Patch levels aren't really trackable....but identified vulnerabilities are. You can use something like Qualys or Nessus as part of the VAM aka Vulnerability and Asset Management module in enVision to locate CVEs that are remediated by a Microsoft patch. The canned VAM reports will be more/less helpful depending on how complete the scanner's information is.
I have identified a few issues with the canned reports hanging so if you run up against a blank screen after trying to run a query hang tight...EBFs are on the way.
