Netwrix Endpoint Protector Reviews

We use it for detecting the traversal of data through endpoints. We keep a multi-tier isolated environment, so we have inner and outer cordons of access control. And over VPN, users could potentially be one of the exfil points, at least the privileged ones with access. Being able to identify when information enters the system and leaves, based on a number of complex criteria, because we work with medical information from all over the world, is the purpose of it in our organization.

The solution is all on-premises. We're a healthcare organization, and that's actually one of the reasons we use it. We can't have a lot of our security functionality in the cloud.

We operate a Waterfall scene mechanism. We trickle up data from a bunch of different endpoint and network solutions to a central event and processing correlation mechanism. We're able to detect when somebody accesses data internally and correlate that to a DLP event when a file lands on their system. It actually provides a data point within our global view. It's an ongoing operation.

We also use it to monitor all clipboard activity. When a detection occurs, we can generally identify it pretty quickly, but someone would have to be copying some pretty specific data to match the policies we've created. When it occurs, we know. Generally, it's also in the line of business. We have healthcare analysts here, and that's what they do all day.

There are effectively two areas of DLP to look at from a technical perspective. One is how it performs the pickup of information traversing the system and the other is how the policy engine, which analyzes the data, works. On the first aspect, CoSoSys is probably best of breed for macOS because they're reasonably well-integrated into the operating system. They're looking at the file system operations level, not at the execution level. Whereas things like Forcepoint are looking at the applications being run and they try to apply policy to that. The pickup paradigm is a lot better than their competitors.

The search for keywords, in our security operations, is critical and we use Endpoint Protector for that. We're a HITRUST-certified organization, and one of the things we need to do is be aware of the movement of personally identifiable health information. Since we work multi-nationally, we have to be able to identify PHI from across different countries and their different medical coding standards.

Another valuable feature is the  Content Aware Protection. We use the device thing to some degree, but it's the Content Aware Protection that's critical for us. That's the aspect of it which is DLP. The content protection engine is what detects the data when it's traversing, and the rest of it is other ways to lock down the system from being able to move data in and out. But the detection aspect of it, that's the really key part for us, because we have to be able to record that, even if it's completely legitimate.

It's quite easy to manage DLP in a hybrid environment because you have the centralized server that receives telemetry from all of the agents. And because that's what's forwarding the telemetry on to subsequent log ingests, you get a single data stream across all of the agents. We also have host intrusion detection, which is backing a lot of this stuff for us. We have full command execution logging in every machine. Every command that is run is recorded. We can cross-correlate very tightly between the DLP and what's being done on the machine itself. That way, we know execution and data movement.

We use the role-based access features, for the teams that administer it, to some degree, because we have an auditing agency that reviews our policy compliance. It's satisfactory. We don't have complex requirements for it. We've got a couple of internal admins with equal privileges and then we have an auditor role. It seems to work fine.

The policy engine could use a bit of work. They're definitely going in the right direction. We've been working with them over the last few weeks to try and optimize that. But it's reasonably clear that they're just not putting as much effort into the policy engine as into other things, like content discovery.

It's somewhat lacking in terms of the granularity of the policies that you can create. Because this is a Mac environment, you have slim pickings. You have really good detection mechanisms, like Code42, but a lot of those players don't operate at the medium business size. So, in terms of the market segment, CoSoSys is really the only player that will be able to still effectively pick up on it, so they're the only game in town on policy. They don't really have much competition in this segment.

I've been using CoSoSys Endpoint Protector for two years.

The stability has been quite good. They did have one shaky patch cycle in the last two years, but compared to the ginormous mess in this industry right now, they're definitely doing better than most.

The scalability works for our use case. It's actually quite resource-light for what it's doing. Being an OSSEC author, I'm writing a C application that does a lot of the same stuff for processing of live-streaming, textual telemetry. They did a lot of optimization work to make this efficient. It's an expensive operation, inherently. What they're doing is really CPU-costly. Most of the time they don't match on anything, and the worst thing that an expression engine can do is not find anything.

We are constantly growing. We're probably going to be growing by 30 or 40 percent again this year. We're going to have to bump up our license counts.

Our experience with their technical support has been better over the last year. Initially it was a little bit shaky, but they've definitely gotten better. There's always room to improve, but on a scale of one to 10, they're probably at a six or seven. They're doing better than the rest of the industry, like Cisco for example, which is a one out of 10.

We did not have a previous solution.

We just used a Zen appliance, so it was incredibly straightforward; it was effectively drop-in.

