For us Secpod Sanernow Patch Management tool is used extensively to patch the vulnerabilities in each devices no matter its location. Features that helps is patching based to risk count to reduce the vulnerability count to a minimal baseline. Other features in PM that helps are the reboot control to set reboot time for Windows OS patches, the rollback feature to rollback patches already deployed. The support for third party patches is also desirable. Other tools like Asset management helps in keeping track of software assets in each devices, outdate applications, blacklist or white list applications are really help. This also helps in automatic License management. There are whole lot of stuff we can do with Endpoint management module also including checks like open ports, last logon users. Actions like device control, application control, software deployment etc. All these are really easy to play around with and helps make our devices compliant.