Study Shows That Slow Response Leaves Mobile Users Most Vulnerable to Security Threats.

Findings Suggest Automated End Point Solutions Essential as Mobile Laptops Not Secured Quickly Enough; Customers Not Sure If Microsoft Windows Vista Will Help

ST. PAUL, Minn. -- Trusted Strategies and Shavlik Technologies today released findings of a new study aimed at identifying how companies assess, remediate and manage vulnerabilities, and where security policies break down or are under supported by current solutions. The e-mail survey drew responses from more than 150 U.S.-based IT security professionals, and points to a lack of automated solutions to support security configuration management at the edge of the network as an ongoing and critical flaw in vulnerability management offerings. Trusted Strategies is an information security industry consulting and market intelligence firm; Shavlik is a leader in security configuration and policy management software.

According to the survey, half of respondents (49.6 percent) said that it takes more than six days to patch critical vulnerabilities on laptop computers. This despite the fact that nearly two-thirds (60.4 percent) of respondents listed mobile laptops as the greatest threat to maintaining a secure posture. Conversely, nearly 80 percent (77.4) of critical server vulnerabilities and 70 percent (67.9) of critical desktop vulnerabilities are patched within six days of discovery.

The survey data suggests that this discrepancy may be explained as a lack of automated assessment, remediation and management tools at the edge of the network (especially on mobile devices). While over 90 percent of respondents believe it is "important" or "very important" to fully automate all of the patch and vulnerability management lifecycle, one in three respondents report that they have only automated "some" or "none" of the patch/vulnerability lifecycle on mobile desktops.

"Over the last six to 12 months, zero-day exploits have risen significantly as hackers grow smarter, better organized, and more financially motivated," said Mark Shavlik, CEO of Shavlik Technologies. "And once a vendor releases its patch, the timeframe to deploy the patch across the network must be extremely short as knowledge of how to exploit the vulnerability rises exponentially once a patch is published. Best practices therefore dictate available patches be deployed within 36 hours or less, to every machine on the network, especially to those distributed and mobile end points that are most vulnerable."

The survey findings also seem to support the belief within the security market that while Microsoft Windows Vista will improve security, it will not completely address customers' patch and vulnerability lifecycle management needs. Only 30 percent of respondent expect Vista to solve "all" or "most" of those requirements, and nearly another 30 percent "don't know" how Vista will impact patch and vulnerability management.

"Contrary to speculation by the media and other observers, the survey data suggest that the release of Vista later this month will not signal the death knell of third-party security solution providers," said Bill Bosen, a Partner at Trusted Strategies. "While respondents recognize there will be security benefits with Vista adoption, they see value in an integrated vulnerability management solution that augments Microsoft's security improvements."

For more information please visit the Shavlik web site at www.shavlik.com.

About Trusted Strategies

Trusted Strategies is the premier advisory, consulting, and market intelligence firm focusing solely on the information technology (IT) security industry. Offering a unique, business-oriented perspective, Trusted Strategies provides security entrepreneurs accurate, expert and concise consulting for strategic decisions relating to product design, market research, and business development. Venture capitalists, investment bankers and fund managers rely on Trusted Strategies' domain expertise and unrivaled research database for advice on investment and merger transactions.

About Shavlik Technologies

Shavlik Technologies, LLC provides solutions for preventing, detecting, and removing critical security threats. Founded in 1993, Shavlik Technologies is considered the industry standard for patch management solutions, with over 7,000 customers worldwide that trust Shavlik to provide the most up-to-date security patch data and the most comprehensive discovery capability to maintain their overall network security posture. Company CEO, Mark Shavlik, is widely acknowledged as a key founder of the patch industry, having teamed with Microsoft in 1999 to create the patch engine for Microsoft Base Security Analyzer (MBSA), which is still being relied upon by millions of users across the globe. The company also licenses its technology to over 20 leading security companies such as IBM, McAfee, BMC, Symantec and iPass. In 2006, Shavlik products were selected as winners of Readers Choice Awards from Redmond Magazine and Readers Trust Awards from SC Magazine.

Shavlik Technologies is a registered trademark in the United States and certain other countries, of Shavlik Technologies. Additional Shavlik product names are either registered trademarks or trademarks of Shavlik Technologies. All other trademarks mentioned in this document are the property of their respective owners.