Kaspersky Anti-Targeted Attack Platform Reviews

I feel the anti-ransomware update is one of the tool's valuable features. There is another feature in the solution that gives us a lot of problems.

Kaspersky Anti-Targeted Attack Platform has highlighted that it's an anti-ransomware tool. They also have a roll-back, but it is not the unique roll-back we have in Harmony. With the pricing, they do provide competition. At times, the reason for considering it is due to its pricing. The pricing of the product should be improved.

The technical side of the tool is okay because we have dedicated two engineers, and they have been doing a really good job. Pricing-wise or package-wise, if Kaspersky can support us, then I think that could be an ideal situation in Sri Lanka because it is a small island. Also, we don't have many big companies or conglomerates. Hence, we have small and medium customers. There are big players, but most of the customers are actually in the middle, like SMBs. Therefore, if you can have a good package with good pricing, we can sell much more of Kaspersky. If you can have packages where if a customer buys thirty solutions, then he gets this much, or what he gets with twenty, fifty, or hundred solutions. Then customers will get a variety of pricing, and that would be the ideal situation. So, if you can have packages, like, indicating the price of, let's say, ten, twenty, thirty, or fifty solutions. It would be good to even have a bundle with Quadrant SPARK. We do have packages at the moment. However, those are not very attractive.

We use the Kaspersky Anti-Targeted Attack Platform for targeted attack prevention and endpoint detection and response. We leverage this solution to detect threats that break traditional endpoint security measures. It uses a sandbox environment within the customer's IT infrastructure to identify advanced and persistent threats, including those without signatures. It's implemented across email, web, and endpoints.

The solution is very easy to use. Its interface is very simple, and you can build IOC's indicators. You can use your rules to detect these attacks because you can leverage threat intelligence. You can develop rules and preventive policies. You can also perform an IOC sweep in your environment, which helps identify the potential compromises.

The product is a combination of different Kaspersky solutions. It includes Kaspersky Secure Mail Gateway, Kaspersky Sandbox, and Kaspersky EDR. It is used for USB blocking. If any malicious software is installed in any system, it will be analyzed in a sandbox environment and blocked according to the results.

The email security feature is really good. I like the email security feature because most XDRs do not provide such features. If any email with a malicious code or link comes to the environment, the tool first checks in the sandbox whether the link is malicious. After analyzing it, the solution delivers the email to the employees.

Kaspersky Anti-Targeted Attack Platform is not a good product. We had problems with endpoints and the solution did not detect it. We didn't get any alerts about the attack. 

Kaspersky Anti-Targeted Attack Platform is stable and runs all the time. 

I use the solution in my company since it has many good features, like sandbox features and other tech aspects. When I find other use cases or see feedback, I learn what the tool's strengths are from the other side or other people.

The most valuable features of the solution are associated with the deployment area, especially when deployed on an on-prem model. The brand comes from Russia, so I heard that in Russia, the knowledge of threats is advanced, especially since some of the threats come from the United States. I think CrowdStrike is better than Kaspersky.

There are two main use cases. The first is EDR. It is a monitoring tool installed on the endpoint device, primarily workstations and servers, to monitor any system activity and identify some abnormal activities that might trace the compensation of the infrastructure. Secondly, it helps to monitor network activity via network traffic that passes across the infrastructure.

So many cyberattacks are still unknown, with no known signatures or attributes that allow you to identify them definitively. However, any kind of cyberattack leaves traces behind. For example, after some activities, attackers may be unable to delete all the clues they go through in the infrastructure. An EDR solution can identify abnormal activities on the endpoint, such as a user opening a malicious email attachment or a workstation downloading a payload. In most cases, antivirus software cannot detect these attacks, but EDR can. You can collect all necessary metadata from EDR, which can then be analyzed automatically by a data anti-barging site or manually by threat-hunting analysts.