Morphisec Reviews

We use version 4. It's not the absolute leading edge, but it was the first version that they supported with Linux.

We use both environments to protect our corporate Windows assets and we also use them to protect our production Linux servers. We're using an on-prem option where we installed the Morphisec server on one of our own pieces.

Our primary use case of Morphisec is to prevent in-memory attacks that would be conducted from ransomware. It's used for frontline and back-end protection. We have it installed on our front-facing web servers and on the backend database servers as well.

Morphisec has given me a lot more visibility into if my employees are actually encountering ransomware. Luckily, to date, we have not actually had any positives come through. We have had false positives, but at least it has given me the peace of mind that upon the investigation that we have not been exploited or have had ransomware, for that matter.

In the future, it'll help me with ensuring that viruses are not inundating our machines as well. Right now I have to go through a separate interface for that.

Morphisec makes use of deterministic attack prevention that doesn't require the investigation of security alerts. Anything that's suspected gets blocked immediately on the machine, which is nice. It allowed us to go back and see what was going on in that situation. And if it was in fact a false positive, then either we figure out a different way to execute whatever the person was trying to do or we can whitelist the event.

Morphisec does not save us at this point from paying for a higher-tier license to get visibility into Defender AV alerts. I'm sure once we get upgraded, absolutely it will, from what I've seen.

It reduced the amount of time we spend investigating false positives. In the past, we haven't had any legitimate ransomware attacks, all we have had is a false positives pop-up. But knowing that ransomware, once it's on a machine, pretty much tanks it, I'd say it saves me hours upon hours of having to recover individual machines, and of course, it could become exponential requirements if there was more than one machine affected. At the very least when it could be one server, it would definitely save me hours of labor up the scale if I had 80 machines that I had to fix. But, that would be a serious time issue. The protection itself saves me potentially an exponential number of hours trying to recover the organization.

Morphisec reduced our team's workload. Instead of having to go to multiple UIs, or instead of having to do manual investigations, I should say rather. It's at least put stuff to the forefront. More so, after we do the upgrade. 

Morphisec has absolutely helped save money on our security stack. The ransomware at the end of the day can cost organizations millions upon millions of dollars. Investing in tools like Morphisec is a great reduction in that cost. If I can spend $10,000 in a year to protect assets that could be ransomed for $20,000,000, that's definitely a bet that one should pursue. Morphisec absolutely it's worth the investment.

It gives us 99% peace of mind in terms of knowing our systems are not being ransomwared. Once we get the upgrade, I'm sure it'll give me much more peace of mind in terms of the antivirus functionalities, knowing that there are no viruses on our machines, as well. But, for now, the only thing I can definitively say is that it gives me confidence that in terms of ransomware attacks, we are not going to be susceptible.

The in-memory attack features have been the most valuable. As we transition to a newer version, I'm excited to see the antivirus reporting functionality search come into effect. We are planning on updating and renewing our contract with them.

My company offers online and mobile banking services. Much like your own bank or credit union, the company has apps and a web interface and provides that to various credit unions and banks. As such, we have direct connections into the various financial institutions' banking courses. We see our environment as a prime area, or vector of attack against this course. We've installed Morphisec over two different production data centers, and it's hooked into our workstations. 

Morphisec's new version provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard. The version that we're on right now does not. That's one of the things I'm excited about getting in the upgrade.

This is extremely important to my work. My team is very small. We have four guys across two data centers. Our data centers are through Rackspace, but we are the primary people that interface it. We have a team of four people that own those two data centers and make sure services are functional. We have a small team and having as much information in one basic user interface is critical.

The ease of use is great. It's a basic UI. It clearly tells us how many of our agents are checked in and how many are not. It gives us a very simple UI to be able to see attacks over time-series data, and to be able to drill down very quickly to see which assets or computers are affected. We can see what user was on there and what application was at play. So, in terms of being able to drill down really quickly, they're great.

It would be useful for them if they had some kind of network discovery. That kind of functionality I think would give IT administrators a little bit more confidence that they have 100 percent coverage, and it gives them something to audit against. Network discovery would be one area I would definitely suggest that they put some effort into.

I have been using Morphisec for around a year and a half. 

