Trend Vision One Endpoint Security Reviews

We use Trend Micro One Endpoint Security for endpoint security. We are using the SaaS version of One Endpoint Security. 

I am confident in One Endpoint Security's capability to defend endpoints against threats like malware, ransomware, and malicious scripts. 

One Endpoint Security has predictive machine learning and behavior monitoring, which are essential for endpoint security. Our file scan also scans the memory for malware. Behavior monitoring is particularly effective at detecting ransomware attacks because it can check for unusual encryption methods.

I like the way Trend products integrate with each other. The servers are all tied into Central, which is now integrated into my Vision One console. The on-premises stuff is also integrated with Azure.

We use a single dashboard through The Central to view detections, threat hunting, and investigations. The visibility through the single console is important. When we open the dashboard, it tells us what it has found. For example, I am currently looking at the SaaS version. If I go to One Endpoint Security, I can see all of the agents that are currently connected. It takes a few moments for all of the agents to load. We are currently in a downtime during the summer months. We are a school board, so there are fewer staff members on-site, and not all of the schools are open. We have 12,000 employees and 80,000 students. However, not all of the students are online right now as they would be during the school year. Next Friday, we will have more staff members in the office. When school starts after the Labor Day long weekend in Canada in September, everyone will be back online. Currently, the dashboard only shows 9,140 agents. Last week, it showed 6,400 agents. I have the system set up to remove inactive agents so that the system does not have to constantly scan a bunch of systems that are not even there. I have seen up to 17,000 endpoints on our system.

Vision One is now monitoring my Cloud One workload security and My Cloud Central. This means that Vision One is collecting data from both systems and giving me a comprehensive overview of my security posture. When I open Vision One, I will be able to see visibility into my entire organization. I have configured Vision One to send data to our Syslog server and receive data from our Qualys server. The Qualys server scans my servers for vulnerabilities and reports back to Vision One. I have also set up a service gateway and a workload security data center gateway. The workload security data center gateway feeds data from my VMware ESX servers into Vision One. This allows Vision One to see the real-time status of our VMs, including which ones are powered on, which ones are running the Deep Security Agent, and which ones are still running on my on-prem Deep Security server. Vision One provides me with a risk overview, an exposure overview, and an attack overview. This information includes details about credential access, lateral movement, collection impact, and suspicious mail forwarding rules.

We have our Azure system for Office 365 and on-premises Azure Active Directory also connected to Vision One. This means that Vision One can see all logins to our Azure system and our on-premises AD. I have agents running on our on-premises directory controllers, so this data is also being fed into Vision One. Vision One can also see our Azure domain controllers and our DMZ. I receive alert emails when something serious happens. I haven't received any of these emails since we started using Vision One. However, I receive emails about endpoints that have had files quarantined. The file on the endpoint was too large to move to the main server quarantine, so Vision One just gave me a small error message. Currently, the endpoint protection dashboard shows that out of 19,678 endpoints, agents have been deployed on 13,675. This includes Macs. The dashboard shows one Linux endpoint, which is my service gateway. There are 882 Mac OS endpoints, which is lower than the usual number of 1,100 because not all of them are turned on. There are 12,792 Windows endpoints. The dashboard also shows that 6,003 endpoints have no security protection. These endpoints likely include network equipment, certain Linux servers that are not running Trend Micro software, and proprietary operating systems that are used by our network team and other IT groups. There are also endpoints that are listed in our Active Directory, but they are either turned off or do not have any active systems.

