Managing patches has always been challenging. But given the greater consistency required today across your entire organization in order to meet compliance standards, SLAs, and other forms of accountability, the challenges are greater than ever. 

This new reality makes it tough to maintain a competitive edge, as your IT staff are having to face difficulties that have become far more complex. 

So, what are the main challenges in enterprise-level patching today?

• Timing, prioritization, and testing; coordinating updates (bundling vs. one at a time)
• Juggling multiple implementation methods
• Tracking an increasing range of endpoint architectures: centralized, off-premises, non-standard appliances, mobile devices/BYOD, virtual OSes, firmware

Your IT department is up against a range of new risks as well. And if you’re like many organizations, you may find that your current patch management methods, like WSUS or homegrown scripts, simply can’t keep up.

That’s why more and more organizations are turning to specialized patch management tools, hoping to up their patch management game via automation, prediction, and process governance.

What Are Patch Management Tools?

In the old world, applications and OSes ran their own patches through a hodgepodge of update methods: self-updating, OS-based, third-party apps, network-based, user-controlled, or manual.

This made managing cyber hygiene an endless round of monitoring, downloading, and manually rolling out updates – a situation that rendered it difficult to streamline patching operations or patch intelligently to minimize downtime. This was especially the case if you didn’t have enough information to analyze and prioritize your assets and vulnerabilities.

And yet, some IT departments are still patching this way. Sure, there are generic OS-level solutions, like WSUS/SCCM for Windows and various Linux solutions, but they’re cumbersome to operate, ignore enterprise processes, and lack the flexibility to integrate with other environments. With today’s complex networks, comprising a mix of on-premises, cloud, and legacy systems, it’s impossible to keep up. Meanwhile, numerous patch management tools have arrived on the market, promising a smarter solution, but do they deliver?

In this post, we’ll compare three of the most popular patch management tools out there today. We’ll review some of the pros and cons of each to help you decide if they really can support—and streamline—your modern patch management and compliance needs.

BigFix (HCL)

BigFix is one of the oldest players, first introduced in 2002 as part of a suite of enterprise desktop, mobile, and server management tools. Acquired by IBM in 2010, it went through several name changes before returning to BigFix. In 2019, BigFix was acquired by IT firm HCL Technologies. 

• The Promise: “Unified, near real-time visibility and enforcement to deploy and manage patches to all distributed endpoints”
• Platforms: Windows, Mac, Unix; cloud (virtual machine) and on-premises
• Pricing: Free limited functionality up to 20 computers; from $34.50/month for 50 computers; free trial
• Pros
  • Simple dashboard for cross-platform management, especially for Unix
  • Solid performance across 1000s of customers
  • Low pricing and extreme scalability
• Cons
  • Steep learning curve, poor integration with other solutions
  • Reporting is complex and lacks configurability
  • Based on a legacy platform; lacks robust automation capabilities

SolarWinds Patch Manager

The SolarWinds Patch Manager is actually just one module of a complex IT tool platform. This patching component was acquired in 2012 when SolarWinds bought EminentWare, a windows-based patching tool. 

• The Promise: “Patch management software designed to quickly address software vulnerabilities”
• Platforms: Microsoft servers, workstations, and third-party applications
• Pricing: Starts at $1,909; free trial
• Pros
  • Intuitive, user-friendly, native-Windows interface
  • Full integration with WSUS/SCCM, third-party patching applications, virtual machines, offline devices
  • Some patch automation and package-building capabilities
• Cons
  • Doesn’t support Linux, a critical failing in today’s mixed-environment world
  • Can be slow to log in, load, and retrieve patch status; inflexible reporting
  • As part of a suite, may lack the full functionality of other tools

ManageEngine Patch Manager Plus (Zoho)

This is yet another product that’s one part of a complete platform, in this case, the wide-ranging ManageEngine family—cloud-based software used to manage endpoints from a single central location.

• The Promise: “Automated patch deployment for Windows, macOS, and Linux endpoints, plus patching support for 650+ third-party updates across 350+ third party applications”
• Platforms: Windows, Mac, Linux; on-premises and cloud (Windows/Mac only)
• Pricing: From $3,750 for 250 nodes; fully-functional 30-day free trial.

• Pros

• • Some testing automation with the ability to approve/decline a patch
  • Integrates with many other ManageEngine tools
  • Considered a relatively affordable solution

• Cons

• • No vulnerability analysis; cannot test patches without manual install
  • Not always seamless cloud integration
  • As part of a suite, may lack the full functionality of other tools

Automation, Patch Success Prediction, and Process Governance

In some cases, features that were once “nice to have” in a patch manager have become more like “must-haves.” That’s because more employees than ever before are operating from outside their organization, creating a few unprecedented business needs:

• Patch managers must secure not only the perimeter but devices beyond IT’s control
• Cybersecurity team resources and availability are strained, creating a need for automation
• Users’ remote access needs make downtime more unacceptable–highlighting the need for intelligent and predictive patching

Moving toward the hyper-automation future, a few patching solutions are adding some degree of intelligence to save companies time, energy, and money. But legacy contenders are having a hard time keeping up. 

To simplify the patch management process, you need a single source of truth – a console to supervise all patches required, available, downloaded, and scheduled across your entire enterprise. Full transparency into assets throughout your network via a centralized console offers you insights that you can classify both by priority and vulnerability.

Furthermore, when considering any patching solution in today’s world, automation, prediction, and process governance may be the three most important criteria:

• Automation: Takes the burden of downloading and prioritizing vulnerabilities and patches off your shoulders while minimizing downtime risk
• Patch success Prediction: Helps analyze a patch’s potential fail points so that you can prevent them
• Process governance: Lets you choose which patches to apply, where and when, and easily set accountability targets

JetPatch: A One-Stop, Hassle-Free Solution 

JetPatch is a dedicated patching solution, not one component of a larger suite of products. We’re all about vulnerability remediation. So we’ve built in helpful features to take the hard work of patching off your team’s shoulders.

Some of the benefits JetPatch offers in today’s patch management landscape include:

• Minimizes rollout downtimes with intelligent prediction
• Takes over routine tasks with automated patching
• Offers clear insight with a simplified dashboard and customizable reporting
• Secures remote-user endpoints with WFH- and BYOD-ready capability
• Works with all third-party vendor databases
• Provides comprehensive coverage to meet all your patching needs 

Bringing It All Together

As organizations grow, their need for patching grows as well. And then there are the accountability and compliance standards that must be maintained. All of this makes manual patching an almost impossible task for medium-to-large-scale enterprises. There are simply too many third-party update solutions, OSes, and other variables to juggle in a typical business environment.

Finding a tool to bring these together can be a challenge, but understanding which features your organization needs is a good place to start. By focusing on features like automation, prediction, and process governance, you’ll ensure you end up with a patch manager that serves as a partner in keeping your organization secure, even when you’re not there.