Forescout Platform Reviews

We primary use the Forescout appliances to identify, segment, and control all of our internal, manufacturing, automation, and IoT networks. In addition, we use Forescout to deploy guest wireless by utilizing self-registration to allow employees and guests onto our network. Forescout is also responsible for maintaining and showing us all threat data, such as vulnerabilities. We also use it to identify and prevent all malicious network scans throughout our entire network. These powerful tools allow us to secure our network end-to-end.

Before our implementation of Forescout, we had no Network Access Control. This allowed all users, trusted and unknown, to access our internal infrastructure. This was a burden because we are in the contract manufacturing sector where each independent contractor brings in their own infrastructure and it is up to us to secure these networks. Since implementing CounterACT, we have been able to isolate and segment all unknown devices, providing strict requirements for device on boarding. Since implementing Forescout, our environment is significantly more secure.

The biggest benefit to our organization is the fact that being in manufacturing you have many different types of devices. Only a small section of these types of devices support dot1x authentication. This makes Network Access Control very difficult to implement. With Forescout, the difficulty becomes significantly less. Being able to actively identify the client without a certificate allows you to control every device on your network regardless of the make, model, and software running. This allows for end-to-end security.

The product could be improved in different ways: 

• The speed of identification
• More guest management features (i.e. extending time frames)
• Sometimes, the identification profiles completely change after device upgrades. It would be beneficial to keep or merge these records if enough correlating data points exist, so as not to segment devices. 

Some of the features introduced into the product line could have better documentation, which could provide for an overall better experience for administrators.

We have been using Forescout CounterACT for over a year now. We have been very impressed.

Forescout is one of the most stable pieces of software that I have ever worked with. Their updates are timely, and their software has an assortment of plugins and bolt-ons. Having a software this flexible would normally present itself with bugs, but we have not run into any software issues with their plugins, modules, or software in general.

We run virtual appliances. We have needed to bring up a fully functional data center in less than 15 weeks. Forescout takes less than a day to implement. Their product is very scalable.

Tech support is very good and knowledgeable. 

They need to handle their Tier 1 cases differently. The biggest negative regarding Forescout is their support. Not having the ability to get instantly transferred to a support engineer for Tier 1 cases is pretty ridiculous. In addition to the support, they can take their time getting to you, which is another frustrating item.

The initial setup is very simple. The logic behind policies makes it very straightforward. With that being said, policies can be very complex, and if you are not careful, they could have unintended results.

Brite Computers was a phenomenal asset. I would rate them as a 10 out of 10.

The ROI is priceless. How can you put a price on someone's privacy?

We went with the virtual appliance option. The biggest cost to running these types of appliances would be to either have multiple virtual appliances at every data center or running Remote SPAN hardware to provide you the real-time network visibility.

We primarily evaluated Cisco ISE. We looked at Cisco ISE and were in the process of demoing it. We looked elsewhere because the MAC Authentication Bypass feature was not a workaround that we wanted to implement for over half of our environment.

The product has been fantastic for us, meeting our needs. We have hardly had any bugs to speak of. With that being said, please allow Tier 1 cases to be directly transferred to an available engineer. 

The most valuable features of ForeScout is the fact that it can do network access control either with 802.1x or without 802.1x. Many network devices are not ready to do 802.1x. Lots of endpoints are not ready to do it, or they're poor at it, so having a non-.1x solution is critical for maintaining stability on our network.

We did not have a NAC prior to ForeScout. It provides constant monitoring of the endpoints either through an agent or periodic monitoring with a local admin account. This makes posturing very easy to do. Once the device is on the network, we're able to determine, does it continue to meet the requirements that we need for a device to stay on the network?

Definitely, having more third-party integration would be an improvement. This is something that they're doing. Other products that we have on our network, if we're able to get ForeScout to talk with them, we'll get much better information to those products, things like Splunk and other data gathering.

Also, I think we have Rapid7, so all these different programs that want to collect a lot of information, ForeScout is able to do that. So having it being able to talk to them, the more it can talk to, the better it is.

I think there are some product maturity issues in terms of the web interfaces that its able to present for end users. They're working on those. Those are improving, and just other features that come along with them growing into this space that they have. They're getting feedback from us, and they're getting feedback from other very large customers on what to do to improve, and they respond very well.

2 years

We've had no issues with deployment.

