The most revealing number in Action1's business is not 4,512 percent. It is 200. That is how many laptops, servers, and workstations an organization can manage with the Houston company's complete product for free, indefinitely. No crippled dashboard. No patching quota. No feature maze designed to make an IT administrator discover, halfway through setup, that the useful button belongs to Enterprise Plus.
At endpoint 201, the conversation changes. Larger customers buy an annual subscription priced per managed device, with volume discounts and vendor support, through a private quote. That handoff - radically open at the small end, guarded at the commercial end - is the engine beneath Action1's rise. It lets a school, clinic, nonprofit, or small managed-service provider test the same machinery used in far larger deployments. The proof happens on real computers before procurement begins.
Fully functional endpoints, free forever.
Paid licensing begins only beyond the allowance. Free accounts trade vendor support for community help.
Two founders return to the least glamorous room in IT
Alex Vovk and Mike Walters founded Action1 in 2018 after building Netwrix, the data-security company they started in 2006. Their second company did not begin with a consumer-friendly pitch. They saw enterprise patching as a neglected security control: widely needed, poorly loved, and still tied to on-premises tools built for machines sitting obediently inside an office network.
Remote work made that old assumption expensive. A laptop at a kitchen table does not reliably check in with the corporate network. A third-party application can stay vulnerable while a conventional management server waits for the device to return. Action1 put an agent on the endpoint and moved control to the cloud, so administrators could assess and patch devices over an outbound internet connection without routing them through a VPN.
The founders say they reinvested $20 million of their own capital into the platform, including work on a zero-knowledge security architecture. That matters because the usual shorthand - “Action1 raised $20 million” - suggests outside investors and a financing round. The public account is more interesting: two repeat founders financed the bet themselves, kept the company founder-led, and said they were building for long-term independence rather than a quick sale.
“One small change with a huge impact was our decision to laser focus on patch management early on.”
Mike Walters, co-founder and president
That was the change of mind. Action1's underlying platform could inventory assets, deploy software, run scripts, provide remote access, and produce reports. The tempting move was to sell the whole toolbox as another remote-monitoring suite. Instead, the company made patching the wedge. Walters compares focus to a bee's stinger: narrow enough to have an effect. Less zoologically, it meant one buyer, one urgent job, and one measurable result.
The first thing to fail was someone else's patch
A customer example makes the category's dysfunction concrete. ITC Service, a British managed-service provider, had used a previous third-party patching product that could silently remove an application after an update failed. The team then spent six months testing another product without deploying a single update. Software went “rogue,” users called, and the service provider carried the reputational damage.
After moving to Action1, ITC Service said its first update went out within 10 minutes. Over two months, the platform deployed thousands of missing updates, including Chrome patches across 2,610 endpoints and Zoom patches across 1,404. The provider reported more than doubling its patch success rate and saving six hours each week. This is a vendor-produced case study, but its useful detail is the sequence: failed installations came first, delay made the failure intolerable, and a small live test changed the team's mind.
A free tier designed as a production test
Action1's pricing is both refreshingly simple and frustratingly incomplete. The first 200 endpoints are free with no functional restrictions. A one-time vulnerability assessment can cover more devices. A 15-day trial lets a larger organization test ongoing management and support. After that, paid customers are billed per endpoint, annually, at a price Action1 does not list publicly.
All product functions, no expiration, community support. The allowance stays free even as the organization grows.
Annual per-endpoint subscription, vendor support, and lower unit pricing at greater volume. A sales quote is required.
The lack of a public paid price is the first caveat a careful buyer should notice. It adds friction for teams comparing vendors on a spreadsheet, and community discussions show that some administrators simply walk away when they cannot budget without a call. The free offer also excludes vendor support unless it is purchased. Community channels can be active, but they are not an SLA.
Still, the giveaway is not charity wearing a lanyard. The founders say an efficient architecture keeps the cost of serving small organizations low. Those users become experienced advocates, future employees carry the tool to new companies, MSPs expose it to clients, and larger environments arrive with evidence already in hand. Action1 does not have to persuade a buyer that patching works in theory. The buyer can inspect yesterday's deployment report.