Updates are applied on an hourly basis. If an exploit gets through and an endpoint has not been updated, it will receive the update on the next cycle. The most common reason for an endpoint not receiving an update is a network issue or the endpoint being powered off. Once an endpoint goes online, it is configured to automatically retrieve security updates from the server, or directly from Trend Servers over the internet if the server is unavailable. The first thing the endpoint does when it goes online is update its security patches, signatures, and scan engines. When a detection is made, the endpoint first deletes the file and quarantines it. It then blocks the action of whatever the file was trying to do. The endpoint's virtual patching, behavior monitoring, and predictive machine learning then stop any unusual activity. This may even include an activity that is supposed to happen. We have had members of our ICT department complain that they were unable to install software because the antivirus protection was blocking it. In some cases, we have groups within our organization that are responsible for maintaining their own servers. When they are doing upgrades, they may schedule us to temporarily disable the antivirus protection so that they can complete the upgrade. Even if malware does not get detected by the web reputation system and is downloaded by a user, it may still be detected by the signature-based malware detection system. If it is not detected by either of these systems, it may still be blocked if it tries to contact its master. These master addresses are often common addresses on the internet that are used by bots to communicate with a server that is maintained by the threat actor. If a bot is blocked from contacting its master, it will be unable to function. If we see a large number of bots being blocked, we will investigate the system to see what is causing the issue. In many cases, it turns out to be a legitimate activity that is being blocked by the system. For example, we may have custom scripts running on certain servers that look suspicious to the system. We can manually whitelist these scripts so that they are not blocked. Overall, the system is designed to be overprotective. This is because it is better to block something that is legitimate than to let malware through. We can always fix a false positive, but it is much more difficult to fix a security breach.

I started using One Endpoint Security in August 2020. I learned how to move agents, install software, and get the agent onto the server. I also learned from the documentation, knowledge base, forums, and other users. I found One Endpoint Security to be more difficult to learn than PaperCut because the terminology and concepts are different. PaperCut is just about printing and monitoring, while One Endpoint Security is about cybersecurity. There are also many caveats to consider with One Endpoint Security. I found the scan settings to be particularly challenging. Trend Micro has helpful best practices documents, which I used to learn what the normal settings are for servers and workstations. For example, servers don't need to be scanned for office document exploits because they typically don't have Office installed. I also learned that it's important to balance security with performance. We don't want to scan servers so heavily that it slows them down, but we also don't want to skip important security checks. In January 2021, we changed our policy on security settings. We now tell users that if there are any problems, we will fix them. We would rather have a small problem that we can fix quickly than have to restore a server from backup, which can take days.

One Endpoint Security provides virtual patching, also known as vulnerability protection, to protect against vulnerabilities before they are exploited. Deep Security and Workload Security call this feature intrusion prevention, but it is essentially the same thing.

We use the solution for security for endpoints. 

I do a lot of POCs to measure response. 

Trend Micro uses agents to communicate with servers. We're using the service gateway. 

We use the cloud and take advantage of virtual patching. Most customers now use the platform. However, I also have a lot of experience with on-premises setups. 

I work on various models and work on multiple Trend Micro products.

If a machine is not patched properly or the required certificates are not installed, Trend Micro has the ability to remove the existing end device. 

We can access all products and policies now from One Endpoint Security. We can deploy policies and do everything directly from One Endpoint Security. 

Our primary use case is to provide robust XDR capabilities along with advanced EPP solutions. Filtering which external devices, such as USB pen drives can be used on laptops and computers. It also helps determine whether users can use a 4G or 5G modem on the laptop. The tool performs peripheral filtering or securing the peripherals. IT team leaders and internal auditors were mostly interested in the big picture of the company's risk overview.

The solution is used for XDR (extended detection and response), threat hunting, endpoint protection, and device filtering.

The solution works wonderfully to defend endpoints against malware, ransomware, and malicious scripts.

The solution’s machine learning capabilities are wonderful. We extensively tested the solution's machine-learning capabilities, and deploying it to several hundred machines was easy. The solution has capabilities to extend it to protect against AI attacks, deepfake videos, or deepfake emails. In the email protection module, the solution has a writing style analyzer. You can pinpoint the most important entities or people in the company, and the tool will learn how they write and communicate from their emails.

This allows the tool to protect against the business being compromised, and that's a very useful feature. It's a statistical analyzer based on machine learning that observes how you communicate. It needs time, but you can make it learn faster to see the emails. However, it's more useful if you work with current emails, not just the old ones.

You should give the tool two weeks for the current emails, and after two weeks, you can close the learning mode. The solution alerts if it thinks that a business email has been compromised. You have to give it two weeks before it can reliably say whether it's written by the actual user or if it's a fake.

Trend Vision One Endpoint Security provides a single console for cross-layer detection, threat hunting, and investigation. It will collect and show through alerts what is connected from other modules. When something happens on the node that originally came from an email the user clicked on, the tool can pinpoint where the email came from and who else in the company got it. You can block, delete, or put those emails in quarantine before other users click and open them.