Configurations are ongoing. As we get new data in, we do continue to configure. And, obviously, with updates and new features and features being removed, changes are made all the time, but the initial deployment took about half a day.

Our implementation strategy was to understand our data first. We do a lot of in-house software development, so we understand regular expressions, pattern matching, and mechanisms like that; what's expensive and what's cheap. We defined what was identifiable in our data, figured out an identification strategy and policy mechanism first, and then went to implement it across the board. We knew that the number of endpoints we had was relatively small.

In terms of the staff employed in the deployment, we're probably not typical. We hire top-tier talent. Everybody here starts out well into the six-figure range. So it takes one of us to deploy this. We're not your average shop.

In terms of maintenance, there's the occasional update. There is almost no downtime. The hypervisor is more unstable than the VM itself.

We have about 100 people using Endpoint Protector across our organization. It's literally everybody in the organization, including me and the CTO and the CEO. We're all beholden to this. There are no exceptions.

You get ROI in the first year. Endpoint Protector is a facet of our visibility into the environment, but it's a daily-use facet. It's like the passenger-side mirror on your car; you use it all the time. You could probably live without it, but you use it all the time. It's a necessity and it's a useful one. It's one that I endorse within our company to relicense every year.

Pricing is quite reasonable. For smaller organizations, it lets them get into the product domain, whereas a lot of vendors won't even talk to them. Endpoint Protector is just about at that sweet spot of being serious enough that you have to budget for it, but at the same time, affordable enough that the value is well worth it.

I work across the industry. I've used just about every solution. In the Mac space, CoSoSys is probably the market leader, because of the level of detail that they've put into the platform is very significant. They really did bother to optimize it and to make it run efficiently. A lot of these tools are afterthoughts on Mac and, if they do run at all, they destroy the machine. When you have a bunch of engineers trying to code, they notice.

This solution is right up there with Forcepoint Data Loss Prevention and Digital Guardian, but Code42 Next-Gen DLP is probably the closest comparable thing. But that is not a data loss prevention tool, it's just an identification and tagging tool. But it has a very similar semantic of pickup and analysis. 

Endpoint Protector is in the same market space as Forcepoint, in terms of pricing, but it's an apples-to-oranges comparison. Forcepoint is pretty well-known for having a good policy engine, but their detection and pickup mechanism, especially on the Mac platform, is just not practical. I can walk around it in my sleep. Again, we hire highly-talented engineers who can do the same thing, so if one of them decided to go rogue on us, Forcepoint just wouldn't help.

In my private practice, I work with a lot of other firms, including some design firms that are Mac-based and, as they start to ramp up their security—because they're now becoming vectors of attack into their own customer bases—this product is definitely something that's on the radar.

The ability to lock down a wide variety of USB devices is a secondary thing for us, because we do central policy management through another solution, so we have devices locked down through other policy engine mechanisms. But it is very convenient how CoSoSys has implemented it. That ability is definitely on the list for us but not at the top because for us, for policy regulatory compliance, we have to be able to tell when the data is moving in and out. That's the big thing we look at.

In terms of Endpoint Protector's support for Windows, macOS, and Linux, in our case, Linux is a non-starter. We operate big-data clusters. DLP just doesn't work in that context. The information is broken out into multiple pieces and spread all over the environment and traverses between the nodes as part of computation. DLP can't work in that kind of technique. As far as the Windows mechanisms go, we currently don't have Windows workstations or any Windows assets. I'm a red-teamer by trade, one of the people who gets paid to break into places, and Windows has a shared authentication model, meaning that if I compromise one of your servers or workstations, I can basically move unfettered throughout your network. Our environment is a mix, a heterogeneous environment, so that attackers would have to adapt to every different point they want to compromise.

Overall, Endpoint Protector really provides what you expect from it. There are no huge surprises one way or another. If you do your research, it's exactly what they say in their advertisements. They are not promising things they can't deliver. It does its job well.

I was looking for a DLP solution and Endpoint Protector happened not only to help with that, but also with the USB management piece. As a credit union we have a lot of sensitive data, so we need to be able to see it at rest and block it, and not only on-premises, but off-premises as well. A lot of people work remotely now and this solution is really working for me because once the endpoint is on there, I'm still in control.

I've seen, through all my policies, how exit points get blocked. The eDiscovery is one of the important things in Endpoint Protector. That's been working a lot for me, especially with the remote users. The eDiscovery allows me to see data outside of the network.

