What’s a practical patch-management setup for an air-gapped network?

You’ll probably need at least one system outside the air gap to download or stage patches, plus an internal server or repository to distribute them. When comparing products, check whether the vendor maintains a single curated repository or whether the internal cache has to connect directly to every third-party vendor site. That distinction matters a lot in an isolated environment.

ManageEngine Endpoint Central can handle Windows updates and a selection of third-party applications at a relatively reasonable price. For an offline deployment, expect some initial setup work. Office updates can be inconsistent, though, so you may need to maintain your own deployment script using the Office Deployment Tool.

PDQ Deploy combined with PDQ Inventory is another practical option for roughly this size of environment. Inventory can help identify machines that are missing updates, while Deploy can push approved packages after they reconnect. You would still need to design a controlled process for downloading, reviewing, and importing update packages into the isolated network.

BigFix is worth evaluating for this use case. It has worked well for deploying operating-system updates in isolated environments and can use an air-gap utility to gather and transfer update content. Some other platforms still require an internal WSUS server for newer Windows versions, so verify that requirement before choosing a product.