SentinelOne Singularity Cloud Security Reviews

Cloud Native Security helps us identify security issues related to cloud configuration and containers. We leverage cloud synchronization for real-time incident notification.

Cloud Native Security is easy to use. Its user-friendly features make integrating new tools a breeze. Everything can be connected through a simple API. The intuitive dashboard and effortless ticket submission further enhance the user experience.

One of Cloud Native Security's most valuable features is its offensive security engine. This engine excels at identifying vulnerabilities caused by misconfigurations, which could potentially be exploited by external attackers. In these cases, Cloud Native Security's offensive security engine findings are highly accurate, with a proven positive detection rate.

Cloud Native Security has helped reduce the false positive rate. The reduction in false positives has improved our operations.

As a small startup, implementing all security best practices across the organization can be challenging. Additionally, security awareness may not be widespread. However, Cloud Native Security, a cloud-based security tool, helps us address these limitations. Cloud Native Security acts as a vigilant watchdog, continuously monitoring our infrastructure for misconfigurations. This includes detecting unauthorized access attempts, such as someone opening a specific port or granting historical access from an external AWS account. By integrating Cloud Native Security with our Slack channel, we receive immediate alerts whenever such suspicious activity occurs. The notification will highlight the potential risk and provide details, allowing us to investigate and take prompt action. Previously, we unknowingly stored sensitive information, known as hard-coded secrets, in our public GitHub repository. Since integrating Cloud Native Security with GitHub, these secrets are identified immediately and flagged through Slack alerts. This enables us to address the issue swiftly and reduce our overall security exposure.

It is far more effective at reducing our meantime to detection compared to the open-source solution we used previously.

Cloud Native Security's findings have led to increased collaboration with our infrastructure team. While our application is a separate product and doesn't reside in the cloud, Cloud Native Security has still proven valuable in this way.

Cloud Native Security's best feature is its ability to identify hard-coded secrets during pull request reviews. This helped my organization identify nearly 10,000 secrets added across our repositories, many of which had a significant security impact. Integrating Cloud Native Security with GitHub alone allowed us to identify all these secrets. This is a key feature that has been instrumental in improving our security posture through testing.

Secondly, Cloud Native Security's cloud SIEM feature has been essential in preventing our most critical security incidents.

We are experiencing problems with Cloud Native Security reporting. Our organization primarily uses Jira for issue tracking. While Cloud Native Security offers input options for reporting vulnerabilities, the "connect action" it provides to link issues isn't replicating information to Jira. This is happening for approximately half of the company and is causing difficulties for developers and stakeholders in fully understanding the reported issues.

Cloud Native Security's proof of exploitability is not that useful when it relates to container images. More detail should be included in the reporting.

Cloud Native Security can identify hard-coded secrets within our code and tell us if they're valid or not. However, in some cases, Cloud Native Security may flag a valid secret as hard-coded without specifying its exact location within the codebase. This lack of detail makes it difficult for developers to identify where the secret is used. Ideally, Cloud Native Security should provide the specific location of valid hard-coded secrets. This would significantly improve the developer experience by allowing them to easily locate and manage these secrets.

Cloud Native Security integrates with Jira and Slack through APIs, which is great. However, I would also like to see Cloud Native Security offer APIs that allow us to directly build dashboards within the platform. This would be incredibly helpful for visualizing vulnerabilities, security settings, and Cloud Native Security usage reports. Imagine if Cloud Native Security provided these APIs. We could create custom dashboards for specific purposes, like offensive security, cloud misconfiguration monitoring, or even integrating ISS scans. Essentially, any customer could easily build dashboards tailored to their needs. Unfortunately, Cloud Native Security doesn't currently offer this functionality. Other security products provide this level of customization. Adding this feature to Cloud Native Security would significantly improve its overall solution. 

I have been using Cloud Native Security for two years.

Cloud Native Security is extremely stable and we have not encountered any issues.

Cloud Native Security is scalable.

We contact technical support weekly. They are helpful and respond quickly. Additionally, there is a built-in chatbot that allows us to submit support tickets.

Positive

We also rely on AWS built-in features that alert us if there are any misconfigurations along with Cloud Native Security.

Regarding the license model, I believe their approach is appropriate based on the customer workload data we're tracking. It seems like an ideal way to proceed.

For pricing, it currently seems to be in line with market rates. However, I recall Cloud Native Security charging a slightly higher premium previously.

I would rate Cloud Native Security nine out of ten.

We receive notifications from Cloud Native Security whenever maintenance is required, and they provide instructions to complete the process.

