We will primarily use the solution for protecting our database. We're still implementing the product. It's not fully in place just yet.
DBA Dept. Manager at a computer software company with 501-1,000 employees
Flexible, stable, and easy to use
Pros and Cons
- "The product has proven to be flexible"
- "The installation should be a bit easier."
What is our primary use case?
What is most valuable?
The solution is easy to use.
We've found the solution to be very stable.
The product has proven to be flexible.
The system, overall, is quite reliable.
What needs improvement?
The installation should be a bit easier. It's pretty hard to implement right now.
The solution is very expensive. It's expected, as IBM is known to be pricey. It would be nice if they could make it cheaper.
As we are still in the process of implementing the product, it's hard to discuss the features and what might be missing, or could be added. We need more time with the solution to see how it works or what's missing.
For how long have I used the solution?
We've only been using the solution for a short time by now. We're in the middle of implementing it. It's likely only been a couple of weeks.
Buyer's Guide
IBM Security Guardium Data Protection
April 2025

Learn what your peers think about IBM Security Guardium Data Protection. Get advice and tips from experienced pros sharing their opinions. Updated: April 2025.
849,210 professionals have used our research since 2012.
What do I think about the stability of the solution?
We have found the stability to be quite good. It doesn't crash or freeze. There are no bugs or glitches. Its performance has been very good so far.
What do I think about the scalability of the solution?
The solution is very scalable. If a company needs to expand it, it can do so easily.
Only the administrators really deal with the solution at this time. There are four of us.
We did pay for it, therefore we do plan to continue to use it for the foreseeable future.
How are customer service and support?
Our support is through a third-party service, and not directly through IBM itself.
It's been very good so far. They are helpful and responsive.
Which solution did I use previously and why did I switch?
We did not previously use another solution before choosing this IBM product.
How was the initial setup?
The installation is not straightforward at all. In fact, it is very, very complicated. We found the process to be quite difficult to handle. The hardest part is the tuning of the system, to make it work right.
What's my experience with pricing, setup cost, and licensing?
The product is expensive, which is what you tend to expect from IBM products. It's not cheap.
What other advice do I have?
We may be using version 11 of the product at this time.
We're still in the process of implementing the solution. It's still quite new to us.
Right now, I would rate the solution at a nine out of ten, however, I do need more time to really get to know it to evaluate it properly. I likely need another good six months or so with the solution before I can really rate it effectively.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.

Socio Director at RAMDIA
An easy-to-deploy solution with good price, compatibility, stability, and scalability
Pros and Cons
- "One of the most valuable features is the accelerator. It has a predefined report for PCI SOX compliance and other compliances."
- "The most important requirements for us are integration with new database solutions and the ability to manage things like Jailbreak or something like that. Its reduction feature can also be improved. It has a functionality called reduction, which is like masking data, but it is just a replacement of characters. Sometimes the customer needs more than this. It would be good if it was more advanced or complete. We also have a problem with this solution because the IBM aggregator isn't working very well. IBM has created big data intelligence for Guardium, and occasionally, customers need three or four months of data, but they can't run it from the collectors. It can have a better dashboard and more pre-defined use cases for those customers who don't have any idea about data protection or don't have expert personnel in this area. For example, they can include five use cases for banks and five use cases for retail."
What is our primary use case?
One of my customers is a company that manages telecommunications in Mexico. It is a very important company, and they use Guardium for compliance purposes. They use it to comply with PCI, for example.
We have on-premises and cloud deployments. We are currently deploying a customer's environment in Microsoft Azure with SQL Server.
How has it helped my organization?
One of our customers uses IBM Security Guardium to discover the production time and to know the transactions about their databases.
What is most valuable?
One of the most valuable features is the accelerator. It has a predefined report for PCI SOX compliance and other compliances.
What needs improvement?
The most important requirements for us are integration with new database solutions and the ability to manage things like Jailbreak or something like that.
Its reduction feature can also be improved. It has a functionality called reduction, which is like masking data, but it is just a replacement of characters. Sometimes the customer needs more than this. It would be good if it was more advanced or complete.
We also have a problem with this solution because the IBM aggregator isn't working very well. IBM has created big data intelligence for Guardium, and occasionally, customers need three or four months of data, but they can't run it from the collectors.
It can have a better dashboard and more pre-defined use cases for those customers who don't have any idea about data protection or don't have expert personnel in this area. For example, they can include five use cases for banks and five use cases for retail.
For how long have I used the solution?
I have been using this solution for eight or nine years. I have been using Guardium before it was bought by IBM.
