **The honest limitation:** It is a capability of the NinjaOne platform, not a standalone product, so you are really evaluating NinjaOne — see the NinjaOne RMM entry for the commercial shape, including the published per-device band and the quote that sets the exact rate. If you want patching WITHOUT an RMM platform underneath it, Action1 or Qualys are the cleaner comparisons.
- **Price:** $1.50–3.75 — per device / month — NinjaOne publishes $3.75 at 50 or fewer endpoints down to $1.50 at 10,000 and quotes the exact rate; the patching capability within the NinjaOne platform rather than a separate purchase; approval rings and scheduled deployment across Windows, macOS and Linux plus a third-party application catalogue
- **Details:** https://www.thetechbag.com/ninjaone/ninjaone-patch-management

### SuperOps Patch Management — SuperOps

- **Who it's for:** Mixed Windows, macOS and Linux estates that want one patch policy across all three rather than a side process for whichever platform the tool half-covers — with maintenance windows per client, failed-patch visibility, and failures that raise tickets because the service desk is in the same product.
- **The honest limitation:** The third-party application catalogue is thinner than NinjaOne's, which has the broadest in the category. Build your top-20 application list and check it during the trial — that single test decides this purchase, and a miss means manual patching forever. The IT plans' 100-endpoint minimum is hard, and hosting is the US or Europe only — no India region.
- **Price:** $1.50 (≈ ₹125) — per endpoint / month at the 100-endpoint minimum on the internal-IT plans, PUBLISHED — patching is included in both rather than gated behind a tier, and the same rate carries the RMM and the service desk; MSPs buy per technician instead (Standard RMM $99, Super $159 a month on annual billing, 150 endpoints each)
- **Details:** https://www.thetechbag.com/superops/superops-patch-management

### Action1 Software Deployment — Action1

- **Who it's for:** Teams whose real problem is not patching what is installed but controlling WHAT is installed — pushing a new application to a fleet, updating one that is not in any catalogue, or removing software that should not be there. The uninstall half matters more than vendors usually admit: unremoved software is unpatched attack surface that nobody is tracking.
- **The honest limitation:** Windows-first — Linux is not a documented patching target here, so mixed estates need something else alongside. And it is one capability of the Action1 platform rather than a standalone purchase; the free-to-200-endpoints tier and per-endpoint pricing above it are Action1’s, not this feature’s.
- **Price:** Quote — per endpoint / month above the free tier — the same entitlement as the rest of Action1, so deployment is not a separate line item. Deploy, install, update AND uninstall applications, including custom packages
- **Details:** https://www.thetechbag.com/action1/action1-software-deployment

### Action1 Vulnerability Remediation — Action1

- **Who it's for:** Organisations under CERT-In or sectoral pressure to demonstrate that vulnerabilities are not merely FOUND but FIXED, within a defined window. Most estates run a scanner and a separate deployment tool, and the gap between them is where remediation programmes fail — findings get exported, assigned, and quietly age. One tool that does both removes the handover entirely, and the free tier means you can prove it works before spending anything.
- **The honest limitation:** Windows-first, so Linux and macOS-heavy estates need something alongside it. Its vulnerability detection is not as deep as a dedicated scanner — if you need the breadth of Qualys or Tenable for the FINDING half, use Action1 for the fixing and accept two tools. And the free tier, while genuinely generous, is a starting point rather than a permanent answer at scale.
- **Price:** Quote — per endpoint / month above the free tier. Continuously discovers vulnerabilities and remediates them from the same agent — find and fix in one tool rather than two
- **Details:** https://www.thetechbag.com/action1/action1-vulnerability-remediation

