Every endpoint patched. Priced per technician.
Schedules, rollout rings and automatic holds for Windows updates across all your clients. Fully hosted on a private cloud instance that's yours alone.
Product tour
See it before you book
Real screens from the Patch Nexus demo environment, with generated companies and devices.
Features
Patch with confidence
Built by an MSP, for the way MSPs patch: many clients, different time zones, and no surprises on Monday morning.
Maintenance windows
Relative to Patch Tuesday or fixed dates, in each company's own time zone. Tasks reach the agents ahead of time, so they run even if the connection to your instance is down.
Rollout rings
Pilot devices get updates first; everyone else follows days later, once the pilot is clean.
Holds and known issues
Hold an update that fails, or pause it until a Microsoft known issue is resolved. Install success is tracked per update.
Exploited CVEs first
See which devices are exposed to actively exploited vulnerabilities, and which update fixes them.
Restarts under control
Restart order for servers that depend on each other, reboot-pending tracking, and no pop-ups for your users.
Client reports
Compliance, missing updates, installation history and more, per company, exported to PDF.
Third-party apps Gold
Application inventory per device, and updates for common applications once you approve them.
Coverage
Computers in Microsoft Entra ID or Active Directory that don't have the agent yet, per company.
How it works
Up and running in a day
We host it for you
We set up your private cloud instance of Patch Nexus, with its own signing keys, at its own address (such as yourmsp.patchnexus.com). No server to install or maintain on your side.
Install the agent
One signed MSI for Windows 10, 11 and Server 2012 R2 to 2025. Deploy it with your RMM, a GPO, Intune or a single PowerShell command.
Schedule and relax
Create maintenance windows per company, watch the first results on the pilot ring, and send each client their report.
Security
A patch tool can install anything. So we locked it down.
Whoever controls a patch server controls every computer it manages. Patch Nexus is designed so that not even a compromised server or network can turn it against your clients.
- Every task is signedAgents run only tasks signed with your instance's own key, certified by an offline root key.
- End-to-end encryptedAgent traffic is sealed on top of HTTPS, and every answer from your instance is signed.
- No inbound portsAgents connect out over HTTPS. Nothing listens on your clients' networks.
- Strong sign-inAn authenticator app or a passkey for every technician, and sign-in only from your office addresses.
- Your instance, your dataEvery MSP gets a separate private cloud instance with its own database, so your clients' data is never mixed with anyone else's.
- Approved reinstallsA device that reinstalls the agent waits for your approval before it can take over its old identity.
Pricing
Simple pricing
Per technician. Unlimited endpoints, in both plans.
Silver
- Windows, driver and Defender updates
- Schedules, rollout rings and update holds
- Exploited-CVE exposure and known issues
- Coverage against Entra ID and Active Directory
- Client reports
- Unlimited endpoints
Gold Most popular
- Everything in Silver
- Third-party application updates
- Application inventory per device
- Unlimited endpoints
Prices in US dollars, per technician. VAT is added where applicable.
FAQ
Questions MSPs ask
Do we need to install or maintain a server?
No. Patch Nexus is a fully hosted service. We run, update and back up your private cloud instance; you only install the lightweight agent on the computers you manage.
What is a technician?
A person on your team who signs in to your Patch Nexus instance. You pay per technician, not per endpoint, so adding clients and computers never changes the price.
Which Windows versions are supported?
Windows 10 and 11, and Windows Server 2012 R2 to 2025. The installer adds .NET Framework 4.8 when a computer has an older version.
Do my clients' firewalls need changes?
No. The agent connects out to your Patch Nexus instance in the cloud over HTTPS (port 443). Nothing needs to be opened inbound.
Will users see pop-ups or forced restarts?
No pop-ups. Installs and restarts happen in the maintenance windows you set, per company and per device group.
What does the setup fee cover?
Setting up your private cloud instance, its signing and encryption keys, and onboarding with your team. With a 2-year subscription there is no setup fee.
Can we try it first?
Yes. Book a demo and we'll show you Patch Nexus with demo data. If it fits, the next step is a pilot on a few of your own computers.
Book a demo
See Patch Nexus in action
A 15–30 minute live session with a member of our team, focused on your environment. See how Patch Nexus keeps every client's endpoints up to date, reliably and without the extra work.
- We'll reply by e-mail to set a time
- No commitment, no credit card
- Or write to us: [email protected]