So far it's been extremely stable. Their UI has never crashed once. The agents do check in regularly. Overall, I have not had a single issue with them which is the way it should be.

We have the Ansible playbook for doing the automated install on Linux. At this point, we tell it what server to install to and it does it. In terms of scalability, it's really easy. It's pretty straightforward.

There are four users using this solution including the director of DevOps, the director of Software Engineering, and we have a DevOps Engineer and a Corporate IT Engineer.

The DevOps side folks and the software engineering guy are focused mainly on what our production systems are saying through the UI here, while the corporate IT guy is focusing much more on the Windows workstations. That said, if we do notice an attack, all four of us come together to analyze what we're seeing there.

We don't require any staff for deployment and maintenance.

At this point, we have to do the installations of any updates to the Morphisec server, or the Morphisec clients. But for that one person is enough to handle that. It's either me or the IT administrator, but it's really not that painful. 

The Windows corporate machine is the weakest spot because we don't have automation configuration managers for the Windows side. But, on the Linux side, as far as running updates, it's very straightforward. A couple of commands and run through the Samson playbook and off it all goes.

We do have plans to increase usage. So, as we transitioned to AWS, we're planning on having them with us right off the bat. 

It's critical to our security portfolio. 

We contacted technical support a couple of times towards the start, and just had to do with installation. When we first started working with them, it was using a release candidate of their latest stuff. So, it was just a couple of back and forth exchanges, but they were very attentive and forthcoming.

The setup was straightforward. With our Linux environment, our production Linux environments, we were able to deploy using Ansible playbooks to automate, and then on the windows side, they have a number of options available to us. However, because we don't have, on the corporate side, any kind of configuration management tool or whatever, I did have to have my IT admins go in and run a PowerShell script that made the appropriate calls for set up scripts so that they're set up. In terms of our own windows deployment, it was more of a manual process. But, I can tell you from experience with larger organizations and all as well, that the packages that were provided to us could have easily been loaded into a configuration management tool and pushed out much more automatedly.

Once we had things going, I mean, we had everything installed I think, in a total of 10 minutes. That's running these installations concurrently of course, or in parallel. And on the windows side, I'd say over the course of a week, we are able to manually go into all of our workstations and get this installed. Being the COVID environment that it is right now, a lot of our employees are working remotely. A lot of that overhead in that week was simply negotiating when we can actually have the employee make their machine available, remotely.

Our first and foremost deployment was on our Linux front-end servers. We're thinking, get our production environment for a layer of protection right off the bat. So, we protected our web front end as most attackers would be coming through the front door, essentially, aka those web boxes. So, we figured that if we deployed there first that we'd get a nice level of protection.

From there, we did the installations of the windows front end or the endpoints of the window on the corporate side, just to make sure that employees that would be interfacing our source code, or our production environments, would have protection in place, not only to protect their own assets but to also protect the rest of the network that they'd be interfacing with. From there, we went back and upgraded or installed the backend Morphisec agents.

We did our own deployment.

If there was a valid attack one could easily say that they could have tried to ransom us 20 million dollars.

We pay per year, and per endpoint. So, if it's a Windows server, it has its own skew. Versus, a Linux server has its own skew. Pricing is a little bit different between those.

To cover 100 Windows endpoints we're at $5,699. It all comes with the annual maintenance and support crew.

We had looked at a couple of options, but none of them actually seemed to be really what we were looking for because Morphisec handles everything in-memory as things are going. Whereas it seems like a lot of those other tools out there, like Kaspersky and the like seem to be more reactive.

My advice would be to really consider the reality. It's not a question of if you're going to get attacked by ransomware, it's a question of when. And while this seems like something that would be easy to kick down the road, in terms of evaluating the overall battlefield if you will, a ransomware attack will take down your organization. There's no doubt about it.

I would advise you to realize that with that inevitability and how much of your environment it can takedown or render useless. This would probably be one of the higher, first choices, and first endeavors you should make as you go into your source of security portfolio.

The biggest takeaway from this that I've had is, never underestimate would-be attackers. You have something on the internet, they're going to go for it. The other lesson I've learned is that sometimes users of computers do weird things, or do things differently than others would normally. That leaves the door open for would-be attackers of having tools like this in place. It will help you avoid headaches down the road.

