Firstly, congrats on a first class Q&A of NAC. Picking up on Joel Snyder's NAC's inability to measure if a client is infected or not I wonder if our eSAC technology might provide a logical step up on simply checking if an AV is installed, up to date and has no recorded infections.

Take our Prevx eSAC which is intended for use in eCommerce transactions allowing a web site to check if a client PC is infected or not. Unlike NAC our eSAC is agnostic to the presence or state of the end-point security product. Sure it can report on this like any other NAC Client. However, eSAC's primary function is to provide an independent scan of the client to detect active malware.

The process takes around 1 minute from the initial download of the eSAC exe (600Kb) to completion of its scan. The scan's effectiveness is at least as good as that of a modern, up to data AV.

It would be a trivial exercise to augment an existing NAC client to include the eSAC scan technology or for eSAC to be used as an alternative NAC client component.

My point being that an independent high speed, high effficacy scanning agent as we have in eSAC would offer a more consistent and reliable method of reducing risk by blocking clients with known infections.

Regards

Mel Morris
CEO
Prevx

Click to read the article this is in response to.