### LogMeIn Central — GoTo / LogMeIn

- **Who it's for:** Teams already standardised on LogMeIn for remote access who want monitoring and patching in the same console rather than adding a second platform. The remote-access heritage is genuine depth rather than a bolted-on afterthought, and for a helpdesk-led operation that is the workflow people actually live in.
- **The honest limitation:** Remote-access-first rather than patch-first: the patching is competent for Windows and third-party applications and it is not the reason anyone buys this. No documented Linux patching, no mobile management, no PSA. If patching is your primary requirement rather than remote access, Action1, NinjaOne or ManageEngine are stronger answers and cheaper ones.
- **Price:** Quote — per device, quoted by edition — the veteran cloud endpoint-management platform: remote access at fleet scale plus monitoring, Windows and third-party patch management, and LogMeIn Antivirus as a paid module
- **Details:** https://www.thetechbag.com/goto/goto-central

### NinjaOne RMM — NinjaOne

- **Who it's for:** Internal IT and MSPs wanting the broadest Windows / macOS / Linux RMM — patching, scripting, remote access — with MDM, backup and endpoint security as add-ons in the same console.
- **The honest limitation:** Only a price band is published and the exact rate is quoted; small fleets sit at the top of the band, per-device billing climbs linearly with the fleet, and MDM, backup and endpoint security are each a separate paid add-on.
- **Price:** $1.50–3.75 — per device/mo — NinjaOne’s published band: $3.75 at 50 or fewer endpoints, falling to $1.50 at 10,000 (USD; varies by region and products bought); exact rate by quote
- **Details:** https://www.thetechbag.com/ninjaone/ninjaone-rmm

### Atera RMM — Atera

- **Who it's for:** Small IT teams running many devices: headcount, not fleet size, sets the bill — RMM, patching, remote access and a PSA in one.
- **The honest limitation:** Every login is a paid seat (no read-only tier); Network Discovery adds $29 per technician (AI Copilot is now in every plan); third-party patching rides on WinGet / Chocolatey / Homebrew / APT rather than a curated catalog.
- **Price:** $149 (≈ ₹12,367) — per technician/mo, unlimited devices (Professional, annual; Expert $189, Master $219)
- **Details:** https://www.thetechbag.com/atera/atera-rmm

### SuperOps RMM — SuperOps

- **Who it's for:** Small-to-mid MSPs (roughly 1–25 technicians) and internal IT of similar scale who want a price they can read off a public page and the service desk in the box rather than as a second contract — India-built in Chennai, so support hours match the Indian working day.
- **The honest limitation:** The third-party application catalog is thinner than NinjaOne's — build your top-20 application list and check it in the trial, because that single test decides this purchase. The IT plans' 100-endpoint minimum is hard, hosting is the US or Europe with no India region and no self-hosted option, and no analyst quadrant placement is possible for MSP-centric RMM vendors.
- **Price:** $1.50 (≈ ₹125) — per endpoint/mo at the 100-endpoint minimum — PUBLISHED; $1.40 (101–500), $1.30 (501–1,000), $1.20 (1,000+). Prime Plus $2.50 early-bird (list $3.00) → $2.00. That is the internal-IT price book; MSPs pay per technician — Standard RMM $99, Pro $129, Super $159 a month on annual billing, 150 endpoints per licence
- **Details:** https://www.thetechbag.com/superops/superops-rmm

### N-able N-central — N-able

- **Who it's for:** MSPs running many client estates that must be genuinely separated — architectural multi-tenancy with per-client policy and role-based access, plus SNMP network-device monitoring that can retire a second monitoring system, across Windows, macOS, Linux and cloud.
- **The honest limitation:** The heavyweight of N-able's TWO platforms, and choosing wrongly is the expensive mistake here: it takes weeks rather than days to stand up because the policy is designed, not switched on. If you manage one estate, N-sight is the right answer. Quote-only with no published rate card, and the Bengaluru GCC does not answer data residency.
- **Price:** Quote — per device / month, quote-only — third parties report ~$1.50–3.50 by volume, term and bundle, with an Essentials edition from ~$1.05; those are REPORTED figures, not N-able's own
- **Details:** https://www.thetechbag.com/n-able/n-able-n-central