What do I think about the stability of the solution?
Its stability is very good. It is quite available all the time.
What do I think about the scalability of the solution?
Its scalability is perfect. In Mexico, we did most of the implementations for medium and large customers. Our company implemented this solution for banks and telecommunication companies.
How are customer service and technical support?
IBM's technical support is good, but it can be improved. They can improve the response time for the tickets and the availability for the resolution of the tickets.
How was the initial setup?
It is not complex now. Prior to version 11, in general, the console and the environment were not good. They were bad, but they are good in version 11. The deployment duration varies, and complete integration in Windows can take three weeks to two months.
What's my experience with pricing, setup cost, and licensing?
Its cost is good. With the new metric of licensing, such as PDO not being available now, customers are expecting a good price for the solution.
Which other solutions did I evaluate?
Oracle Vault, Guardium, and Imperva are the three main solutions that clients consider. Easy deployment and good compatibility with all the solutions that customers have gives Guardium an advantage over other solutions.
What other advice do I have?
We would recommend this solution to others. It is a good solution at a good price, and your data is invaluable.
I would rate IBM Guardium Data Protection a nine out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Buyer's Guide
IBM Security Guardium Data Protection
April 2025

Learn what your peers think about IBM Security Guardium Data Protection. Get advice and tips from experienced pros sharing their opinions. Updated: April 2025.
849,210 professionals have used our research since 2012.
Database Administrator at a healthcare company with 10,001+ employees
It tests security to support SOX compliance
Pros and Cons
- "It supports our audit compliance."
- "It tests security to support SOX compliance."
- "I would like them to support cloud services."
- "Sometimes the performance is not good, and also sometimes we have sudden bugs causing difficulties."
What is our primary use case?
It tests security to support SOX compliance.
How has it helped my organization?
It supports our audit compliance. We use IBM Guardium to support security initiatives and compliance policies within our organization. We have a lot of self controls which require the database to be monitored, especially for the privileged user.
What is most valuable?
- Its band monitoring. We just started to use it.
- The mobility assessment
What needs improvement?
I would like them to support cloud services.
What do I think about the stability of the solution?
It is pretty good, though we have had some issues. Sometimes the performance is not good, and also sometimes we have sudden bugs causing difficulties. Therefore, it is hard for IBM to fix.
What do I think about the scalability of the solution?
Scalability is good.
How is customer service and technical support?
My experience with technical support depends. Sometimes, with Level 1, it is not good. However, when the case goes to Level 2, the support is pretty good.
How was the initial setup?
The initial setup was pretty straightforward.
What was our ROI?
Senior management is aware that Guardium has saved the organization time and money
Which other solutions did I evaluate?
We just talked to IBM. If we have a problem, maybe they can offer us something new, new features, etc.
What other advice do I have?
IBM Guardium is good.
Most important criteria when selecting a vendor: reliability.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Senior Manager at PT Permata Anugerah Abadi
Provides data protection and efficient technical support services
Pros and Cons
- "The platform provides data protection from internal and external threats."
- "There could be a feature to integrate and protect multiple databases. The local support services need improvements as well."
What is our primary use case?
We use the product to permanently protect data from unauthorized user access, malware, and external threats.
What is most valuable?
The platform provides data protection from internal and external threats. It has good features for reporting and integration with other products.
What needs improvement?
There could be a feature to integrate and protect multiple databases. The local support services need improvements as well.
For how long have I used the solution?
We have IBM Security Guardium Data Protection implementation since 2013.
What do I think about the stability of the solution?
The platform has good stability.
What do I think about the scalability of the solution?
We have almost 10,000 IBM Security Guardium Data Protection in our organization. I rate its scalability a nine out of ten.
How are customer service and support?
The technical support team responds quickly. However, there could be a local team to reach out instead of contacting the headquarters.
How was the initial setup?
The initial setup process is straightforward. It can be deployed on-premise and in the cloud. It takes an hour to complete deployment.
What about the implementation team?
We implement the process in-house.
What's my experience with pricing, setup cost, and licensing?
It is not an expensive product. We purchase its yearly license.
What other advice do I have?
I recommend IBM Security Guardium Data Protection and rate it a nine out of ten.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
CyberSecurity Leader Specialist at KLNCIT
It lets you centrally manage aggregators and collectors
Pros and Cons
- "Guardium lets you centrally manage aggregators and collectors."
- "The documentation could be better."
What is our primary use case?
We use Guardium for large and medium-sized clients in the banking sector for things like monitoring, protecting sensitive data, and logins.