We had a few issues that were unique to our environment, but ForeScout tech support has been very timely in being able to respond to them and getting us support we needed. We have had to have a few reboots due to some outages, but again, these are things that were able to be resolve very quickly. Overall, I would say that this is a stable solution.

We're a huge company, over 100,000 employees, and it does require that we have done our homework ahead of time -- that we know where our address space is, that we know what's out there, and being able to come up with a deployment plan is our responsibility. Once we had that, we were able to go with it, and it works very well.

Very good.

Very good.

Device setup is straightforward - NAC itself is always a complex thing due to its profiling of EVERY device that connects to the network.

The ForeScout engineers were there to help us without the standard, "Oh, you have over 100,000 endpoints? Well here's what every 100,000-endpoint company does."

We compared ForeScout to Cisco ISE. There were some other vendors in this space, but we felt they were for mid-sized companies at largest. Cisco looked like they had an offering that would be able to compete head-to-head with it in terms of size. The reason we picked this over ISE was because ForeScout had a non-802.1x solution for the wired network. We would avoid a lot of chaos and a lot of destruction if we go that route. Also, ForeScout had fewer vulnerabilities whereas Cisco ISE had several level-10 vulnerabilities that have been observed over the years. While we were testing it, two of them came out.

ForeScout has never had a vulnerability above 7.0, so when we look at the security of the system, it definitely meets that requirement where this is not something that's going to be compromised the way it looked, as though Cisco ISE had some potential for that. Much less disruptive, both Cisco ISE and ForeScout really require a client to get the full features of the system. They say that it can run client-less, but having the client gives a lot better functionality, and the ForeScout client just worked a lot better for us on our endpoints.

The most important thing would be that a NAC project involves more than just the network. You've got to have client people, PKI people, active directory people all working together with the network to make this product work and make it happen. There's so many ways that it could interrelate. If you're in a very large company, you've got to break down the silo walls and get everybody together from the beginning to make this thing work out, but once you have those people together, this is something that every group wants to have. Desktop people want it, the mobile people want it, the scanning people. Everybody wants it once they see it, so it does sell itself, but you've got to have that education meeting up front.

The most valuable feature of the solution is that it is not dependent on whatever suite or product you use.

The product is very easy to work with and easy to deploy.

Weaknesses of the product are usually present from the side of vendors. In the case of Cisco's vendors, they do have a presence in the South African region. The fact that Forescout Platform doesn't have a presence in the South African region is a weakness because of which you can't ask for help from them if you have any problems. Though they offer support, Forescout Platform does not offer a vendor like other products do for even East Africa ensuring they deliver better services to their customers. The aforementioned area can be considered for improvement.

Maybe integration with or onboarding an XDR solution is something I would like to see in future product releases.

I have experience with Forescout Platform for about three years. My company has a partnership with Forescout. We are also resellers of Forescout.

It is a stable solution.

It is a scalable solution.

I can recommend the solution to medium and enterprise-sized companies. I recommend an open-source product over Forescout Platform to small businesses.

The solution's technical support can onboard more users. I rate the technical support a seven out of ten.

Neutral

An advantage of Forescout Platform is that it is easy to deploy.

The deployment process took around a week.

The product's pricing is reasonable. Considering the deployment or the professional service, on the other side, along with the basic service, which was a bit technical, with the product and the licenses, Forescout Platform can compete with other products.

My company does help our customers manage Forescout Platform.

I would definitely recommend the solution to those planning to use it.

Overall, I rate the solution a nine and a half out of ten.

Mostly, I use this solution for endpoint compliance, antivirus updates to block malicious traffic access to the internal network, and for visibility, to see who is connected to the network and the infrastructure.

I can integrate Forescout with products from multiple vendors in my environment, and also, the integration is searchable. It can be used with 802.1X and non-802.1X to integrate with my existing network. I don't need to upgrade any existing networks in my system, and I don't need to replace existing devices to integrate with Forescout. I find value in not having to spend money upgrading existing devices and networks.

Other solutions have TACACS+, but Forescout does not. In the next release, I would like to see Forescout have accounting.

I've been working with this solution for around two years.

The scalability varies. If you have 1000 endpoints, Forescout recommends the 2000 endpoint plan. Depending on the scalability you choose, the hardware and license can be extended.

We currently have three people who use this solution, including an
IT security person, an administrator, and a technical person.

For technical support, they have ActiveCare Basic, ActiveCare Advanced, and ActiveCare Premium. Mostly, I have used ActiveCare Advanced for technical support requests, and they have responded depending on the severity and also my support plan.