### N-able N-sight — N-able

- **Who it's for:** Support-led shops and lean IT teams with one estate (or a handful they need not wall off) who want monitoring, cross-OS patching, ticketing and a genuinely strong attended and unattended remote-support workflow — working in days rather than weeks.
- **The honest limitation:** Lighter multi-tenancy than N-central, and SNMP network-device monitoring is not a strength — if either is load-bearing, buy N-central and accept the longer implementation. Automation is shallower than N-central's policy engine. Quote-only, like the rest of the portfolio.
- **Price:** Quote — per device / month, quote-only — reported below N-central; both platforms share the same patch engine, so Windows, macOS and Linux coverage is identical
- **Details:** https://www.thetechbag.com/n-able/n-able-n-sight

### Action1 — Action1

- **Who it's for:** Patch-first teams: Windows / macOS / Linux patching, software deployment and vulnerability remediation, free until the 201st endpoint.
- **The honest limitation:** Patch-and-deploy first, RMM second — monitoring and alerting are lighter than NinjaOne or Atera, there is no PSA, and the macOS third-party catalog (~30 apps) is far narrower than Windows.
- **Price:** Quote — per endpoint/mo beyond 200 (Growth, annual) + a support subscription
- **Details:** https://www.thetechbag.com/action1/action1-patch-management

### Action1 RMM & Remote Access — Action1

- **Who it's for:** Lean IT teams and MSPs that want remote control and endpoint visibility on the SAME agent that already patches the fleet — one tool, one agent, no second console to stand up. The case is efficiency for endpoint-centric teams rather than breadth.
- **The honest limitation:** These are the remote ESSENTIALS on a patch-first platform, NOT a full RMM+PSA — Action1’s own positioning. No ticketing, no PSA or billing, no SNMP or network-device monitoring and no mobile admin app. NinjaOne, Atera and ManageEngine Endpoint Central do materially more here, and TechBag sells all three.
- **Price:** Quote — per endpoint / month above the free tier — the same entitlement as the rest of Action1, so the remote-management features are not a separate line item. Real-time monitoring and alerts, browser-based remote desktop, remote PowerShell/Bash scripting and multi-tenant views
- **Details:** https://www.thetechbag.com/action1/action1-rmm-remote-access

### ManageEngine Endpoint Central — ManageEngine

- **Who it's for:** Teams wanting RMM-grade patching and software deployment inside a full UEM — on-prem, or India-hosted.
- **The honest limitation:** Windows-first console heritage shows; each edition includes one technician (more are paid), and multi-tenancy is the separate Endpoint Central MSP edition, not a switch.
- **Price:** $1.33–2.83 (≈ ₹110) — per endpoint/mo equivalent — Professional → Security, per 50 endpoints a year, on-prem
- **Details:** https://www.thetechbag.com/manageengine/manageengine-endpoint-central

### Splashtop AEM — Splashtop

- **Who it's for:** Teams already on Splashtop remote access adding real-time OS and third-party patching, CVE visibility and scripting — same agent, no second tool.
- **The honest limitation:** Patches Windows and macOS only (Linux is remote-control only), 100-endpoint minimum, and monitoring / alerting depth sits below a full RMM.
- **Price:** Under $1 (≈ ₹83) — per endpoint/mo (vendor-stated ceiling); 100-endpoint minimum; one technician licence per 10 endpoints
- **Details:** https://www.thetechbag.com/splashtop/splashtop-aem

### LogMeIn Resolve — GoTo / LogMeIn

- **Who it's for:** Helpdesk-first teams wanting remote support, ticketing, patching and a built-in MDM in one light console.
- **The honest limitation:** Windows and macOS patching only; monitoring and scripting are lighter than NinjaOne or Atera, and patching is not in the entry Starter plan — Windows patching starts at Advanced and application patching at Complete; the product was renamed from GoTo Resolve.
- **Price:** Per endpoint — per endpoint/mo, billed annually — Starter · Advanced · Complete; 25-endpoint minimum, unlimited technician users; patching starts at Advanced (Windows), application patching and MDM at Complete; GoTo draws the dollar figures in the browser, so TechBag confirms today’s per-endpoint price
- **Details:** https://www.thetechbag.com/goto/goto-resolve

