When the only option I had was xp_cmdshell it was a godsend, however when SQL 2005/2008 came available we moved away from its use because of security considerations. We took a "just don't use it" position.

However with all that said, there were still times when command-line executables need to be called, what we did was to use SQLCLR to instantiate a process and call the command-line. But the SQLCLR function was only capable of calling that one command-line executable. We viewed this as the safest method since we controlled what could be called and how it was called and what command-line options could be passed. It also didn't use very much memory which can sometimes be an issue with SQLCLR. We had a very limited number of cases where we allowed command-line calls so our CLR code wouldn't change often.

CEWII