What is most valuable?
Guardium lets you centrally manage aggregators and collectors.
What needs improvement?
The documentation could be better.
For how long have I used the solution?
I have used Guardium for two or three years.
What do I think about the stability of the solution?
Guardium is stable.
What do I think about the scalability of the solution?
Guardium is scalable.
How are customer service and support?
IBM support is perfect.
How was the initial setup?
The initial setup isn't complex, and it takes about four or five days depending on your environment.
What's my experience with pricing, setup cost, and licensing?
We pay for a yearly license, and the price is reasonable.
What other advice do I have?
I rate IBM Guardium Data Protection 10 out of 10. Anyone can understand this product.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Senior Middleware Engineer at a tech company with 501-1,000 employees
We used it to harden databases by defining policies for alerting and blocking access to prohibited and restricted data.
Pros and Cons
- "Database logging and audit functions are the most valuable features."
- "I would like to be able to upgrade appliances within major versions without needing to rebuild the appliance."
What is most valuable?
Database logging and audit functions are the most valuable features. In some fields like banking, it's very important to be aware of the actions of database users, and ensure that those without the permission to access information do not access it.
How has it helped my organization?
We succeeded at hardening our customer databases by defining policies for alerting and blocking access to prohibited and restricted data.
What needs improvement?
I would like to be able to upgrade appliances within major versions without needing to rebuild the appliance. Once, I tried to upgrade a Guardium Appliance from v9.5 to v10 and there was no available patch for that. Therefore, the solution was to back up the appliance data, rebuild the appliance with the v10 image and then restore the data. This procedure is highly risky, because you can lose all the data if the restoration does not succeed. Installing a patch is much easier and there is no data loss risk!
For how long have I used the solution?
I have used it for 2 years.
What do I think about the stability of the solution?
I have not encountered any stability issues.
What do I think about the scalability of the solution?
I have not encountered any scalability issues.
How are customer service and technical support?
Technical support is unsatisfactory. IBM Support failed to provide me with the v9-v10 upgrade patch as it is suggested on a upgrade roadmap technote.
Which solution did I use previously and why did I switch?
Back when I was a developer, I developed an audit trail module in Java/JEE. Obviously, it was not as sophisticated as Guardium.
How was the initial setup?
Initial setup was straightforward.
Which other solutions did I evaluate?
Before choosing this product, I did not evaluate other options. We implement exclusively IBM products.
What other advice do I have?
At first, IBM Guardium may seem complicated, but once you learn the basics, it becomes simple to use.
Disclosure: My company has a business relationship with this vendor other than being a customer: We're IBM business partners.
VP - Enterprise Security & Cloud Business at a tech vendor with 1,001-5,000 employees
Textured and reliable with secure data privacy provisions
Pros and Cons
- "Ease of deployment is a valuable feature."
- "Flexibility could be improved."
What is our primary use case?
We deal with a range of customers and lately the issue of data privacy and user identity has become very important and many companies are now seriously evaluating tools like Guardium. Companies want to know who is accessing database applications and what they are doing. This product is geared towards medium and large size enterprise companies. We're partners of IBM and I'm a company Vice President.
What is most valuable?
The ease of deployment is a key feature of this solution.
What needs improvement?
With these solutions, flexibility is always an issue and that applies to Oracle and other similar products. Integreon, which is much smaller in size, is likely to be more flexible than IBM.
There is a big concern here in India about deploying on cloud so the one thing I would like to see in the next release is a fast option from IBM that is hosted from their India cloud data center.
For how long have I used the solution?
I've been using this solution for a few months.
What do I think about the stability of the solution?
I think this is a stable solution.
What do I think about the scalability of the solution?
It's easy to scale this solution.
How are customer service and technical support?
Technical support is good.
How was the initial setup?
The initial setup is a little complex and requires some effort. It generally involves some customization and configuring and will require good online support. If you have a fair idea of the customer environment I don't think it takes a long time. There is very little, if any, maintenance required if the solution has been configured properly.
What other advice do I have?
This is one of the core applications for customers and is not something like an endpoint security or perimeter security. It's a specialized use case. This is a textured product and the brand equity of IBM means it's reliable. I have long-term relationships with my clients and wouldn't like to deploy something that gives me problems. This is a good product.
I would rate this solution an eight out of 10.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Trusted Security Advisor at a tech services company with 501-1,000 employees
Proven record of preventing unauthorized access and modifications to our customer's data
Pros and Cons
- "It allows us to put in controls to make sure that only the right persons access the proper records in the database."
