1. A computer-implemented method comprising: installing a patch management agent on a computing device; determining a first set of software patches based on a group of software patches installed on the computing device and a group of available software patches; receiving at the computing device, the first set of software patches over a network connection; after receiving the first set of software patches, determining, by the patch management agent, a second set of software patches based on the group of software patches installed on the computing device and the first set of software patches, wherein the group of software patches installed on the computing device has changed since determining the first set, and wherein the second set is a subset of the first set; and installing, by the agent, the second set of software patches on the computing device.