I would rate Morphisec a nine out of ten.

We use Morphisec in conjunction with our other endpoint tools to be a type of fail-safe. If something can get through Trend Micro or CrowdStrike, Morphisec is the secret weapon, because if it sees anything it will stop it. We have a defense-in-depth model, and Morphisec caps it off for us.

The solution is hosted by the vendor.

Often, it's very hard to get the vendors of the biomedical devices we use to allow us to install security software on their devices for monitoring. Morphisec is the first one that we've gotten the vendors to potentially buy-in on. They're taking a look at it to see what it does and allow us to start distributing it across some biomedical PCs. That's a big deal for us.

Another benefit is that, while Morphisec hasn't necessarily reduced the number of false positives we get, it makes it easy to determine whether something is real or false. We don't have to spend a lot of time trying to figure that out. We get a lot more false positives from CrowdStrike. When it comes to investigating something like that with Morphisec, we don't have a lot of occurrences. We may have gotten three false positives from it in the last year, and that was when an application got upgraded and changed.

The simplicity of the solution, how easy it is to deploy and how small it is when deployed as an agent on a device, is probably the biggest aspect, given what it can do.

It's a set-and-forget, unless somebody says something or we get an alert. It is not something you have to manage every day, that's for sure.

The only area that really needs improvement is the reporting functionality. Gathering the detailed information that is in the system for an executive, or for me as a director, could be better. Some of the interface and reporting aspects are a little bit dated. They're working on it.

We have been using Morphisec Breach Prevention Platform for just about four years.

I've never had a problem with its stability.

In terms of scalability, it's easy to push out. It will go on pretty much any Windows device, which is great. We have it on every endpoint our organization owns. That includes servers and workstations. The only thing it probably does not touch is anything that is biomedical. We've adopted it 100 percent. Obviously, we'll add licenses as we add devices.

We are also looking at some of Morphisec's other product lines that they have recently come out with.

I would rate their technical support very highly. If we need technical support, which we haven't needed much, they're quick to respond.

Aside from that, I would say that working with Morphisec, from the business development and partnership points of view, has been tremendous. They're always willing to listen to new ideas. And they come to us and say, "Hey, we have these things that are going on. Are you interested in looking at it and giving your opinion on it?" They're very in tune with customers and communicate well, which is rare.

Positive

We did not have a solution to do what Morphisec specifically does. We don't use Microsoft Defender. I know Morphisec has the capability to pull all that together, but we are not a Defender customer. Currently, we use CrowdStrike.

With our testing process and our change process, it took us about a month to deploy the solution. It was very short compared to what our processes normally take.

We deployed it to the IT department, and then to another group as a testbed. After dealing with any small issues, and by that I mean there were a couple of applications we had to whitelist, we started deploying it across our fleet to all 6,000 devices.

It's simple to push it out through SCCM because it's a very small, lightweight application that does not affect the users in any way. It does not slow down their machines or have dependencies that need to be installed, and it runs on pretty much everything.

The financial savings are unknown, but the risks that Morphisec offsets, and the dollar amounts tied to those risks, are tremendous. We're potentially saving millions of dollars from a breach because we have Morphisec in place.

The pricing is definitely fair for what it does.

Before we got Morphisec we evaluated solutions that claim to do similar things, and we have done additional evaluations since we started using it, but I don't think anything can truly touch what Morphisec does and the way it does it.

A lot of the solutions out there are basic antivirus tools and they add on EDR capabilities. They're usually trying to compare EDR to Morphisec. A lot of the competition says they're similar, but they're rooted in old ways of doing things. Morphisec is just a different process.

My advice is to get to know the individuals at Morphisec. Lay out your infrastructure and where you need to put it and let them help you do that. Also, be open to new ways of tackling security problems.

We are using it for endpoint and Windows Server protection. We have other tools as well, but we took this service as a second line of defense.

It's a cloud-based service.

If you take, for example, threats from email phishing campaigns, other vendors do not alert on them, but Morphisec shows the alerts for any phishing activities. If any user has clicked a phishing link, Morphisec takes the necessary action. It does not allow that.