New users should be prepared to have a dedicated staff member manage Cloud Native Security. This person will handle alerts, configurations, and integrations. You should continuously evaluate all the findings that Cloud Native Security provides, as it performs daily scans. However, it's possible to miss vulnerabilities that have already been fixed. Therefore, careful attention is needed when raising issues with developers. To optimize your use of Cloud Native Security and potentially reduce workload, consider providing feedback to improve the product. Additionally, try to utilize as many features as possible, as they can all have a positive impact on your organization's infrastructure.

We have an environment in the cloud where we have a bunch of EC2 instances and S3 buckets. We have the SentinelOne agent installed on all of our EC2 instances, to monitor our environment, so we use it quite frequently.

We needed cloud-based endpoint protection that we could install to get a single pane of glass into our security environment. Specifically, we needed to see the version usage of the applications to ensure we didn't have any outdated applications.

It has definitely helped reduce our mean time to detect. It's much quicker than with our last platform. Singularity has also helped free up our staff to work on other projects. We don't usually come into the console unless we get an alert. In that sense, we have been working on many other projects in the last year. Now that everything is set up and running smoothly, we haven't had to spend as much time in the console as before.

And when I consider the solution's impact on overall productivity, features such as the reporting have helped. When we need to run a report on how many endpoints we have in our environment for regulatory requirements, we use the reporting feature of Singularity because we know it's installed on every endpoint, giving us full visibility. From a reporting standpoint, it has certainly helped us.

We really appreciate the Slack integration. When we have an incident, we get an instant notification. We also use Joe Sandbox, which Singularity can integrate with, so we can verify if a threat is legitimate. The third feature we use most often is the VirusTotal integration. That allows us to take the hash of a threat or virus and open it up in VirusTotal.

Also, it's amazing how quickly its real-time detection and response capabilities come through. There have been multiple times where either my coworker or I will be working on something—even in our elevated environment, and even just running a script. We wouldn't expect a pop-up, but it's good to know that it's checking for those anomalies, detecting them, and notifying us of them instantly. We love that feature.

In terms of the historical data record provided by Singularity after an attack, we like to use the Storyline feature for deep dives and threat hunting if needed. It has been very useful in our operations. We can see different event types on each endpoint, which comes in handy. Using the Storyline feature, we can dig in much quicker, connect the dots, and see what caused the alert. So it has quickened remediation.

And the SentinelOne Cloud engine detection types are useful when trying to determine whether a threat could be legitimate or a false positive.

One of our use cases was setting up a firewall for our endpoints, specifically for our remote users. We have a firewall on-premises that comes into play when someone is at our main campus. But we needed something more for our remote users. We were hoping to utilize SentinelOne's firewall capabilities, but there were limitations on how many URLs we could implement. Because of those limitations on the number of URLs, we weren't able to utilize that feature in the way we had hoped to.

I have been using SentinelOne Singularity Cloud for about two years.

Singularity has been very stable. It has never lagged or crashed that I've noticed. In my experience, there has been 100 percent uptime.

The interoperability with AWS has been very straightforward and streamlined, without any major bugs or issues that I've come across.

Its scalability is one of the main reasons we chose SentinelOne. Because it's hosted in the cloud, we can install as many agents as we're licensed for. We've never gone over that limit. As new servers and endpoints come online, it's easy to deploy. It's built into the image.

We do have a unique use case regarding scalability. We use a VDI environment in Azure, and it works. We haven't had any issues. But when we need to run updates on those machines, we have to rebuild the image. We can't have the agent built into the image because of our rebuild process. That makes it a manual process for us every month when we redeploy those desktops. We have it scripted out with a PowerShell script that helps, but it's a manual step for us. That's one area we're trying to address from a scalability standpoint.

As for auto-scaling, we're more of a static environment for most of our endpoints. The VDI is our only more fluid environment, since our VDI endpoints go up and down based on usage. Once the agent has been deployed to those images, the auto-scaling works flawlessly, and we haven't had any issues there.

We used ESET, but the decision to go with Singularity was made before my time with the company.

We have a couple different deployments: our end-user endpoints and our server fleet. I was involved with the server deployment. It was very straightforward, and we didn't run into any issues during that deployment.

The only maintenance involved is when we need to whitelist an application. For example, if a new user installs an application, we might get a false-positive pop-up. That's really the only maintenance we have to do.

We did it ourselves, and there were four people involved.

It's a fair price for what you get. We are happy with the price as it stands.