### TeamViewer Remote Management — TeamViewer

- **Who it's for:** TeamViewer estates adding monitoring, asset and patch management to the remote-access agent already on every machine.
- **The honest limitation:** Quote-only with a 100-endpoint minimum; patching is Windows / macOS only and starts at the Advanced tier; remote-access-first, so monitoring and scripting are add-on-grade beside a dedicated RMM.
- **Price:** Quote — per endpoint, annual (TeamViewer ONE Standard / Advanced / Enterprise; patching from Advanced)
- **Details:** https://www.thetechbag.com/teamviewer/teamviewer-remote-management

### ConnectWise RMM — ConnectWise

- **Who it's for:** MSPs that want a cloud-native RMM with NOC-tested Windows updates, third-party patching and ScreenConnect built in, on the same ConnectWise Platform as its PSA and SIEM.
- **The honest limitation:** Quote-only, cloud-only, and ConnectWise documents no India storage region; Linux patching is not documented (Linux is monitored), and it shares 2025’s code-signing certificate rotation with ScreenConnect and Automate.
- **Price:** Quote — quote-only in three packages — Essentials, Pro and Premium (Premium adds unlimited ScreenConnect agents, ScreenConnect Remote Support and Microsoft 365 backup); ConnectWise publishes no price
- **Details:** https://www.thetechbag.com/connectwise/connectwise-rmm

### ConnectWise Automate — ConnectWise

- **Who it's for:** MSPs that want the deepest scripting and automation in the ConnectWise range and need to host the RMM on their own server — the self-hosted route for data kept in India.
- **The honest limitation:** ConnectWise says it “primarily supports Windows”; self-hosting means you patch the Automate server yourself (several critical fixes since 2024), and prices are quote-only.
- **Price:** Quote — quote-only; hosted on your own Windows server with MySQL or in ConnectWise’s cloud — ConnectWise’s own FAQ calls it a separate tool from ConnectWise RMM
- **Details:** https://www.thetechbag.com/connectwise/connectwise-automate

### Datto RMM — Datto

- **Who it's for:** MSPs that want a cloud RMM with Windows patching, ransomware detection and Microsoft 365 user management, sold together with Datto backup and Kaseya security.
- **The honest limitation:** Cloud-only on AWS with no India platform (Ireland, US and Sydney); native patching is Windows-only (Macs via a component, Linux not documented); phones and tablets are not in the console today — native Apple MDM is announced for October 2026.
- **Price:** Quote — quote-only standalone (third-party patching, Advanced Software Management, is a separate licence there); also the RMM inside Kaseya 365 Endpoint, reported at $5.25 (Pro) or $2.25 (Express) per endpoint a month with a 50-endpoint minimum, which includes it
- **Details:** https://www.thetechbag.com/datto/datto-rmm

### Kaseya VSA 10 — Kaseya

- **Who it's for:** MSPs and internal IT teams that want an RMM they can run SaaS or on their own Windows server, with policy-driven OS and third-party patching, standard-language scripting and Android Enterprise management in the same console.
- **The honest limitation:** Quote-only, and the PSA (Kaseya BMS or Autotask) is a separate product; Kaseya sells a second RMM, Datto RMM, so check which one your bundle includes; an on-premises server is yours to harden and patch — the 2021 REvil attack exploited zero-days in on-prem VSA 9.5.
- **Price:** Quote — per device, quote-only; third-party patching is a separate per-device licence; also an RMM option inside Kaseya 365 Endpoint; SaaS or on-premises
- **Details:** https://www.thetechbag.com/kaseya/kaseya-vsa

### Heimdal Patch & Asset Management — Heimdal

- **Who it's for:** Teams that want patching and asset inventory from the same agent as Heimdal’s DNS filtering and antivirus.
- **The honest limitation:** Not an RMM: no PSA, scripting-led remote management or mobile devices; Linux has no agent interface; quote-only, and tenant data stays in Europe, the US or the UK.
- **Price:** Quote — per device / year, quoted — OS and 350+ third-party application updates on Windows, macOS and Ubuntu from Heimdal’s cloud dashboard, with software inventory
- **Details:** https://www.thetechbag.com/heimdal/heimdal-patch-asset-management