You can see all the network activities they have done or tried to do. You can also see where they tried to communicate from the URL filtering and what they dropped. In the solution's new version, a privileged user has access to a predictive attack vector.

The single console's end-to-end visibility has reduced our response time because we have automated responses called playbooks. You can decide whether the probability is small, medium, or high and whether it comes from an email or file. You can also decide whether to block the user, kill the process, send an email, or create the workbench automatically to see what happened and what was the case.

You can manually generate workbenches for the hunting, but if you use the automation playbooks, it can respond faster automatically. The customer bought and managed the MDR (managed detection and response) service. Other professionals bought this managed service for all the products.

For the price of one SOC Analyst a year, a medium-sized bank got 24/7 service with extra help. It was pretty cheap compared to competitors or to the fine they would have to pay if something happened and they could not report back in a timely manner. They wanted to make sure they had double protection.

The solution's end-to-end visibility has reduced your response times. If something happens, the automation handles it pretty fast. Everything is filtered, and the workbenches are created automatically. There's also an auto-response. If something happens, we can block the user or disable the user's Active Directory. We can kill the process or isolate the machine.

It happens almost in real-time when the detection happens. Still, we have an option to just give alerts because the machine or user is too important to block or isolate automatically. You just want to see what happens in the console. If somebody's online, the response time takes ten minutes or so.

Users have to learn to use the solution because it's a bit complex. The solution is pretty straightforward in that the problem is not with the tool's usage but who works with it. Suppose a helpdesk person or an operator gets the alarms for the user laptops. It's not about where to click, how to use it, or which user is using that because it's super easy as it shows the username and where the user is logged in on other computers. You have all the information from the company if it's a clean alert.

Sometimes, they have to verify the technical background. Based on the alerts, the knowledge base, and the preview setting, Trend Micro users can chat with an AI to find out how serious the problem is. Suppose there is a software that behaves badly and gives a false positive because it's poorly written. You excluded it on other machines or decided not to quarantine it because you know it is problematic.

The software has a new version. It comes and is blocked again. It can learn that it has happened before in your environment, so that could be a false positive. You can chat with an AI there, and they can ask about the context. If you are in the workbench environment, you can ask about a user, and it will analyze. Previously, it was not so great. However, it's much better and more mature now because it has learned a lot from the company and what has happened inside it. They also could have just developed a new version.

It's very easy to administer Trend Vision One Endpoint Security.

The solution provides consolidated security across hybrid environments because users don't have to buy tools from three different vendors. Previously, there was an antivirus, an EDR, and a CM to analyze. They kept the CM because they already paid for it. The email protection was different. Right now, they see everything, including email protection, server protection, desktop or PC protection, and XDR.

All the protection for PCs, servers, and emails by both modules is happening from the same console. The threat hunting happens in the same console because they have all the logs. They have everything in one console, including email protection, threat hunting, and server protection. They will introduce mobile protection from Trend Micro, which is XDR for mobile.

All the threat hunting can happen. If something happens on one device, you can see the full context of the user in one console. This is the risk analysis for the C-level entities. It's the overall risk index, and it calculates the actual state. They have a module. The customer didn't buy it because they had already bought a tool for that. This module is more accurate and detailed because the default risk index shows you the overall risk or the ten most risky PCs and users.

Suppose you want the Attack Surface Risk Management (ASRM), which is a more detailed module. It calculates the risk differently if you are inside the company network, on the road with a laptop and free Wi-Fi, or at home and you don't have patches. It calculates that if you have a very important system that you have marked, and if the user connects to that and it's not patched correctly, it has a higher risk.

It could happen with another user who misses the same patches but doesn't have access to critical systems. It has a lower index because the impact will not be so high if the user is compromised. However, it will have a higher index if it's a privileged user. It's not like watching the software versions and the configuration options, but it also benchmarks the context of the user and learns from the AI as well.

The PC product includes 300 of the most widely used virtual patches for ongoing attacks. For example, if there is a new Microsoft bug with a remote desktop, it will provide virtual patches. However, if there is a missing patch not on your system, it's used and gives you an alarm if somebody tries to take advantage of it. Even if you don't need a patch, you can see when an unmanaged computer on the network is trying to hack it.

They have another virtual patching system for the servers in the server product, which is the cloud one and needs an extra license. It gives the host IPFs, and it analyzes traffic as well. If you have vulnerable systems, it will automatically use virtual patches, but it's an extra license for the servers.

