This is a solid vulnerability assessment appliance with a long-standing pedigree. The StillSecure VAM is also available in a software-only version. Implementation is straightforward and the web-based user interface is intuitive. Operation and administration are easy enough, and a plethora of wizards makes most tasks quick and effective.
Reporting is good and includes many templates. However, setting up the reporting can be a bit tedious. Like most products in this group test, VAM supports compliance testing, especially Payment Card Industry standards.Compliance reporting is strong.
We had no trouble implementing the VAM in our test environment. There is a clear installation guide that takes you through initial configuration. For much more depth, the user guide offers additional information and specific details on VAM capabilities. The documentation is in PDF files that are packed with screen shots, examples and menu descriptions.
VAM is Linux-based, but the operating system is somewhat purpose built. Today that can mean anything from a completely new operating system to a hardened version of an existing one. In this case, there is a lot of Linux (a hardened version of Red Hat) in the VAM, which makes for an efficient operating environment. We found no obvious way to compromise the VAM OS.
The product provides network mapping and discovery, and this can be automated and scheduled. Performance was above average, with the appliance identifying more than 75 per cent of our vulnerabilities. In addition, the VAM can act as a centralised dashboard correlation centre, accepting scanner output from other devices, such as Nessus and ISS Internet Scanner, as well as other copies of the VAM.
Support is excellent, including email and phone. Additional support packages include product updates and upgrades, plus rule updates. There is a frequently asked questions section on the website, as well as other useful resources.
We found the VAM to be a bit pricey, however. Although the product performs well and is scalable, at £21 per IP address, it can be quite expensive for large enterprises, even with the available volume discounts.