We use a defense-in-depth strategy to harden our attack surface and Morphisec is our second defense line at the endpoint protection level, for all servers, including Linux. It evaluates scripts or any utilities that are not genuine, and running on a Linux server, and it blocks them. Our Linux platform is also becoming secure now. Morphisec is quite an important tool for us in terms of security and InfoSec because of the malware protection. It is quite a good security platform in comparison with its competitors.

It also helps close the security gap of device memory at run time. Closing this security gap means when we can trust this solution. It gives us the required output. This is the kind of technology that is required more by financial organizations like ours.

Another benefit is that Morphisec has reduced the amount of time we spend investigating false positives. On a daily basis, our SOC analysts review all the tickets that have been raised by the solution. If there is a false positive, we need to check the scanning limits that have been set and why it is creating that alert. If it is a false positive, we point it out to the Morphisec team as well.

Morphisec has also reduced our team's workload, without question, because the solution is quite simple to use. And if there are any alerts on the dashboard, you get all the information and can easily address or investigate them. Everything is displayed on the Morphisec console and that is the best part of the tool. It has also saved us money on our security stack.

Their scanning analysis engines are quite good compared to other solutions. It scans for malware attacks and enables blocking. It immediately takes action by itself, from the Morphisec console.

All the alerts are on the dashboard, which is quite simple and useful for us. You can easily check all the alerts that are being blocked or allowed, or whatever the action is. You can easily see that and you can take the necessary actions. You can add a PowerShell extension or any activities for blocking at your network level or for endpoints. You can easily do the configuration.

We also use the Moving Target Defense feature. If you are using another endpoint protection and Morphisec is compatible with it, you will also have this second line of defense. If there is a Zero-day attack that is not blocked by your endpoint protection tool, it will be blocked by Morphisec. That is quite an important feature.

Sometimes it generates false positive alerts. They need to continue working on that. They have provided solutions for it and have fixed issues with updated versions. The service is quite good but they need to work on it more so that there are no false positive alerts.

We have been using Morphisec Breach Prevention Platform for more than two years.

The stability is quite good. The agent does not consume much memory or processing, so it's quite a stable product. Until now, we haven't faced any issues with this product.

The tool is scalable too in terms of the cyber security attacks that are happening globally. In the pandemic situation, these attacks are more inclusive, but Morphisec is scalable in terms of cyber security and second-level defense.

We have deployed it to between 700 and 800 endpoints and we have a large SOC team with seven to eight members who are closely monitoring everything.

We have contacted their technical support many times. We get prompt support from their team. Their support is on time for any query and we get support for investigations. We even get proactive emails from Morphisec for any version upgrade or new features.

Positive

We didn't have a solution prior to Morphisec, other than endpoint protection.

We did a PoC for almost a month, but deployment is very easy. You just deploy the agent and it gets started. We took our time, doing different PoC use cases and then we finalized the product. We used a patch management tool to automatically deploy it to all our systems.

Compared to their competitors, the price of Morphisec is not that high. You can easily deploy it on a large-scale or small-scale network.

So far, we haven't been subject to attacks or incidents. But from what I have seen globally, Morphisec has prevented many attacks. I have registered for Morphisec's articles and they have articles on what they're blocking currently. 

It is a useful tool as an InfoSec and cyber security platform for all IT members, giving them more in-depth knowledge about every alert, including the exact process that generated the alert.

We've been using Morphisec as a layered defense in our security plan. We have beefy firewalls and another antivirus; Morphisec isn't technically an antivirus. It's a protection agent. It's one of the layers of our security plan. We use it to defend ourselves from any sort of CryptoLocker attacks or ransomware drive-bys, and it should catch auto-executes that come from ads. We haven't been breached, as far as I'm aware.

We started with it on-prem and we had no complaints. It made sense. A cost analysis was done and on-premises cost less than the cloud, which is how things normally are. We used our own network so the cost was cut because they didn't have to use any of the load on their servers or network. It was all on us. But about a year ago they approached us and we were torn away from the on-premises solution. They made such a compelling cost-savings case for us to go to the cloud that it made sense to go to the cloud. We also got another service from them along with the protector, some sort of BI.