### WatchGuard Patch Management — WatchGuard

- **Who it's for:** WatchGuard Endpoint Security estates that want OS and application patching in the same agent and console.
- **The honest limitation:** Not sold on its own and not an RMM: no PSA, scripting or mobile patching; no price is published and WatchGuard Cloud has no Indian region.
- **Price:** Quote — per endpoint, quoted — an add-on module to WatchGuard Endpoint Security, patching Windows, macOS and Linux and third-party applications from WatchGuard Cloud
- **Details:** https://www.thetechbag.com/watchguard/watchguard-patch-management

### Absolute Secure Endpoint (Resilience for Security / Automation) — Absolute

- **Who it's for:** PC fleets that want OS and third-party patching on the same firmware-anchored agent that keeps security tools running and laptops recoverable, often beside Intune.
- **The honest limitation:** Not an RMM or MDM: no phones or tablets, no PSA; patching needs the top two editions; Linux patching is claimed on a product page but missing from the agent's published requirements; quote-led.
- **Price:** Quote — per device / year; patching starts at the Resilience for Security edition ($79.95 MSRP) and Resilience for Automation ($89.95) adds vulnerability fixes, workflows and remote control; both MSRPs are private-offer-only list figures on Absolute's AWS Marketplace listing
- **Details:** https://www.thetechbag.com/absolute/absolute-secure-endpoint

### JumpCloud Patch Management — JumpCloud

- **Who it's for:** Teams already running JumpCloud for devices or identity that want Windows (KB-level, with CVE severity), macOS, Ubuntu, Chrome and iPhone/iPad updates from the same console.
- **The honest limitation:** Linux patching is Ubuntu only; CVE data is attached to Windows KBs only (no vulnerability scanner); no PSA or ticketing; the unified Windows + Apple dashboard is still Preview. No on-prem edition — the hosting tick is the Mumbai region (Apr 2026, new tenants only, data at rest; logs and telemetry may be processed abroad).
- **Price:** $3 (≈ ₹249) — per USER/mo à la carte, billed annually ($4 monthly) — JumpCloud prices per user, not per device; included in the $9 Device Management package and every package with device management; 30-day trial, no free tier for new accounts
- **Details:** https://www.thetechbag.com/jumpcloud/jumpcloud-patch-management

## Why each constraint rules out what it does

**Per technician, unlimited devices.** Rules out Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, NinjaOne RMM, SuperOps RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management — priced per device / endpoint, not per technician. That leaves Atera RMM.

**Per device or endpoint.** Rules out Atera RMM — priced per technician, not per device. That leaves Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, NinjaOne RMM, SuperOps RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management.

**Free to start.** Rules out Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, LogMeIn Central, NinjaOne RMM, Atera RMM, SuperOps RMM, N-able N-central, N-able N-sight, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management — no free tier (trial only). That leaves Action1 Software Deployment, Action1 Vulnerability Remediation, Action1, Action1 RMM & Remote Access and ManageEngine Endpoint Central.

**On-prem or India data residency.** Rules out Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, NinjaOne RMM, Atera RMM, SuperOps RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, Datto RMM, Heimdal Patch & Asset Management, WatchGuard Patch Management and Absolute Secure Endpoint (Resilience for Security / Automation) — cloud-only, no on-prem and no India data region. That leaves ManageEngine Endpoint Central, ConnectWise Automate, Kaseya VSA 10 and JumpCloud Patch Management.

**Ticketing or PSA in the console.** Rules out Qualys Patch Management, NinjaOne Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, Splashtop AEM, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management — no ticketing in the console (a separate service-desk product). That leaves SuperOps Patch Management, NinjaOne RMM, Atera RMM, SuperOps RMM and LogMeIn Resolve.