With regard to initial setup, it can take a bit to customize policies. Forescout requires in-depth knowledge to customize policies to monitor endpoint visibility.

It takes around one or two hours to deploy the software and have it up and running. This includes configuration and integration with the existing network. Customization takes a long time because some departments require more customization.

I had a consultant do the deployment, and it could have been better.

You can have a flexible license depending on your environment.

If you are looking for a NAC solution and you want to integrate the existing network infrastructure without upgrades or without replacing existing devices, then you should go with Forescout. Also, if you don't want to run an agent in the endpoint, Forescout is the way to go because it does not require an agent. It is optional. If you are concerned about having to run too many agents in your endpoint and don't want to add an another agent, this solution is a good choice.

Because Forescout has flexible integration and flexible pricing, I would give it a general rating of nine out of ten.

I am a freelance cybersecurity consultant. I provide and implement products for our clients.

Forescout Platform is a very good NAC solution.

It's a very good product.

The agentless visibility is definitely unmatched and outstanding. 

The actions that the agentless visibility, allow us to perform on the endpoint, are really amazing, especially in the way that it is done. 

It is a good solution, Garner rated because their leadership quadrant position is responsible for their market.

As a user, if I am using a laptop that is Wi-Fi connected, Forescout identifies my port connectivity as one user license, and if I take that same laptop with the same username to a wired network, which is also the same network that is used for the Wi-Fi connection, Forescout detects it as a separate license.

At times, I am working on wireless and sometimes I enter a zone where there is no wireless connection, which forces a land connection. This is an issue that needs to be resolved because it consumes another license for the same device and the same user.

This issue has been escalated to Forscout directly.

There was integration with Microsoft SCCM previously, and have suddenly stopped the open integration module for Microsoft. Customers are not aware of what is available to them in terms of the open integration module. 

Forescout Platform advised that there are many options available and many things they can do, but they don't tell customers exactly what they are. 

They need clear documentation and direction as to what the customer can expect from the open integration module. Customers need some clarity on what they can do and what is not possible to do.

When it comes to a full open integration we need to rely on the professional services from Forescout directly, no one can implement it as there is a limited amount of knowledge available.

They need to be more considerate, and there should be good documentation available to the customer.

They need to improve their selling approach or the consultant approach.

One of their use cases is an ITM use case, and ITSS asset management, but they don't really do ITSS management. They only detect the ITSS and all the parameters around that test, but they do not have any integration with any database system where they can store all these details and act like a typical ITSS management system. 

They should remove that use case in full. They should say that we complement your ITSS management by detecting the unknown assets in your network. This would be right.

I have been familiar with the Forescout Platform for more than four years.

In terms of technical support, their engineering team is very rigid. They must provide us with some clear answers and if they exceed the time it takes to resolve the issue, they will charge for that extra time. For example, if they go one day more, they will charge for that extra day.

We have completed significant deployments which are more than 4,000 endpoints. There was a complex network architecture.

All of the implementations have gone very well and the customers are satisfied.

They base the license on the number of devices, which is quite misleading. If I am one user, it should be based on that rather than how many devices I use with the same user name. 

To base it on the number of devices it can reduce one more license from my overall license allotment. It can result in four or five licenses for one user.

I was a partner of the company who was a Forescout Platform partner and I was responsible for bringing in Forescout, and establishing the service line for the Forescout Platform sales, pre-sales, and the implementation, but I am no longer with that company.

I would rate Forescout Platform an eight out of ten.

• Immediate relocation of network devices to segregated "Vendor" network based on autonomous analysis. Prevents scanning, malware spread, corporate asset (i.e. printer) misuse, and reconnaissance on our network by third-party devices. Allows us to block VPN from our corporate network but still allow Vendors to establish them.
• Better information provided by Level 1 support (helpdesk) regarding asset information as we provide them with R/O access to the tool
• Visitor policy communication & acceptance

• Network Access Control, its core use
• Asset Intelligence for deskside
• "What port is it plugged into" intelligence for deskside
• Patch-level Auditing
• Emergency response, risk assessment information to get a view of the vulnerability
• "What PC is a user on" for helpdesk/IT security/deskside
• Forces PEN Testers to request permission to exist on your network

• JAVA Memory management - leaving the app running for multiple days requires relaunch
• Search - needs boolean functionality (or psudeau operand now working)

Stability has been good.

