What is our primary use case?
ManageEngine Patch Manager Plus was the first solution on the cloud six years ago when I started using this product. Although other competitors existed in the market, they were either behind in terms of functionality and popularity or were not even cloud-based. Many products in the market are cobbled together, meaning vendors purchase products from different companies and integrate them under one umbrella while still allowing individual purchases. Sophos operates this way by acquiring companies and integrating those products by default. However, in patch management, vendors offer products that are completely separate line items with independently operable products. You can have your own independent management console for each product rather than a unified console.
ManageEngine Patch Manager Plus provides patching for Windows, Mac, and Linux, while many competitors do not support Linux. This capability is particularly valuable because you can patch all platforms from a single tool. For example, if you have an AWS-based EC2 server running, you can patch it from the same console. The Linux agent is available for both desktop environments like Ubuntu or CentOS, and for servers. Classic use cases include EC2 servers running on AWS with Ubuntu, CentOS, RHEL, and Amazon variants. Once you install the same Linux agent, you can patch and monitor these machines from the console.
What is most valuable?
The detailed reporting feature in ManageEngine Patch Manager Plus is useful for my clients. Patch Management is a sub-module and add-on component. I speak about this in terms of Endpoint Central, which is the core product. Endpoint Central does three primary things. First, you get inventory management for software and hardware. Second, you get remote access capabilities, meaning you can take the device remotely and provide support, with the session recorded for playback if needed. Third, you get the patching capability, which splits into two parts: patching for Windows, Linux, and Mac boxes, and a vulnerability manager add-on module called Vulnerability Management that I use.
ManageEngine Patch Manager Plus helps manage patches for third-party applications, which I use for both operating system and third-party patching. For example, browsers like Chrome and Firefox are common across all three platforms. If you have a Linux desktop and install Chrome and Firefox browsers, you can patch all three variants. The auditing capabilities in ManageEngine Patch Manager Plus perform well. I would not call it brilliant because every person's requirement differs, but most requirements are common. The tool meets approximately 70% of expectations across the board, independent of who is using the reports and what size organization they are.
Regarding the remote patching feature, an agent is loaded onto your laptop, and from my console, I can patch your machine. I receive real-time data about all activities on the box. If you plug in a pen drive or Bluetooth, for example, I receive that hardware data. If you install any software, such as Office 365 or Acrobat Reader, reports come to me showing what was installed by which user and at what time. I can verify this information with the add-remove programs in the control panel on Windows.
Another capability is the ability to take the machine on remote access. If you need to install some software and do not have the admin rights to install it, I can log in remotely. You can see what I am doing in a screen share session, and the session gets recorded as an MP4 file with a default retention of about one year. Every month, applications have vulnerabilities discovered. If you have a patching tool, it constantly monitors the machine and checks against monitoring source data. If there is a zero-day vulnerability, the vulnerability manager plugin provides a handy tool that will patch based on CVSS scores. If the score goes into the 9.X series, you have to patch, treating it as a zero-day. Without the vulnerability manager, you know there is a patch marked as critical, but deciding when to deploy it becomes your choice.
What needs improvement?
Based on my experience, a better function would be to address the problem that the product only scans a machine once a day. It has a central scanning activity that scans every laptop for changes in assets, meaning both hardware and software, as well as installed software for patches. However, this activity works only once per day and does not work on local time. If you are a global organization with the UK office and a colleague in the US, for example, and you set the task at 11:00 AM UK time, that translates to 6:00 AM in the US East Coast. If that colleague's laptop is on, the task completes; otherwise, it fails. This represents a major drawback because the task does not run on the local time of the system.
Regarding the ability to create multiple tasks, you cannot create them, which is another significant issue. Only one task exists for these two activities. That one task performs both the hardware and software scanning for any changes and also conducts a patch scan. Both activities occur through the same task, but the problem is that if you have a global user base, this becomes a bottleneck.
For how long have I used the solution?
I have been working with ManageEngine Patch Manager Plus for six years.
What do I think about the stability of the solution?
From one to ten, I would rate stability for ManageEngine Patch Manager Plus as absolutely stable. I have not had any downtime in six years. They conduct maintenance, but that maintenance is seamless. I have not experienced a failure except for one instance three years back when something happened on their internet service provider side and it went down for about an hour. The service returned, but otherwise it has never failed.
