When KES returns a 'Reboot Needed' message, is my endpoint not protected?
The "required" reboots are not really required...they are only required to complete the previous update. The machine remains in a protected state and the virus database continues to update. The program updates that are being installed won't finish until then. (In other words, I wouldn't be super concerned about machines that need a reboot in order to finish the update...other AV vendors don't even alert you to that fact)
In future versions of KES, we'll incorporate some reboot options similar to KES.