Fisher says it’s difficult to know which of the many patch management products are best. "We have Solaris, HP-UX and Linux, and we’re trying to figure out a solution that will cover all three," he says. "Typically we’ve found we’d have to write [such a solution]. I’d love to be able to use one tool, but I know that applications are different from firmware, which is different from operating systems."

Even with automated patch management, analysts say, the process can still be complex. "If a company has an unstructured environment with a large combination of software products on PCs and servers, it’s not in a good position—no matter what patch management tool it’s using," says Gartner’s Nicolett.

"Patch management software is helpful in that you at least have a vehicle for delivering a high volume of patches automatically. But if you have five configurations of Windows and 500 flavors of production systems, it’s still very difficult to deploy patches," says Laura Koetzle, a senior analyst at Forrester Research. "Having too many configurations of Windows is a huge problem."

Koetzle suggests enterprises select three or four standard configurations—for example, a Web server, an application server and a back office—and standardize on those. "This ensures that eventually you will have a standard pool of Windows configurations that you can more easily test patches against," she says.

Paccar’s Flynn agrees that computing environments are getting too complex. "For the last several years, we’ve worked to get control of our computing environment," he says. "The more you add things, the more difficult it becomes." For that reason, Paccar has begun to restrict company PC specifications and software packages, and restricts who can modify settings.

Meanwhile, software vendors (see "Patch Tools," Page 80) are lining up to provide patch management tools. Microsoft is attempting to improve its own patch solutions. In June, the company launched a redesigned patch management tool and announced it would make continued improvements to its system for issuing security patches for its products. Microsoft later this year will consolidate the ways it distributes patches to customers, to simplify the process.

Will such efforts decrease the need for patch management tools? Not likely. "The tools vendors will always be able to provide some additional value on top of what Microsoft is doing," says Koetzle.