**Backup from the same vendor.** Rules out Qualys Patch Management, SuperOps Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, SuperOps RMM, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, Splashtop AEM, LogMeIn Resolve, ConnectWise Automate, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management — no backup product; Atera RMM, Datto RMM and Kaseya VSA 10 — backup via third-party integration, not a vendor SKU. That leaves NinjaOne Patch Management, NinjaOne RMM, N-able N-central, N-able N-sight, TeamViewer Remote Management and ConnectWise RMM.

**Linux in the fleet.** Rules out Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM and Absolute Secure Endpoint (Resilience for Security / Automation) — patches Windows and macOS only (Linux is remote-control at best). That leaves Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, NinjaOne RMM, Atera RMM, SuperOps RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management and JumpCloud Patch Management.

**Phones and tablets in scope.** Rules out Qualys Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, Splashtop AEM, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Heimdal Patch & Asset Management, WatchGuard Patch Management and Absolute Secure Endpoint (Resilience for Security / Automation) — no mobile device management; Atera RMM — mobile only through a separate Miradore subscription and console. That leaves NinjaOne Patch Management, SuperOps Patch Management, NinjaOne RMM, SuperOps RMM, ManageEngine Endpoint Central, LogMeIn Resolve, Kaseya VSA 10 and JumpCloud Patch Management.

**Under 100 endpoints.** Rules out SuperOps Patch Management, SuperOps RMM, Splashtop AEM and TeamViewer Remote Management — published 100-endpoint minimum. That leaves Qualys Patch Management, NinjaOne Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, LogMeIn Central, NinjaOne RMM, Atera RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, ManageEngine Endpoint Central, LogMeIn Resolve, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management.

**2,000+ endpoints.** Rules nothing out on published terms.

**Separate business units or tenants.** Rules out LogMeIn Central and ManageEngine Endpoint Central — multi-tenant is the separate Endpoint Central MSP edition; Atera RMM — IT-department plans are single-organisation; multi-tenant is the MSP plan. That leaves Qualys Patch Management, NinjaOne Patch Management, SuperOps Patch Management, Action1 Software Deployment, Action1 Vulnerability Remediation, NinjaOne RMM, SuperOps RMM, N-able N-central, N-able N-sight, Action1, Action1 RMM & Remote Access, Splashtop AEM, LogMeIn Resolve, TeamViewer Remote Management, ConnectWise RMM, ConnectWise Automate, Datto RMM, Kaseya VSA 10, Heimdal Patch & Asset Management, WatchGuard Patch Management, Absolute Secure Endpoint (Resilience for Security / Automation) and JumpCloud Patch Management.

**Windows and macOS in the fleet.** Rules nothing out. All seven patch Windows and macOS. What differs is depth: the macOS third-party catalog ranges from hundreds of apps (LogMeIn Resolve lists ~100 on macOS, TeamViewer and ManageEngine hundreds across both) down to roughly 30 on Action1, and Atera's depends on what Homebrew carries.

**Remote access included.** Rules nothing out — every product here ships remote control (NinjaOne via Splashtop / ScreenConnect in its bundle, Atera via Splashtop and AnyDesk, Action1 built in, ManageEngine built in, and the three remote-first vendors natively). The double-buy question is the other way round: if you already hold one of the three remote tools, their RMM tier may be enough.

**Scripting depth.** Rules nothing out on documentation — all seven run scripts across endpoints. Depth differs: NinjaOne, Atera (library + AI-generated) and Action1 document automation at policy level; Splashtop AEM and Resolve document scripting; TeamViewer's is thinnest. Where the line falls for your runbooks is a PoC question, not a datasheet one.

**100–2,000 endpoints.** Rules nothing out: the published minimums (Splashtop AEM and TeamViewer ONE at 100, NinjaOne publishes none) are cleared, and no product publishes a ceiling in this band. Which console starts to strain first is delivery-team experience: [TechBag to confirm].

