Endpoint Protection

Hello,

I am having a disagreement with a colleague about when we cross the line between acceptable and non acceptable amount of out of date clients.

Situation :

• We consider 1000 clients, all online.
• We don't take in account the offline clients.
• What we call out of date is with a definition older than 20 days.

My scale would be :

• 0 - 20          = acceptable
• 20 - 40        = need attention
• beyond 40   = not acceptable, investigate and reduce the number

What would be your scale ? Does you scale (in % of course) change for 10 000 clients ?

I know that the fewer the better, and that only one out of date client is a threat we should not accept, but this is not the answer I am looking for.

I really wish to have the opinion of people who work with antivirus all day and that know the real life an antivirus console.

Best Regards,

Alexandra.

Usually 10% but it also depends on the amount of clients. If you have a large amount you should really do some troubleshooting. 20 days it way too much for me since content is released 2-3x per day. I set it at 7 days.

At the end of the day, it should be managements call on what is acceptable/not acceptable.

We already are doing troubleshooting, and we currently have 60 clients out of date, but we used to have 100 and we have 950 clients online. So according to you, we are fine ? I wish we were under 40.

For the delay, it's good to know what other people consider out of date. I usually look for clients out of date since 10 to 15 days.

Don't really think there is a right or wrong answer. 10% is usually the starting point but it all comes down to what you think is realistic and acceptable.

You may have clients off the network for long periods of time or simply turned off. There could be others with issues and they don't update for whatever reason. Right now youi're over 95% so IMO that is acceptable. Another thing you need to factor is resources available to remediate issues. If you don't have resources this could be difficult as well.

Well, these are clients online, so no clients out of the network or turned off. If you add "offline" clients, were up to 25% which is too high.

We are also working on reducing the number of offline clients, but this one is late due to lack of ressources, as you just mentionned.

But your answers help : this is exactly the points we are discussing right now. In percentage it looks small, in number of clients it looks high, what does the managment say, do we have the ressources...

Thank you for your time.