I have policies right now with eDiscovery for social security number, credit card, member number, and I created a duplicate SSN. So it's finding anything where that agent is installed, anything from the computer. It's finding all that data and it's reported to me.

I don't have a single most valuable feature. Every feature is really working for me. One of the reasons I bought it was for the USB block, but that's not as much a use case anymore since I have a lot of people working remotely. It's the DLP part that is more important to me right now, to pinpoint the data that's getting moved.

The granularity enables me to not only see a file, but to read inside the file and pull out the data inside it. The granularity is really pretty good on that. It's very important. Let's say somebody just exported a file or emailed a file or uploaded a file on the internet. Seeing the inside of the file is really important to me. Whether it's encrypted or not, I still can see inside the file.

I'm the only admin on it, but the role-based access is fine. I have one user that I give access to so he can just see device control and that's it. That's all I need him to see. I was able to do that, so I'm pretty happy with the role-based access.

I use the solution's clipboard granularity feature to monitor copying and pasting to specific exit points, and it works great. People are trying to get the data any way they can, from the clipboard and things like that. I'm able to see it, report on it, and block it.

I've been using Endpoint Protector for going on two years now.

I'm pretty impressed with its stability.

I don't see any issues or limitations with scalability. As long as you have the license, everything should be fine.

I'm managing about 300 devices right now.

One of the areas where there is room for improvement is support. It takes time for them to respond. They need to respond on time. Instead of sending an email, I think it would be very helpful to say, "Let's set up a WebEx to see what's really going on," instead of the back and forth of email.

I didn't replace any solution with this one. I was looking for a USB management solution. I have competitors like ManageEngine, but when I happened to find Endpoint Protector, with the USB and the DLP side of it in one solution, it was good to have that in one platform. I was going to have to find another DLP solution to be able to manage all this.

The initial setup was straightforward for me. They have good documentation, so if you follow everything it should be fine.

My deployment took a month. The implementation strategy for the solution was to set it up, deploy it to a couple of test machines, and see how it was behaving. Once that was done, I deployed it to everybody.

It doesn't require any maintenance on my side, other than when the updates come available. I get them installed and that's it.

I deployed myself.

I have definitely seen return on the investment when it comes to satisfying my auditors. I can show them I'm looking at all these things. And I'm protecting the credit union at the same time. It's really all worth it.

I don't have any issue with the licensing and pricing. I would love for it to be cheaper, but at the same time I'm getting a lot from it.

Compared to a lot of the USB management systems out there, Endpoint Protector is the only one that comes with true USB management and the DLP side of it. I'm pretty impressed because I've used several solutions with DLP and USB management, and I've never seen granularity like this solution has.

I haven't seen any solution like Endpoint Protector. Everybody says, "USB management: We can control, we can block, etc." And you have other solutions that are DLP only. Having it all in one place is really helpful. Not only do I have the USB management side, but I can come back and say, "All right, what's in that USB? What sensitive data is in there?"

I'm in a Windows environment, but I see it does MacOS, Windows, open sources. It has all of that on the platform.

I'm not using the EasyLock USB Enforced Encryption app to automatically encrypt confidential data transferred to USB storage devices. I'm more monitoring it. But I have the option of force it to encrypt.

Overall, I've never seen a solution with this much granularity. I didn't expect that. I did the demo, but it was only when I actually put in my environment and saw things and said, "Oh, wow." The reporting and the analysis have provided a lot of lessons learned. I didn't think I could get that much information.

I use Endpoint Protector to protect our end server.

Endpoint Protector's best features are its protection and user-friendliness.

Endpoint Protector would be improved with more DLP templates.

I've been using Endpoint Protector for two to three months.

Endpoint Protector works perfectly.

Endpoint Protector is scalable.

The initial setup is easy with a private cloud.

Endpoint Protector has machine learning and AI, and it prevents 99% of ransomware. I would give Endpoint Protector a rating of nine out of ten.

We store graphics files on our computers and they are confidential, so we implemented this product to block all of the computers from being able to send the data outside of our organization.

We use it to block USB ports so that people cannot connect an external hard drive, flash drive, or anything else that people can use to take files off of the system. Essentially, it blocks data transfer.

We only have two policies. The first is to block everything and the second one allows for Wi-Fi and Bluetooth connections.

This product does give us multiple choices for blocking data exit points. Without giving specifics, I can say that I know we have better security because of it.

We have Mac and PC machines, and it is very easy to manage both types. There is no noticeable difference in features between Mac and Windows machines.