- "The biggest complaint that I hear from customers and users is that using this solution requires database skills, yet it is a security and monitoring tool."
What is our primary use case?
This solution is for database security and protecting the core of the data. It allows us to put in controls to make sure that only the right persons access the proper records in the database. It prevents unauthorized access.
For example, a customer may want to restrict the database so that it is accessible only from within a specific application. This means that the database administrator will not be able to access the data from outside of the application, as is normally allowed by their administrative rights. It can prevent the administrator from seeing or modifying any data for which they are not allowed to do so.
It is also possible to set specific permissions, such as restrictions on the field, table, or record level of the database. Only people with explicit permissions can view or modify the data.
How has it helped my organization?
One of our clients is a passport authority, and they were able to successfully apply this solution to detect corruption within their organization. There had been some employees who had been illegally changing the status of some residents in return for money. Once this solution was deployed, they detected that somebody was making those changes in the database, caught the people, and stopped it from happening again. It was a big finding.
What is most valuable?
This solution has a lot of functionality and there are hundreds of use cases for it. We are talking about the database, which is the main business core for the company that holds all of the data. The features used by any one customer are dependent on their requirements and the relevant regulations.
That said, IBM Guardium has a lot of capabilities, even compared to other solutions on the market. It can do everything from detection to prevention, and it provides reports about this as well.
What needs improvement?
The biggest complaint that I hear from customers and users is that using this solution requires database skills, yet it is a security and monitoring tool. Specifically, it is a tool that is used for monitoring the database administrator. The database expert will not want you to implement control on top of him, so you instead need to utilize a person from security. However, security people do not have a complete set of database skills. So, there is always a gap in the administration and the person who is going to manage this tool. As such, the person using this tool feels that it is complicated, doesn't know where to go and what to do.
I have heard that the latest version has better support, with better access, and a better GUI that is easier to use than before. At the same time, this is still one of the main concerns that I always hear from the customers.
The second most common complaint that I hear is in regards to the support from IBM. Some of the cases are open for a very long time because they do not have local engineers to come and look at the issues. In our region, my company is providing 24/7 support to help close these gaps. This has strengthened our presence in the market, but in other regions, this is still a complaint that customers have.
For how long have I used the solution?
More than six years.
What do I think about the stability of the solution?
The feedback that I have heard from customers, and my team, is that the solution is very stable. It does not require a lot of things after it is set up for the first time. Once it is fine-tuned, you do not need to do much other than generate and show reports.
At the same time, I do still hear complaints directly from customers about stability. Specifically, it has to do with making changes. If there is an S-TAP agent installed on the service then sometimes the configuration needs to be changed. This might be by adding a new rule or policy. After this, the server needs to be restarted. It is impossible to frequently stop and restart a service when it is in production.
My team justifies this by saying that it only happens infrequently, at a rate of perhaps once a year. However, the customers still see it as a very difficult task that makes their lives tough. Other than this, I have not heard any complaints about stability.
What do I think about the scalability of the solution?
This is a highly scalable solution, but it requires a lot of resources.
For example, I know of a big bank that has been a long-time user of this solution, but they were looking to replace it because they need forty-four Guardium severs in order to monitor their entire database farm. They feel that this is too much and will cost a lot. They do not have a new solution at the moment, although they are looking at other options.
Before this solution existed, people did not have really have anything in place. It was a new concept and it became critical when people came to understand database risks. In 2011 or 2012, many banks started to use Guardium, and since then, it has been spreading to other sectors such as government, transportation, and healthcare.
How are customer service and technical support?
The complaints that we have heard are about IBM support in general and are not specific to the Guardium solution. There are gaps because they do not offer local support in every region.
Which solution did I use previously and why did I switch?
I cannot recall an instance where a customer switched to this solution from another one that they already had in place.
We have been assisting people with migrating from earlier versions to the current version.
How was the initial setup?
The installation of the database, itself, is very easy and straightforward.
The initial setup involves configuring the database connection with Guardium so that it monitors it correctly. It also depends whether you want to deploy the protection method or not, which means that you need to deploy the S-TAP agent on the service where the database resides.
Beyond that, most of the configuration is in the policy, itself. This changes based on what you would like to monitor, what you want to prevent, and what kind of queries you want to block. For me, fine-tuning the policy is one of the most important elements of the implementation. It also depends on the customer's knowledge, and whether the customer knows exactly what he needs. Some customers want you to not only deploy the system but also to create the policy. You have to translate their internal policy into a configuration, which can really take a long time.
