They had no idea their virus scan was using a certain service account to authenticate to the virus-scan server, and these authentications showed up in the log. It was never a security issue, but the IT staff looked at the log and eventually figured out what was going on. "It's allowed us to understand some of our applications and processes a little better," he says.

GEHA is using Nevis NAC endpoint scanning on one of its access switches that services the company network operations center. That switch is used only by the company network services department and is essentially trialing the capability.

At some point, devices wired into the LAN may be scanned, but for now Gerharter says they are considered safe enough. Other virus scanning software and patch-updating software keep them in compliance, he say. . "There's no reason for Nevis to be reporting on this when we have other tools reporting as well," he says.

The Nevis device can restrict access to servers that must be kept secure under HIPAA regulations, he says, and while it hasn't done so yet, GEHA has plans to use that as well. It has no specific time table for implementing it.

Meanwhile, the NAC gear is doing what it was purchased to do, he says. Last week a company employee brought her personal laptop in to work because she was having trouble getting it to connect remotely using Citrix's browser-based Web access, he says. She was unauthorized to plug it into the corporate network directly.

"She brought her laptop in and plugged it in," Gerharter says. "How would we know how often that's happening without a very watchful eye and constantly looking at this stuff?" The company's IT staff is too small to monitor this type of incident manually, he says.