We use role-based access for administering this solution, but as we are a small company, it is only insofar as having an administrative role that can perform any of the functions when needed. Some people can unblock certain policies, but we have a single administrator that can do everything.

The most valuable feature is blocking data transfer.

The software is easy to use and the dashboard is intuitive.

I have been using Endpoint Protector since I joined the company five years ago. I believe that they were using it for one or two years prior to that.

Stability-wise, it is very good and very safe. It seems to work fine.

We have approximately 117 endpoints and for the time being, I don't think that we will be expanding. We already have all of our computers.

I have not used technical support often, but every time I have, it was perfect. They have good support and they have helped me very well.

Several years ago, we used ESET but we found that it only logged the files that were transferred via the ports. This was not what we wanted to do, so we canceled the license and implemented Endpoint Protector instead for blocking the ports.

When I last renewed the license it was for a two-year term, and they gave me the second year at half price. It was a very nice gesture. Normally, I renew my license annually and I was happy to get a discount for committing to two years. There are no costs in addition to the standard licensing fees.

It would be helpful if they offered discounted pricing for long-term contracts to serve customers who are interested in committing for periods of three years, five years, or longer. I have been with the same company for five years, it was installed when I arrived, and we are going to continue using it in the future. Perhaps after a company has completed their first year, they should propose longer contracts to them.

My advice for anybody who is considering this product is that if they want something to protect data on both Macs and PCs then this is a very good choice. I have never worked with a product that is this easy to use.

In summary, this is a good product and for now, I think that it has everything we need. It seems to be a perfect match for us.

I would rate this solution a ten out of ten.

The product's most valuable feature is its ability to support Linux operating systems.

CoSoSys Endpoint Protector's network-level DLP and integration with mail servers need improvement.

We have been using CoSoSys Endpoint Protector for five or six years.

We never encountered any bugs or issues. The product has been running for many years since we set it up with the server.

We have 10 CoSoSys Endpoint Protector users in our organization.

The technical support services are good.

CoSoSys Endpoint Protector can be deployed on the cloud and on-premises. It takes 15 minutes to set up the server and get it running. The process is easy.

The product is worth the investment.

The product has average pricing.

The product supports Linux systems and multiple source codes. I advise others to go for it. I rate it a nine out of ten.

It was the unique seventy-point I used for Linux devices. 

The console is friendly and it supports Mac.

They have many predefined classifiers in terms of data identifiers, and they should improve this. 

As per the market perspectives, the data is driven and the usage is totally modernized. Digitally, there are lots of inventions and the data usage depends on the cloud.

I have been using CoSoSys Endpoint Protector for six months. 

The solution is stable. 

The solution is scalable. 

The initial setup is easy. 

The pricing depends on the customers. 

I rate the overall solution a seven out of ten.

We use this product to protect our Mac and Windows 10 endpoints.

Our main purpose is to block the uploading of Excel and PowerPoint files. We also use it to block USB devices and other peripherals that users connect to the system. 

This product performs well and multiple things have been blocked by it.

By raising discovered issues with our team members, they are doing their part in terms of resolving them.

Endpoint Protector provides a single platform to support our Windows and Mac machines. We do not have any Linux machines in our environment. Managing DLP for our machines in this hybrid environment is pretty simple, as the product is user-friendly and we can easily find what we need.

The fact that this solution supports different operating systems is very important to us because we want to ensure that there is no data leakage.

We have one or two Macs in our organization, with the majority of people using Windows 10 machines. We haven't seen any difference in the support that this product offers for either operating system.

The Device Control feature and tools are very nice. It can also be used for containers. We have blocked multiple financial components using these features and rely on the upload and block policies. For example, we have blocked Google Drive uploads, as well as the upload functionality for other cloud spaces.

The interface is pretty user-friendly, neatly explained, and simple to use.

We are able to lock down a wide variety of USB devices, which is important to us because none of our users can connect a USB drive or other device to the machine. By preventing this, there won't be data leakage. We have experienced this in the past and we are now able to control it through the use of device policies. 

The technical support that they provide works well.

We use the RDP remote desktop option to prevent copy and paste operations to remote systems. If anyone tries to copy and paste between a remote system and a local system then they will not be able to do it. This works well and it makes our operations more secure.

We are currently facing an issue where it is blocking the Winman software, which is something that we don't want to happen because we use it in our accounts department to pay taxes.

There is no option or support available for DriveHQ. 

We have been using Endpoint Protector for between seven and eight years.

This product is pretty stable.

