Event Orchestrator is an object technology based on the Component Object Model that maps a company's security policies to actions, says Zachary Nelson, VP and general manager for Network Associates' Service Desk product line. It picks up alerts from security tools, checks the events against company policies, then takes appropriate action based on the level of risk.

For example, if Network Associates' CyberCop Monitor detects a hacker attack, Event Orchestrator can order the ports on a firewall closed to block access rather than page a network administrator to do the same. "Properly configured, Event Orchestrator can react far faster than I can," says Christopher Ward, director of corporate security for Pagemart Wireless Inc., a wireless paging company in Dallas.

Jim Balderston, an analyst with Zona Research, adds that if users change the setting on a device such as a firewall and that affects an application such as antivirus software, that software is automatically notified. "This is really building a security infrastructure where all individual applications are not only coordinated, but also in communication with each other so you can set and enforce security policy," he says.