The product lives between detection and the fix
Security teams already have scanners that identify vulnerable software. IT teams already have ticket queues. Action1 positions itself in the stubborn middle: the work required to turn a finding into an updated machine. Its console continuously assesses Windows, macOS, and Linux devices, maps vulnerabilities to installed software, flags known exploitation, schedules operating-system and third-party updates, and records whether the job succeeded.
Peer-to-peer distribution is a practical differentiator in large locations. Instead of every endpoint downloading the same multi-gigabyte update from the internet, one device can obtain it and share it locally. There is no separate cache server to maintain. Off-network machines communicate directly with the service when they reconnect. Administrators can also push custom applications, execute scripts, inspect inventory, open a remote session, and use an API. The PSAction1 project on GitHub wraps that API in PowerShell cmdlets.
The customer list is broad because outdated software is democratic. Action1 publishes examples from schools, hospitals, libraries, game studios, banks, construction groups, and MSPs. Circet France manages 6,000 endpoints; Ecobank's story covers 16,000. Memorial Hospital reported automating patching across 2,300 endpoints and saving $15,000 a year. A global hospitality business said it recovered a day each week. The common buyer is a small IT team responsible for more machines than it can reasonably touch.
Growth shifted from free-tool curiosity to larger contracts
*Annual recurring revenue booked from six-figure deals, year over year. Company-reported operating metrics; bar lengths are indexed to 275.
The outside scoreboards support the direction, though each measures a different window. Deloitte ranked Action1 No. 16 on its 2025 Technology Fast 500 with 7,265 percent growth from 2021 through 2024. Inc. placed it No. 29 on the 2025 Inc. 5000, then No. 60 in 2026 with 4,512 percent three-year growth. Action1 reported 98 percent customer retention and a 275 percent year-over-year jump in recurring revenue booked from six-figure deals during the first half of 2026.
Where it fits - and where it does not
Action1 competes with Automox, ManageEngine Endpoint Central, Ivanti, NinjaOne, Tanium, Atera, SuperOps, and Microsoft's endpoint stack. Its argument against legacy tools is architectural: cloud control, no on-premises management server, real-time visibility, and no VPN requirement. Its argument against broad RMM suites is focus: patching is not a checkbox buried beside ticketing and billing.
That focus creates boundaries. Action1 is not a full mobile-device management system, endpoint detection and response platform, backup product, PSA, OS-imaging suite, or network monitor. An MSP wanting one bill for every operational function may prefer a broader RMM. A Microsoft-heavy enterprise may keep Intune for identity-linked device policy and use Action1 to fill third-party patching and real-time remediation gaps. The product is easiest to understand as a specialist that connects vulnerability intelligence to action.
Conditions that break the pitch
- A device still needs the Action1 agent and an outbound internet path. “No VPN” removes network plumbing, not connectivity.
- Truly offline machines cannot receive a cloud-delivered update until they reconnect.
- Free users who require guaranteed response times need to buy support.
- Teams seeking deep MDM, EDR, backup, PSA, imaging, and monitoring in one suite will need companion products.
- Buyers who require public list pricing cannot calculate the paid tier without speaking to sales.
Four ideas worth stealing
Known vulnerabilities become incidents because routine work is delayed. A dull task with severe consequences can support a serious company.
Action1 had a wide toolkit, but growth followed a narrow promise. Lead with the job buyers can measure in days, not the platform they may appreciate in years.
A complete 200-endpoint deployment creates operational evidence. Feature-limited trials create questions. The model works only when marginal serving costs stay low.
Peer-to-peer delivery reduces bandwidth and infrastructure. Business-model generosity is easier when architecture makes each additional free user cheaper.
Action1 is now widening its lane carefully. ServiceNow synchronization connects patch state to the configuration database. Jira Cloud can route work for CVEs, failed automations, missing updates, and pending restarts. Integrations with Rapid7, Tenable, CrowdStrike, and Microsoft Defender bring outside findings closer to remediation. The 2026 Rockledge release focused on hardening the management platform itself, a sensible priority when software with administrative reach becomes a tempting target.
The company's achievement is not making patching exciting. It is making the absence of drama commercially valuable. A patch should arrive, install, survive a restart, and leave behind a report. The founders spent $20 million, the customer spent 10 minutes getting its first update out, and the first 200 endpoints cost nothing. Those numbers tell a cleaner story than any promise of autonomous security: get the ordinary thing done, then show the receipt.