What are the best patching tools for completely air-gapped Windows networks?

ManageEngine Endpoint Central has a closed-network patch-management option that may fit this scenario. It’s worth comparing its offline catalog and package-transfer process against your current WSUS and PDQ workflow before changing platforms.

Ivanti Security Controls, or Ivanti Patch, is worth evaluating. It supports an offline workflow where you download the patch database and packages on an internet-connected system, transfer them into the isolated environment, scan for missing updates, and export the results. You can then use those results to download the required patches and transfer them back for deployment. This is practical for a strict removable-media process, although monthly patch packages can require DVDs or larger external drives rather than CDs.

For a genuinely offline network, WSUS export/import combined with PDQ is already a solid approach. Most cloud-based patching products won’t help unless you can provide some kind of controlled outbound connection. BigFix is probably the stronger enterprise option if you want one on-premises console to manage Microsoft and third-party updates, but it may be more infrastructure than you need.

BigFix is a popular choice for this kind of environment. It can work well as an on-premises patching platform, but make sure you verify the exact export and import process for your version. The amount of manual work on the isolated side, including importing content and transferring packages, is an important part of the evaluation.