We're using it on all of our endpoints, servers and desktops that users touch. For servers that don't get touched by users, we don't have Morphisec on them because we just don't need it.

I wouldn't be doing Morphisec any favors saying, "Well I can't tell if it's working because the rest of our security posture seems to be taking care of anything else that gets through." Maybe it's not working at all. I can't tell. It would be useful to set up a virtual machine—and this is something I should bring up with our Morphisec person—and get some triggers that are actually on our dashboard so we can prove to management that Morphisec is doing what they said it was going to do. Worst case scenario, we have an infected virtual machine that I just blow away. The short answer is that we haven't seen it protect us from something yet. 

It hasn't taken anything off my plate. It's just a "gun under my pillow at night". It's something that we can tell our cyber-insurance people, "We have this, and this was used." In "Pretend-Land," where we got compromised, we can say, "We have all these layers of security and it managed to get through all of them, so we did our due diligence. Now please pay us for our losses."

What's valuable is really the whole kit and caboodle of the Morphisec agent. What it does is genius, in a way, until the bad guys get wise to it. You set it up and then you watch the dashboard. There isn't really much tinkering. As long as you did the install correctly, it should be pointing at your server and it will tell you a bunch of information on each client.

We have only had four attacks in the last year, "attacks" being some benign PDF from a vendor that, for some reason, were triggered. There were no actual attacks. They were just four false positives, or something lowly like adware. There have been false positives with both the on-premises solution and the cloud solution.

I'd rather see false positives than not seeing anything. If I see nothing then I literally cannot tell if it's working or not. But there are some false positives that are ambiguous enough to be caught.

We have been using Morphisec for about two years.

I don't look at the dashboard every day, but the on-premises solution was flawless. If the network was down between the clients and the server in our local area, we would be in trouble. But Morphisec's AWS implementation has been stable as a rock.

I believe it's scalable. I don't know what the upper limit is. Our company is a medium-sized business, with about 100 end-users and 500 employees in total. Morphisec easily holds those 100 users.

All the end-users are using the solution, meaning the solution is attempting to protect them from the silly mistakes that they make. But there are only two of us who actually look at the dashboard.

The business is growing so we do increase the number of clients. Whenever we add a new computer, we add Morphisec to it. Once we get to version 5, we'll revisit the ATP integration.

We didn't have a solution before Morphisec for this specific layer of defense, for the CryptoLocker/ransomware niche. We had an antivirus.

The demos worked great. They would open a bad file on a virtual machine and we watched the CryptoLocker being stopped in real time. It's hard to compare with that.

The initial setup was definitely straightforward. It has to go on every computer. There's a different installer for desktops versus servers. You just choose which one is which. We use PDQ Deploy, and a script that the onboarding technician helped us with, and it worked. It ran perfectly. We even have scripts for uninstalling it and installing the newer version, and Morphisec assisted us with that. It was definitely easy to do.

Before I saw the version 5 update and the notes on that, about how it's going to update automatically, I'd say the implementation was a slight pain. It wasn't a huge pain but you can't really get away from how you have to install this on all your computers. However, they actually made that process very easy, and I can do it with just a couple clicks to almost an entire organization, as long as computers are online.

Over the course of a day, it took about two hours to get the script going and select all the computers for each kind of installer. I kept running it over the course of the day because certain computers would be turned off or they were restarting. I had to do a good couple of runs of it, but it was very simple and quick.

Since there was nothing already doing what Morphisec does, on the computers, and Morphisec plays well with the current antivirus that we are using, we just installed on each computer remotely and it started working. We watched the dashboard fill right up in a matter of minutes.

We're not on the latest version but I'm actually excited for the latest version because it will do away with the manual updating process. The clients will start to update themselves. We will have to wait until one of our Morphisec representatives reaches out to us so that we can get the installer for the newest version. Version 5 is where it begins self-updating. Until now, I've had to manually update each time we wanted to do an update. The new one will mean I won't need to be worrying about updating or if the versions are out of date.

In terms of working with the solution, if Morphisec says, "Hey you're going over the number of licenses," we look to see how many are offline and we look at the versions. We look at it just to make sure that everything is going okay. We have alerts for when there's a threat. We get emailed saying, "Hey, look at this. There's a threat going on on XYZ computer."