• It is very scalable, allowing additional strategic appliances as required in either physical or VM format.
• We control >400 field sites, two Oilsands mines, multiple remote platform locations, 2 Canadian Metro offices and 1 UK office with 4 appliances centrally located.

Customer Service:

It's excellent! 

Technical Support:

It's excellent!

No previous solution was used.

It was straightforward, although I recommend having a strong relationship with network-asset owners to ensure SNMP rights are looked after.

We used a vendor, Conexsys (Graham Cheng & Jerry G), who were excellent.

Forescout's flex licensing has made our deployment more agile and helps us adapt our environment without buying more hardware.  

Under their old model, licensing was tied to 4k and 10k appliances which strained under the new v7 and v8 Forescout OS when nearing their designed capacity.  To acquire a new appliance, physical or virtual, meant buying licensing for that size of appliance.

Under the new flex licensing model, we've been able to deploy VM appliances, responsible for host interrogation and management, while retaining our physical appliances for SNMP switch management, and span aggregation.  

Under the flex licencing model, we've deployed to our ICS segments, and are deploying VMs to our DCS environment, allowing for full visibility under one 'pane of glass' of nearly every host on our network.

Ensure you consider everything you want to monitor that has an IP. Devices with multiple IP's count multiple times against your license count.

This was chosen without hands-on evaluation based on reviews and industry feedback.

If you have distributed services (DHCP), strategically ensure you generate reliable traffic to establish timely inspections. We've avoided the use of traps by centralizing our DHCP at HQ, but it causes black holes during inspection schedules in case of a static device being plugged in.

Our primary use cases of Forescout Platform are network access control, user access control, and Wi-Fi network access control.

The most valuable feature of Forescout Platform is that it has everything that Aruba has at significantly less cost.

Unfortunately, Forescout Platform can only be accessed by Android systems. iOS is not supported, so there are some limitations to the operating system. I would like to see all devices have access to the solution.

Forescout needs to upgrade its development in the future.

I have been using Forescout Platform for the last two years.

Forescout Platform is very stable.

The solution is scalable. It is not one box that has limitations on licenses. Forescout Platform is more capable than Aruba ClearPass. 

Customer service and support is a four out of five overall. I am satisfied with the support I receive. 

Positive

Comparing Forescout to Aruba ClearPass, the difference is in the price and the level of policy enforcement.

The initial setup of Forescout Platform is very easy because it is pre-configured. I would rate it a five of five for the ease of setup of this product.

Forescout Platform licenses include everything integrated into the system including eyesight, recovery, and valid license. All three come in one box. It is a very competitive product, being half the price of its competitors.

5,000 user licenses will cost you between seven and eight million dollars, compared to 20 million for Aruba.

Overall, I would rate Forescout an eight out of ten.

Endpoint visibility, policy flexibility, compatibility and integration with other products.

Automation! One broad example is that we can now stop network threats right away and without intervention.

Forescout is constantly adding new features, so this may change as of this writing, but sometimes the switch management interface doesn't display accurate information which relates to false positives on individual switch access errors.

1 year

None that were Forescout related. CounterACT always opens a bunch of little IP sessions with endpoints, ake sure you have a large enough connection table on your firewall if you plan to put it behind one.

Minor. Had to reinstall one virtual appliance, which is painless when you have an Enterprise Manager.

No, this is one of the products strengths.

10 out of 10. Very responsive and address concerns quickly.

9 out of 10. Really fast response, high level of competency.

I switched from Cisco NAC because it is reliant on 802.1X, and has no other function than to ensure endpoints have authenticated via your method of choice.

Straightforward. Setup is simple with a solid, pre-defined set of policies that you build on and customize as you learn.

In house.

Without access specific numbers, we now have the ability to instantly shut down internal malicious hosts or traffic, refuse or restrict access to non-compliant hosts, discover risks on the network we didn't know were there, and automate the remediation of a multitude of security risks. As I work for an organization that spends a lot on security administration, at a minimum, the cost savings must have already paid for the product.

Palo Alto

Make sure to plan for all endpoints. If you want full coverage of your networks, account for anything that has an IP address. For example, a busy core switch can have 20+ IP addresses, and each one goes against your license count. Also, if you plan to have it behind a firewall, take into consideration your firewall's connection limitations. Although CounterACT isn't really a heavy bandwidth user, it does open a ton of short connections on a constant basis. The more you tune these down, the less accurate your real time host information becomes.