**Endpoint security from the same vendor.** Not offered as a chip because the line between 'sells an EDR SKU' and 'integrates one' is blurred in every datasheet. NinjaOne resells endpoint security and integrates CrowdStrike / SentinelOne / Bitdefender; ManageEngine's Security edition adds vulnerability and ransomware controls; TeamViewer and Splashtop sell antivirus add-ons; Atera resells third-party AV. Read the agent-coexistence block before treating any of it as a second EDR.

## Your situation

### Internal IT, 200–2,000 mostly-Windows endpoints, no MSP

**Shortlist:** NinjaOne RMM, Action1, ManageEngine Endpoint Central

**Why:** Catalog-based patching with approval rings and a console built for one organisation; NinjaOne for breadth, Action1 for patch-first simplicity, ManageEngine if UEM depth or on-prem matters.

**Trade-off:** NinjaOne publishes only a price band and quotes the exact rate; Action1's monitoring is lighter than a full RMM; ManageEngine's console carries its Windows-first heritage.

### Two technicians, 800 devices — headcount is tiny, the fleet is not

**Shortlist:** Atera RMM, Action1, ManageEngine Endpoint Central

**Why:** Per-technician pricing (Atera) or a free-to-200 / per-50-endpoint model makes the bill track the team, not the estate.

**Trade-off:** Atera charges for every login and its add-ons stack; Action1 jumps to $4 per endpoint beyond 200 plus support; ManageEngine charges for technicians beyond the first.

### Patch compliance is the whole job — audits ask for proof

**Shortlist:** Action1, ManageEngine Endpoint Central, NinjaOne RMM

**Why:** Vulnerability-to-patch views, per-CVE evidence and exportable reports; Action1 and ManageEngine are built around the patch record, NinjaOne reports across the estate.

**Trade-off:** An RMM's 'patched' is not a UEM's 'compliant' — if the audit asks for device state (encryption, configuration, enrolment), you still need a UEM beside it.

### Windows + macOS + Linux servers, one console

**Shortlist:** NinjaOne RMM, Atera RMM, Action1

**Why:** Documented Linux patching — NinjaOne and Action1 by catalog, Atera by APT on Ubuntu / Debian — alongside Windows and macOS.

**Trade-off:** macOS third-party coverage varies widely (Action1 ~30 apps; Atera depends on Homebrew); test your top 20 apps on every OS in the PoC.

### You already pay for Splashtop, TeamViewer or LogMeIn

**Shortlist:** Splashtop AEM, TeamViewer Remote Management, LogMeIn Resolve

**Why:** Their RMM tiers ride the agent you already run — no second agent, no second contract, and the double-buy disappears.

**Trade-off:** All three patch Windows and macOS only, two carry 100-endpoint minimums, and monitoring / scripting depth is below NinjaOne, Atera or Action1.

### Separate business units that must not see each other

**Shortlist:** NinjaOne RMM, Action1, Atera RMM

**Why:** NinjaOne and Action1 document scoped organisations in one console; Atera does it on the MSP plan.

**Trade-off:** On Atera's IT-department plans and on Endpoint Central (non-MSP) the separation is a different plan or edition — price that SKU, not the one on the website.

### UEM and RMM in one console — phones too

**Shortlist:** ManageEngine Endpoint Central, NinjaOne RMM, LogMeIn Resolve

**Why:** ManageEngine's UEM edition, NinjaOne's MDM add-on and Resolve's built-in MDM put mobile beside the RMM agent.

**Trade-off:** Depth differs sharply: ManageEngine is a full UEM, NinjaOne MDM is Apple / Android without Windows MDM, Resolve MDM is light — see the UEM & MDM guide for the mobile side.

### Regulated — on-prem or India data residency is mandatory

**Shortlist:** ManageEngine Endpoint Central

**Why:** The only product here with an on-premises edition and an India data centre; the other six are cloud-only in US / EU / other regions.

**Trade-off:** One survivor means no competitive tension on price — TechBag negotiates edition and technician count instead, and checks whether a cloud region you can accept reopens the field.

---

*Vendor-neutral. Nothing gated. https://www.thetechbag.com/browse/endpoint-management/rmm-patch*