What do I think about the scalability of the solution?
Regarding scalability, the default instance, which most customers run, can take up to 5,000 endpoints. Almost many companies, the big ones in the SMB class also can be accommodated on one single instance.
How are customer service and support?
In terms of technical support from ManageEngine, I would rate them an eight to nine. They are pretty available. Phone call support is there, and built-in chat support is also available. You do not have to raise a ticket and wait for them to respond. From the browser window itself, you can contact tech support, and this capability has been there from day one.
How would you rate customer service and support?
How was the initial setup?
The setup process for that module is very easy. You just have to create your patching rule. Once you deploy the agent and the patch scan is set, you can set it as a scan on a daily basis. My patching is done once a month as the default patching cycle. When critical patches come, I deploy them on an immediate basis or maybe once a week. You have to set your scheduling, and that is all there is to it.
What's my experience with pricing, setup cost, and licensing?
Pricing for ManageEngine Patch Manager Plus is pretty reasonable. Currently, I am paying around three dollars per agent per month.
Which other solutions did I evaluate?
You can look at NinjaOne and Kaseya as two very good competition products with very similar capabilities. You have to deploy both Kaseya and ManageEngine Patch Manager Plus to understand there are some differences, but majorly all three are common for most capabilities like patching and reporting.
What other advice do I have?
Regarding Sophos Safeguard and MDR, I do not work with MDR because MDR is a service offered directly from Sophos. I do not think there are many partners involved in the MDR service, and those who do must have vast resources to provide support for MDR. MDR is basically Managed Detection and Response, an outsourced service equivalent to having a Security Operation Center and paying for on-the-go usage of a SOC for security analytics. This is an expensive proposition, and only big enterprises of Sophos customers would use that tool. Regarding Sophos Workspace, which is the encryption tool, it runs only on Windows. It is the Windows laptop encryption tool that uses Windows encryption, manages the keys, and allows you to set the policy. I do not think it is a great offering, and I really do not think anybody will invest in that when there are so many other options, especially Microsoft itself. Any third-party offering an encryption solution brings into question whether they are using Microsoft.
Apart from Sophos, I work with ManageEngine, which is a tool for patch management and asset management. It is a Zoho Corporation product. In terms of ManageEngine, AD Plus and others are for managing your Active Directory and Azure AD. I work on the patch management, which is Endpoint Central, asset management, and I have started working on the DLP application control solutions that work on the endpoint. ManageEngine Patch Manager Plus is one of the modules, and you can buy Patch Management as a separate product, but it is better to buy Endpoint Central, which has the patch managing capability built in.
ManageEngine Patch Manager Plus provides the instance in the cloud, so that is the cost saving. Otherwise, I will have to spin up an AWS instance and pay for the AWS instance as well as this product, which is a double cost. Better than that is to just take this offering, which saves time and trouble. You just place a request, they will give you a trial instance or you can sign up for a trial instance. After that, you license it, and the trial becomes your production instance. You do not have to move anything.
I have one customer having it via a partner and another one directly. With Microsoft, you cannot patch non-Microsoft products. You can only patch Microsoft Windows or the server or maybe MS Office, and there are limitations with drivers also. You cannot control the patching through Microsoft because you can create a task and leave it there, but you cannot say deploy this on that machine and do not deploy on the other machine. This is where the third-party patching tool comes into play.
Consider a software developer and colleagues in sales and marketing. The protocol says I do not disturb your machine until you say it is patchable or I will take care of the patching. This is the common understanding in all software organizations. The development machines will not be touched. If you are a developer and I know what patches are there, I can give you a report saying these are all the dangerous ones you need to attend. Either I patch it to the latest edition or you have to take the trouble. If you are going to patch it, you know exactly what you have to patch to, what level you are going to patch it to, and which version you can accept before your system breaks up in some configuration issue.
Software is software, but the code which you have built depends on the version of the software you are running. Obviously, this is the compromise you have to make. Suppose you are using Visual Studio. You can patch it, I can patch the application, but will you let me patch it? That is the question. Microsoft will not patch Visual Studio through Intune. You have to manually patch it.
What happens is you have to define the type of patch policy-wise. Define the type of patch as critical, important, medium, or low. Define whether it is operating system or application, choose whatever you want, set the criteria for the patch to be deployed, and set the schedule for the patch to be deployed. It runs by itself with nothing to be done.