When you deploy using the basic implementation, it is usually only a week or two before you get complaints from the customer. They don't see the value in the solution because they are overwhelmed. So, fine-tuning the policy takes time, and it should be taken very seriously and with care.
If the customer knows exactly what he needs then the deployment can be done in two weeks.
In terms of maintenance, it does not require a staff member full time. One person can dedicate perhaps three hours a day for monitoring, reporting, and doing a health check of the system. We sometimes offer visits to customer sites daily or weekly. For example, we can assist the customer for two hours per week to monitor the system and ensure that everything is working properly. It really doesn't require much work.
What about the implementation team?
Because we are a distributor, we work between the partner and the vendor. When it comes to implementation, we can either assist the partner or work with the customer directly, based on what the customer wants.
Our Guardian expert is dedicated to that product, and will either visit the customer to perform the implementation himself, or he will align with a partner and they will go together. Most of the implementations are handled by ourselves.
What was our ROI?
I have not specifically calculated the ROI for any of our customers. However, I have shown them general ROI. For example, one incident of losing one record, either by mistake or intentionally by one of the admins, will cost you a certain amount. Moreover, it is important to consider how much you will pay to not have this happen again. These types of losses in the database may be critical data and can affect the company's reputation.
In general, deploying this solution will cost very little compared to the cost of losing data.
What's my experience with pricing, setup cost, and licensing?
In the past, the pricing of IBM Guardium was very complex. It was dependent on the number of CPUs and other things to support the servers. Nowadays, things have changed. Pricing is dependent on the number of databases and the number of servers.
The licensing fees are paid yearly. One of the deployments that I know of had three databases, and the yearly fees are approximately $50,000 USD.
There are some additional add-ons that are available, but I do not see many people taking them. There is encryption, and there is a Guardium Inspection license, but I am not sure of the costs.
Which other solutions did I evaluate?
The main competitor in the market is Imperva. They were originally not allowed in the Kingdom because of their country of origin, but they now have a local Saudi team. Some customers were approached by Imperva and did not know of Guardium, and simply went with that solution.
There is also a phenomenon in the market that is quite common when a new technology comes from the outside. Even if people don't have the full picture or details about the existing one, they feel that it is "old". Everybody has it, and they need something new. Because of this, we see a lot of people making the choice to go with Imperva.
What other advice do I have?
When it comes to implementing this solution, it is important for people to know exactly what they need to do. This includes what they need to monitor, what they need to protect, and what kinds of queries they want to prevent. They shouldn't rely on having this tool teach them what they need to do.
Next, people need to make sure that they are getting proper support. This can be from the vendor, by having an advanced SLA for example, or a strong local partner to help them. If they have any trouble, especially something urgent, then they want to have this support in place.
The third thing is to have somebody who is trained to take care of the system. Assuming that it is easy and that anybody can handle it will be the start of a larger problem. It will not seem too much at the beginning, but after a year they will be unhappy with the product.
It is important to recognize that there are several milestones for any Guardium project. Our consultant, for example, is an expert in that domain. He usually submits a project plan showing the implementation stages for the project. There are prerequisites that have to be put in place and verified, then Guardium deployed on the server. This can be either a physical or virtual server. Then the database configuration begins, which is followed by the fine-tuning phase. Finally, all of the appropriate documentation for these aspects has to be compiled. The length of time required for all of this depends on the requirements.
I would rate this solution an eight out of ten.
Disclosure: I am a real user, and this review is based on my own experience and opinions.

Buyer's Guide
Download our free IBM Security Guardium Data Protection Report and get advice and tips from experienced pros
sharing their opinions.
Updated: April 2025
Product Categories
Database SecurityPopular Comparisons
Imperva SecureSphere Database Security
Oracle Audit Vault
Protegrity’s Data Protection Platform
DataSunrise Database Security
Trustwave DbProtect
Oracle Database Vault
IDERA SQL Compliance Manager
Buyer's Guide
Download our free IBM Security Guardium Data Protection Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- IBM Guardium vs Imperva SecureSphere Database Security
- IBM Guardium Data Protection vs. Vormetric Application Crypto Suite for a tech services company
- How does IBM Guardium Data Protection compare with Imperva SecureSphere Database Security?
- What are the differences between IBM Guardium and Imperva?
- When evaluating Database Security, what aspect do you think is the most important to look for?
- IBM Guardium vs Imperva SecureSphere Database Security
- What is the difference between "data protection in transit" vs "data protection at rest"?
- Audit Vault vs. InfoSphere Guardium?
- Database security tools comparison report?
- Why is Database Security important for companies?