It is easy to scale. Across the organization, we have more than 900 users with Endpoint Protector deployed on their machines.

We plan to soon increase the number of licenses that we have. Our intention is to start deploying on our laptops, which will bring us to a total of approximately 1,500 licenses.

We have been in touch with technical support and our experience has been pretty nice.

This solution was easy to deploy but it was implemented before I joined the company so I don't know how long the process took.

No major upgrades have been required since I have been working with it.

We have an in-house person who is responsible for servers, and he deployed Endpoint Protector. The process is not complex and only one person is required.

We have three system engineers, three senior system engineers, and one assistant manager in charge of maintenance.

We looked at a DLP product by Forcepoint but our current solution was working pretty well, so we opted not to switch.

This is a product that has improved over time. For example, in the past, there was no option to view the ports that were not added to your list. This is now supported and some of the problems we were facing have been stopped. Another example is that we are now able to block Teams and it works pretty well, whereas, in the past, we could not block uploads or downloads with Teams.

Endpoint Protector has other features that we do not use, such as encryption. Instead, we deployed Sophos Encryption approximately six months ago for this purpose.

The biggest lesson that I have learned from using this product is how to block uploads and downloads, as well as how to lock devices on users' machines. My advice for anybody who is considering it is that it is pretty simple to use. It's a friendly environment and it's easy to block devices, uploads, and other security issues.

In summary, we have not faced many issues with Endpoint Protector and it is fulfilling our requirements, as we wanted.

I would rate this solution a nine out of ten.

I use the Endpoint Protector to monitor what the users or employees are doing. I monitor employee data like what they are sending, who they are sending it to, and what kind of data they're sending.

If I want to check that data, I can download it. I am checking the backup of the Endpoint Protector data weekly. If I want to monitor previous things, I can do that with the backup of the software.

It's important to create policies to protect my company data. If I create a policy that only our attachments go through our domain, only our attachments get through and not from Google, Yahoo, and others. It's blocking attachments effectively while providing me with an alert if I included an alert policy.

Endpoint Protector by CoSoSys has some valuable features. The role-based access features for the teams that administer it is good.

The granularity of the policies is good. The versatility of exit points is good. It also supports both macOS and Windows.

A lot of things can be improved. Especially customization could be a lot better.

Sometimes there are issues like when I write a policy to block finance sites. It also blocks the banking sites I have not included. Sometimes it also blocks commands I send to the machine while using Matrix software. 

Whenever this happens, I have to go into the software and choose the packet inspection option or something similar. Then I have to send the command again to the machine, and if it doesn't work, I have to contact the support team. These are some of the issues I have dealt with.

I have been using the Endpoint Protector by CoSoSys for over six months. 

The stability, reliability, and availability of Endpoint Protector by CoSoSys is good.

Endpoint Protector by CoSoSys is scalable and that's why we use it.

The support is excellent. I got responses promptly, just like the vendor stated. If I email or call support, they are ready to assist me.

Previously, we used Symantec Endpoint Protection, but the customer support wasn't good. I also inquired about Symantec Endpoint Protection and found out from our local vendors that the support wasn't good, and they recommended CoSoSys.

I installed CoSoSys in my system and tested it for two to three days. I made some policies like data blocking policies, mail blocking policies, attachment blocking policies, and all kinds of policies we need in our company. I tested it and felt very good about it and purchased the license.

The initial setup and deployment are very easy. You can download the database directly, and you can purchase the license. After that, you can download the ETP client to install it. That's all you have to do.

The deployment takes about two hours. The company had a deployment plan and strategy, and I did the rest. 

I implemented the Endpoint Protector by CoSoSys all by myself. 

The price of Endpoint Protector by CoSoSys is more or less the same as other competing solutions.

I have installed Symantec Endpoint Protection previously, and the response wasn't good. That's why I moved to CoSoSys DLP. Before CoSoSys DLP, I checked another software, but I found it wasn't a DLP.

If you need a good DLP software to protect your data, I recommend that you go for CoSoSys without any second thought. 

Endpoint Protector by CoSoSys is a versatile solution. The important thing is to protect the data, and it does that well. I have blocked all USB connections from the users via CoSoSys Endpoint Protector. 

It's very easy to use, just download the database from the internet directly, and after getting the license key, we can install and connect to the internet. Once you purchase the license, it's very easy, and 4GB of RAM and 150GB hard disk is enough for this data.

On a scale from one to ten, I would give Endpoint Protector by CoSoSys a ten.