What is our primary use case?
We're not yet clients of Perception Point. We have been running a PoC on their email security product for about two months. My managers are still going through some steps to see if we will finalize something with them.
How has it helped my organization?
The main component of their product is email security and their solution has been proven to be quite good at catching the bad guys.
What is most valuable?
The solution has pretty good detection. It has some particular areas that are—if "unique" is not the right word—strong points for them.
- It has modules to detect malware and that is a strong point.
- It has a very nice way of showing you, directly in the product, a lot of details about certain pieces of malware. It goes very deep and even shows you the assembly code.
- It also does detonations on files and shows you the results in different operating systems. That is very useful.
- And it has pretty good capabilities for catching malware campaigns that other products are not really catching.
What needs improvement?
Coming from products in the Microsoft stack, Perception Point doesn't really give you, as an admin, a lot of options to make changes yourself. It's more on their side to make changes in the back end. That's something they could improve on in the future.
Also, the search functionality is kind of tricky or buggy. When you enter some text to search, you have to scroll down to find the search button. It's a bit more friendly on the Microsoft side, or maybe I'm just more used to Microsoft. But if you copy a piece of text, like the subject of an email, and you paste it in the Perception Point search, you cannot modify it. You have to modify it before you paste it. That's just the way their text input field works. They need to pay some attention to the search functionality.
Also, you cannot really see graphs of evolution over time. You can choose various timeframes like one day, one week, one month, or a custom timeframe, but you cannot really see any evolution or compare graphs. You can't really see what the spikes were in one month. Perception Point does have a very graphical layer and they tell you, "We stopped this many emails with this layer, and we stopped this many emails at this other layer," which is very nice, but I would love to see a graph showing evolution and spikes.
What do I think about the stability of the solution?
We didn't have issues where the service wasn't available. That was okay.
The only little issues that we had were on the identity side, where we would invite a person to join the sandbox that they created for us, we would give them a role, but at some point they would lose access, and we would have to do some steps again. I'm not sure why that happened. But we didn't have service interruptions or anything like that.
What do I think about the scalability of the solution?
We ran the PoC in a way that almost all emails that had to go to Perception Point did. It handled that volume pretty well and I didn't see any kind of issues. And I don't expect to see any issues if we were to scale it even more with a bigger volume of emails. We onboarded close to 5,000 email accounts into Perception Point.
How are customer service and support?
Because Perception Point is not such a big company right now, I found that they are very responsive. The account team, the team that we did the PoC with, was very friendly. They answered all of our queries and they were always there. Even if we didn't directly communicate with the IR team, the person that we were in touch with, who had connections with the IR team, was always available. He was always giving us a heads up telling us, "We caught this campaign," or asking us if we needed anything. They were very friendly, responsive, and professional.
We didn't communicate with the support team. The account team took care of anything we needed. But they were excellent.
How was the initial setup?
The way we set up the PoC, just required us to set up a tiny transport rule and that was it. I'm not sure, when you put it into production as your main solution, what that process would be like. For us, having it as a second solution, on top of Defender, it was very straightforward.
We didn't let Perception Point actually stop anything in the PoC. The stopping task was still left to our main production system which is Defender. Our approach in the PoC was that we wanted to see what they would detect beyond our current solution. If I had let Perception Point stop anything, it would have stopped some pretty important campaigns in terms of malware, credential harvesting, and the like. But right now, it's just in detection mode.
During the PoC we didn't really use or talk to the Perception Point Incident Response team. We had two contact points on their side, and one of them was working closely with their IR team, but my colleagues and I didn't interact with their IR team. I know that behind the scenes the IR team was active, at some points blocking things or analyzing things.
I was the primary person who set up and tested Perception Point, in my role as senior security engineer. And one of my colleagues, who is handling email in his role as a cloud operations engineer, was involved. We also had our manager who is our director of IT, and another colleague who is a security analyst involved.
Which other solutions did I evaluate?
Our main email security solution is Microsoft Defender for Office 365. During the Perception Point PoC, we put the two products alongside one another, and we did see better results for some malware campaigns with Perception Point. There were some campaigns in which Defender for Office didn't catch things and Perception Point did.
We didn't really look for false positives. We were looking more to see if Perception Point could complement our detection stack. There were some things, legitimate domains that we were using, that Microsoft blocked and Perception Point didn't. If Perception Point had been our primary product, it probably wouldn't have blocked them. But in a similar way, Perception Point also blocked some stuff that was not actually malicious.
Perception Point has a very good engine for image recognition, like logos, and it was able to stop some phishing. Anyone could see they were phishing attempts, but somehow, Defender for Office 365 sometimes didn't catch them. Perception Point did, every time.
What other advice do I have?
Perception Point is a good solution. It's definitely worth testing. Every customer's environment is different, and not all companies are targeted in the same way, either because they are in different industries or they have a different number of employees. But phishing is definitely a very important attack vector, and Perception Point's product is very good. It's worth giving it a try, to at least run a PoC to see how it works.
The PoC was a very good experience and, at this point, I'm just waiting for my managers to make a decision about the product.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.