Shavlik Technologies hits a patch management high note with its robust NetChk Protect. When we launched this Rolling Review, we cited automation of the patch process, strong change control, and the ability to use bandwidth wisely as key decision points, and NetChk delivers well. The scheduler can handle both discovery and deployment of patches as well as continually scan for patch compliance. We were also kept well-informed thanks to its ability to generate Microsoft Baseline Security Analyzer-formatted output for scan results.

By adding Shavlik's Distribution Server option, IT can control when patches are distributed to target machines. However, companies with Unix or Linux boxes will need to supplement NetChk. Shavlik includes a patch repository that's checked prior to all scans and automatically updates Microsoft security- and nonsecurity-related patches within 24 hours of release. Repository connections and the validity of patches applied by NetChk are verified by digital signatures, and communications between host and client machines use secure protocols. Patching of our test virtual machines was seamless.

Other features time-strapped IT groups will appreciate include the ability to set up automated results notifications, a choice between agentless or agent-facilitated deployment, and spyware discovery and remediation. For those who must keep detailed security records, we found reporting both comprehensive and flexible. Reports are generated from scanning and patch deployment results and may be arranged and grouped in multiple ways. We used some of the default reports after our scan to gauge the success of patch distribution by severity and the rate of scan success. Reports are easily exported into a variety of formats.

Rolling Reviews present a comprehensive look at a hot technology category, beginning with market analysis and wrapping up with a synopsis of our findings. See our patch management kickoff Rolling Reviews.