On this page
Short answer: Small-business patch management needs an inventory of managed devices and applications, a regular deployment window, a route for urgent updates, a recovery test, and a record of what did not patch. Choose software only after confirming that it covers your actual Windows, macOS, Linux and third-party applications. A free endpoint allowance or a low OS-patching price may still leave support, application coverage and staff effort to budget.
Key takeaways
- Count managed endpoints, including shared computers and servers. Employee headcount is not the license count.
- Treat third-party applications as a separate coverage check; an OS-patching entry tier may not include them.
- Keep a small test group and a recovery plan before a broad rollout. NIST's patch management guide treats patching as planned preventive maintenance.
- Require evidence for failures and deferrals, not merely a green deployment dashboard.
- Compare the support you can reach during a failed change with the license price.
Define the small-team patching job
Make a device list from the endpoint inventory, not from payroll. A 20-person business may have 20 laptops, a few shared kiosks, servers, spare machines and remote devices. Each has an operating system version, owner, location, update method and reboot constraint. Record the third-party applications that matter most, including browsers, collaboration software, PDF readers and any specialized line-of-business client. A tool cannot patch an app it does not support or a device it cannot reach.
Write down how the team decides urgency. A security update affecting an exposed service may need a faster path than a routine feature update. A device that misses two scheduled windows needs a follow-up owner, not a silent exception. NIST SP 800-40 Rev.4 frames patch management as an enterprise strategy, but its core idea also applies to small teams: prepare, identify, prioritize, install and verify as part of preventive maintenance.
Public entry prices and their boundaries
These are current vendor statements checked September 26, 2026. They show why a feature and support comparison must sit beside the price. No option below is ranked or claimed to be tested here.
| Starting point | Public price statement | Important boundary to check |
|---|---|---|
| Action1 free edition | First 200 endpoints free forever; larger fleets by quote Action1 pricing | Community support is named for free; obtain support terms and verify OS/app coverage in a pilot |
| Automox Patch OS | $1 per endpoint per month with annual commitment Automox pricing | This published-price tier covers operating-system patching; third-party app patching is in quote-based Automate Essentials |
| Automox Automate Essentials | Custom price Automox pricing | Includes third-party patching and automation features; request catalog and quote |
The Action1 page says no feature limits for its first-200-endpoint offer, but this does not establish a contractual support response. Automox's pricing page separately advertises monthly payment without commitment and a 25% annual saving, while the displayed $1 Patch OS number specifically says with annual commitment. Do not use that annual rate as a month-to-month price. Action1 pricing, Automox pricing
Budget for 10, 50 and 250 employees
Employee counts help describe likely operating complexity, not an endpoint invoice. Use actual managed devices in the quote. These scenarios show the questions that change as a team grows.
| Business example | Likely planning question | Cost check |
|---|---|---|
| 10 staff in one office | Are shared PCs, a server and remote laptops included in the inventory? | Count all managed endpoints, then test a free allowance or calculate a published OS-only rate |
| 50 staff across two sites | Can offline devices catch up and do local applications appear in the patch catalog? | Include servers, shared devices, support and third-party patching in the comparison |
| 250 staff with mixed locations | Who approves rings, exceptions and emergency deployment? | Obtain a written quote and verify multi-site reporting and escalation terms |
For illustration, 50 managed endpoints at Automox's published $1 Patch OS rate would calculate to $50 per month, or $600 for a year with the stated annual commitment, before any tax or contract adjustment. It would not buy the quote-based third-party patching tier. A business with 50 employees might have a different endpoint count. Action1's first 200 endpoints are advertised as free, but a 250-endpoint deployment has no published paid total. Automox pricing, Action1 pricing
Run a pilot that exposes gaps
Choose a test group that includes at least one machine from each OS family in use, a typical remote laptop, a server or shared device if applicable, and one difficult third-party application. Record version before and after the update. Test detection, approval, scheduling, user notification, reboot behavior and reporting. A trial that only installs one easy patch cannot establish coverage for the rest of the business.
| Pilot question | Evidence to keep | Why it matters |
|---|---|---|
| Did the tool identify missing updates? | Device, OS, app version and scan time | Unsupported or offline devices may be absent from a success count |
| Did the update install? | Job outcome, installed version and reboot state | "Sent" is not the same as installed and working |
| Can the team recover? | Restore or uninstall test and owner | A failed update can block critical work |
| Can the team prove an exception? | Approval, reason, expiry and next check | Deferred devices need a visible return path |
| Can a second admin operate it? | Runbook and access test | One person's knowledge is a continuity risk |
Start with a small ring, review results, then widen deployment. For an urgent vulnerability, use an accelerated path that still records the affected assets and verification. NIST SP 800-40 Rev.4 provides the broader planning framework; your local schedule and risk acceptance need an accountable owner.
Costs beyond the license
Setup, packaging unusual software, troubleshooting failed updates, help-desk calls, reporting and recovery consume staff time. A platform can lower repetitive work but cannot decide whether a custom app tolerates a patch or whether a server may reboot at midday. Budget time to maintain the endpoint inventory and follow up on systems that stop reporting.
Support also has a practical value. Ask whether the free or entry tier includes direct vendor help, how critical cases are opened, and when a response is promised. Document the support process before a wide rollout. Use the patch management category overview to define requirements and keep vendor answers in a software shortlist.
FAQ
What is the first patch-management task for a small business?
Create an accurate endpoint and application inventory with owners. Without it, a success percentage can hide unsupported and offline machines. Then set a regular update window and an escalation path for urgent patches. NIST patch planning guide
Is free patch management enough?
Possibly, if the tool covers the actual OS and apps and your team can operate it with the available support. Action1 advertises a free first-200-endpoint edition with no feature limits, but it identifies community support on the public page. Verify contractual support needs separately. Action1 pricing
Is the lowest advertised per-endpoint price the total price?
No. Automox's $1 figure is for Patch OS with an annual commitment; its third-party patching tier is custom priced. Add staff work, support, implementation and any other required capabilities. Automox pricing
How many devices should be in a test ring?
There is no universal number. Include representative OS versions, applications, locations and user roles while keeping the group small enough to investigate failures. Expand only after checking installation and reboot outcomes. NIST SP 800-40 Rev.4
What should a patch report show?
It should identify eligible devices, missing updates, successful installs, failures, deferred devices and last contact time. Compare a sample of reported results with actual installed versions during a pilot, and keep an owner for each exception.
Bottom line
A small team needs a repeatable patch process before it needs an elaborate platform. Inventory every managed endpoint, test OS and third-party coverage, define rollout and recovery, and keep visible exceptions. Compare a free allowance or low entry price against the full scope and support needed to keep devices current.
Sources (3)
- NIST SP 800-40 Rev.4, Guide to Enterprise Patch Management Planning, checked September 26, 2026.
- Action1 pricing, checked September 26, 2026.
- Automox pricing, checked September 26, 2026.