If it sees that you have a vulnerable Java application and an old Java version, it will activate the virtual patches for the vulnerabilities against it. However, if you patch, it will turn off automatically by default, so it doesn't consume resources. So, it can be all automated.

We use Trend Vision One Endpoint Security for threat investigation, DDI, DLP,  analyzer, and email scanning. Other Trend Micro solutions share their suspicious objects with One Endpoint Security , and One Endpoint Security investigates the suspicious items. 

We are using One Endpoint Security  in the cloud because we are a ministry, and we have more than a hundred branches. All the branches are connected and integrated through the cloud. We have 6,500 endpoints or 20,000 if we include all the branches. 

We have all of the Trend Micro products, so it's beneficial to integrate them all and get consolidated logs of suspicious objects and malware attacks in a single console. We can do the same work with fewer employees because of One Endpoint Security's automation. 

We protect our client's desktops, laptops, and other devices. The servers will be protected by cloud and workload security. It's a complete end-to-end inter-security solution.

The solution provides our customers with malware protection. It has a good level of malware protection to protect against malicious threats. It provides protection against a good number of threats, both known and unknown, and we do get more details to help us log and investigate.

My company had an opportunity to implement Trend Micro Endpoint for one of our customers. They have around 500 PCs as endpoints and also around 100 or 120 servers.

The behavior analytics feature is very useful, and its threat detection based on AI is very strong. It is easy to integrate with other vendors and technologies like SIEM and SOAR. The traffic is monitored and can be managed successfully.

We use Trend Micro Apex One for endpoint security on our devices.

Trend Micro Apex One has been doing a good job protecting our endpoints against malware and malicious scripts. We have not had to deal with any threats.

Apex One boasts advanced protection capabilities that continuously adapt to safeguard against previously unknown and deceptive new threats. The ability to adapt to evolving threats is crucial, especially considering the surge in new variants, including zero-day attacks.

It detects ransomware using machine learning. This capability is important to defend against ransomware attacks.

The solution provides a single console for cross-layer detection for threat hunting and investigations. This is particularly helpful for gaining visibility across multiple platforms.

Apex One is integrated with our other security products.

It is easy to learn. Updating the solution is also easy.

I have experience with previous versions of Trend Micro so for me administering Apex One is easy.

Apex One has protected our organization from threats.

Apex One provides virtual patching before patches are available for the source of the issue. The virtual patching helps minimize risk until the patch is ready.

Since using Apex One, we have seen a reduction in viruses and malware by 50 percent.

We use Apex One as a service and this has helped save our staff five percent of their time.

Apex One has reduced our administrative overhead by five percent.

We utilize Trend Micro Apex One for endpoint security across all of our clients, managing it centrally alongside the entire Trend Micro suite.

We implemented Trend Micro Apex One to improve our endpoint security.

Trend Micro Apex One is able to identify threats and notify us to investigate from a central location. From there we are able to inform the client and disconnect the affected device to protect the environment.

Apex One employs advanced protection features, including behavior analysis, to adapt to and defend against unknown threats. Apex One's ability to recognize abnormal behavior and terminate processes is crucial for safeguarding our organization's security.

Apex One utilizes runtime machine learning to detect ransomware, a crucial feature for safeguarding our data from ransomware attacks.

We utilize Apex Central as a single unified console for comprehensive management, enhanced visibility, and effective cross-layer threat detection, hunting, and investigations. As managers of Apex One, we require a centralized console for comprehensive threat detection, investigation, and hunting across all layers of the environment to effectively monitor and manage client performance.

Apex One's single console provides end-to-end visibility into the entire IT security environment.

The end-to-end visibility has significantly reduced our response time, enabling us to respond within five minutes.

We have integrated Apex One with other security products. Apex One is able to deploy rapid updates within ten minutes of detecting threats in the network sandbox. 

The ability to deploy updates immediately is crucial for me as a security manager.

Apex One is easy to learn.

Administering Apex One is more straightforward than the other products I manage.

Apex One has helped improve our production. We were able to see the benefits within two months.

Apex One offers virtual patching to mitigate vulnerabilities that attackers could exploit.

We have seen a reduction in viruses and malware since the implementation of Apex One.

Apex One has reduced our administrative overhead because it is easy to use.