Free Patch Management Software
Patch 200 endpoints free, forever. Every feature included, no trial, no credit card. Windows, macOS, and Linux.
Is patch management actually free?
Free is not one thing. There are three flavors, and they are not equal. Free-forever tiers give you a real product capped by endpoint count: TridentStack Control and Action1 both cover the first 200 endpoints at no cost, with no time limit. Time-limited trials give you the full product for a few weeks, then you pay. Open-source and do-it-yourself tools give you free software where your own time and infrastructure are the price.
So the useful question is never whether it is free, it is what is capped and what the catch is. A 25-endpoint cap, Windows-only coverage, or a self-hosted server you maintain yourself are all real costs, even when the license fee is zero. The table below names each free option and where it wins or loses.
The free options, compared
A fair look at the main free ways to patch a fleet today. Every free-tier fact here is checked against the source page it is drawn from.
| Tool | Free limit | Platforms | Third-party apps | Vulnerability detection | Compliance | The catch |
|---|---|---|---|---|---|---|
| TridentStack Control | 200 endpoints, forever | Windows, macOS, Linux | Yes | Yes | CIS, DISA STIG, MS baselines | $5/endpoint/mo past 200, every feature included |
| Action1 (Free) | 200 endpoints, forever | Windows, macOS, Linux | Yes | Yes | Regulatory reporting (HIPAA, PCI, SOC 2) | Community-only free support; sales quote past 200 |
| WSUS | Unlimited (built into Windows Server) | Windows | No | No | No | Microsoft updates only, on-prem, no longer actively developed |
| ManageEngine Patch Manager Plus (Free) | 25 endpoints | Windows, macOS, Linux | Yes | No | No | Hard 25-endpoint cap |
| Open source (e.g. OPSI) | Unlimited (self-hosted) | Varies by tool | DIY packaging | No | No | You host, integrate, and maintain everything |
Free tiers verified against each vendor's own page.
What is in the free tier
Not a stripped-down starter edition. Every capability below is included for your first 200 endpoints, at no cost.
Patch management
Operating system updates, approval workflows, and phased deployment rings across your fleet.
Third-party application updates
Package manager integration keeps the applications on your endpoints current, not just the OS.
Vulnerability detection
Automatic CVE detection from software inventory, with CVSS scoring to prioritize what matters.
Compliance scoring
CIS Benchmarks, DISA STIG, and Microsoft Security Baselines with automated per-control scoring.
Policy management
A web-based settings catalog with versioning and enforcement verification. No Active Directory required.
Unlimited admin users
Bring your whole team. Role-based access is included, with no per-seat fees on the free tier.
When you outgrow free
Past your first 200 endpoints it is $5 per endpoint per month, every feature still included, no tiers. See the pricing calculator.
More free tools from TridentStack Control
Free Vulnerability Scanner
Continuous, agent-based CVE detection across Windows, macOS, and Linux, with CVSS prioritization.
Free CIS Benchmark Tool
Scored CIS Level 1 and 2, DISA STIG, and Microsoft baselines from one console.
Free Endpoint Management Software
A web settings catalog with enforcement that works without Active Directory.
Free Group Policy Alternative
Enforce settings across Windows, macOS, and Linux without a domain controller.
Frequently asked questions
Is TridentStack Control really free forever?
Yes. Your first 200 endpoints are free forever with every feature included. It is not a trial and it does not expire.
What is the catch?
There is no feature catch. The free tier includes patch management, third-party application updates, vulnerability detection, compliance scoring, and policy management. Past 200 endpoints it is $5 per endpoint per month.
Do I need a credit card to start?
No. You can start managing up to 200 endpoints without entering payment details.
Which operating systems are supported?
Windows, macOS, and Linux, from a single platform.
How is this different from WSUS?
WSUS is free but Windows only, patches Microsoft updates only with no third-party applications, requires on-prem setup, and is no longer actively developed by Microsoft. TridentStack Control patches Windows, macOS, and Linux plus third-party applications, with vulnerability detection and compliance scoring built in.
How is this different from Action1's free tier?
Action1's free tier is a strong option and, like TridentStack Control, covers 200 endpoints free across Windows, macOS, and Linux. The differences are in depth: TridentStack Control includes CIS Level 1 and Level 2 and DISA STIG compliance scoring, full policy management with a versioned settings catalog, and vendor email support on the free tier, and it publishes a flat $5 per endpoint per month past 200 rather than a sales quote.
Is TridentStack Control open source?
No. It is a commercial platform with a free-forever tier for up to 200 endpoints. If you specifically need open source, tools like OPSI exist, though they require more setup and ongoing maintenance.
Start patching, free
200 endpoints free forever, every feature included. No credit card, no time limit.
Competitor facts verified against each vendor page. Last verified 2026-08-17.