I haven't seen ROI because I haven't seen a threat that it has protected against, exactly. If you're always wearing a bulletproof vest and you never get shot, was the vest worth it? I'd rather have it than not have it.

We looked across the rest of the security field and we spent more money on Morphisec than other solutions that do a similar thing, but the demos that we've seen were impressive enough to sway management. The technology behind it is clever enough for us to think it's cutting edge. It didn't save us money but we spent money on it because we thought it would be a good product.

The way that they explained how their solution works was more in-depth than other solutions that we were looking at. It looks cleaner. It has a good UI for the dashboard. It's not overbearing with security tabs and a lot of other stuff. It tells you, "Here's the list of all of your protectors. Here are all the threats. Here's the dashboard that gives you a little bit of everything," but not in an overwhelming way.

It sells itself, honestly. My advice to others looking into implementing Morphisec would be to use PDQ Deploy. The hardest part was getting all of the endpoints protected in a timely manner, but Morphisec assisted us with that. They suggested PDQ Deploy, which is a great tool. Implementation went so smoothly because of that.

Morphisec provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard, although we're not currently utilizing that feature. We're definitely interested in it. The reason we're not using it is because you have to purchase the upgraded version of Defender for Microsoft. We thought it was the regular Defender that each one comes with, but it's actually ATP, Advanced Threat Protection. That's what integrates with Morphisec. We're just waiting for the CFO to say, "All right, who wants a bigger budget?" and we'll say, "Yes, us, please: ATP." We would do it if we could bend our CFO's arm to get that kind of protection.

Our use case is for memory protection of our desktop and VDI computers beyond traditional antivirus capabilities.

We are on the most recent release.

We have seen it successfully block attacks that a traditional antivirus did not pick up.

Morphisec has reduced the amount of time that we spend investigating false positives by four to eight hours a month.

Memory morphing and the central console are the most valuable features. Most traditional antivirus solutions don't come with these features, so you need a tool, like Morphisec, to add this functionality.

It would be nice if they could integrate Morphisec with other traditional antivirus solutions beyond Microsoft Defender. That is probably my biggest gripe.

I have been using it for three and a half years.

It has been very stable. We haven't had any unintended consequences. Usually with security solutions, they introduce a lot of chaos and false positives in an environment, but that has not been the case in Morphisec. It has been uneventful, luckily.

We don't really have a lot of maintenance that goes on day to day. A lot of it is kind of set it and forget it. We have one admin who works on it, but they probably only touch it once a week unless they get an email alert that tells them to look at something.

Our environment isn't particularly large. We only have around 500 endpoints in our environment.

I would rate the customer/technical support as 10 out of 10. They are all very competent, motivated people who are very helpful.

We did previously use another solution before Morphisec. The company was acquired by VMware and discontinued.

We started it on a very small subset of computers. We tested on those for an extended period, then we pushed it out to the entire environment.

The deployment took 30 minutes at most.

The solution is very easy to deploy. They have excellent trained staff who can assist with a deployment as well as upgrades. They make it as easy as possible.

We haven't had any cybersecurity incidents on machines running Morphisec. We also haven't seen a large number of false positives on machines running Morphisec. I guess you could argue that there is a return on investment there because it has obviously decreased the amount of time that we spend looking at false positive events and remediating cybersecurity incidents. In general, it is always harder to build business cases on security tools.

Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. There is less overhead because it is more focused on the protect versus remediation, removing additional steps that you need to do associated with remediation.

Morphisec has reduced our team’s workload by four to eight hours a month.

It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off.

There aren't too many players in this market. It is very niche. Morphisec is in an interesting niche that a lot of companies might touch on, but not at the depth and breadth that Morphisec does.

We have looked at other vendors, but they don't necessarily overlap with Morphisec. 

While the solution provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard, we are not using that function right now.

The best thing would be to first understand the difference between traditional AV solutions and the Morphisec product. After that, it is just so easy to implement and install. I would recommend running an evaluation of it, because there is no reason not to.

I would rate Morphisec as eight out of 10.