My advice is that if you want an easy-to-deploy solution where you can have a single pane of glass to get visibility into all of your endpoints and applications, and run reports on those application versions, Singularity makes it a very easy-to-use, straightforward, and streamlined process that has helped us over and over again.

If someone thinks they don't need Singularity because they already have a continuous security monitoring solution in place, using SentinelOne gives us an overarching view from the single console, giving us the entire picture of the timeline of events that happened. Going through the timeline and connecting those dots really helps when threat hunting. It helps to get the full picture instead of just a specific point in time, which is the way some of the legacy antivirus programs work.

The solution has an automated remediation feature, but we don't currently use it because we are a smaller team. We like to remediate manually. For the time being, we haven't had a reason to use the automation feature yet.

One area we're trying to innovate more in is the AWS Security Hub. Singularity, in their marketplace, has a couple of apps related to that. We're trying to build more automations within AWS Security Hub to get better overall visibility, not only of our EC2 endpoints but of our applications as well.

SentinelOne Singularity Cloud Security is deployed on all our servers except for user machines. When Singularity identifies a downloaded application as malicious, it triggers an alert sent to our SIEM console. We can then investigate the alert details, including associated logs, to determine if the malware is static or actively malicious. We can also investigate suspicious IP addresses or domains. Additionally, Singularity monitors process creation and can provide forensic data on security incidents, including information about backdoor connections and the applications involved, like Chrome or other browsers.

SentinelOne Singularity Cloud Security stands out for its user-friendliness compared to competitors like CrowdStrike, FireEye HX, and Microsoft Defender. Unlike these tools, which can be cumbersome for tasks like running queries or searching for logs, Singularity offers intuitive interfaces and delivers results in seconds, even for complex searches across various hash formats, like MD5, SHA256, etc., without needing conversion.

Our existing SIEM console allows us to analyze alerts triggered by the SOC team. We can investigate potential false positives or conduct tests directly within the console. Additionally, the console facilitates quick searches for IOCs to identify malicious communications. Furthermore, Singularity Cloud Security offers a central management console for automated machine reboots, containment, and even self-maintenance in response to high-severity security alerts. This eliminates the need for manual intervention.

We saw the benefits of SentinelOne Singularity Cloud Security within the first two months of transitioning from FireEye HX. Singularity was easy to manage, and we were able to identify vulnerabilities.

SentinelOne Singularity Cloud Security has helped reduce the false positives we receive by 15 percent compared to FireEye HX.

Singularity has helped reduce our mean time to detect. The automatic containment of the infected machine is done within the first ten seconds of detection.

Singularity has helped reduce our mean time to remediate. 

The user-friendliness is the most valuable feature.

SentinelOne Singularity Cloud Security offers a custom search function with a default 14-day limit. Extending this period to 30 days requires an additional license. A two-month grace period for extended searches would be a valuable improvement. Additionally, enhancements to the threat-hunting capabilities of the hunter module are recommended.

I have been using SentinelOne Singularity Cloud Security for two years.

We had an incident in which they pushed a patch without notifying us and without testing, damaging all of our security controls. 

Neutral

We previously used FireEye HX but shifted to Singularity because we saw the potential while the POC was going on. The top three endpoint security solutions are SentinelOne Singularity, Microsoft Defender, and CrowdStrike. FireEye HX is not one of them.

The initial deployment's complexity was moderate. The entire deployment took six months to complete.

The implementation was completed with the help of the vendor.

I would rate SentinelOne Singularity Cloud Security seven out of ten. The lack of a 60-day search option for the log source lowers the overall score.

The endpoint security team does the maintenance.

SentinelOne Singularity Cloud Security is a good product that is easy to use. 

We leverage PingSafe for cloud security posture management, which continuously monitors our cloud configuration for vulnerabilities. When PingSafe detects an issue, we prioritize the alert from our cloud-native security solution and route it directly to the DevOps team for remediation.

We have PingSafe deployed on AWS, Azure, and GCP.

PingSafe has significantly reduced the number of false positives in our cloud-native security environment from 30 percent down to five percent. This is especially helpful since we receive notifications and alerts from various sources like AWS and Cloudflare, all with their own security policies. With PingSafe, I feel confident that these alerts are accurate, reducing the workload on our security team and giving us peace of mind for the past two years.

The threat detection capabilities have improved our overall security by safeguarding our cloud data transfers, and protecting both incoming and outgoing files.

With a large number of domains under our management, PingSafe's incident response feature is crucial for identifying and swiftly addressing any data corruption issues that may arise within them.

PingSafe has a user-friendly interface, making it a breeze to learn the fundamentals and navigate the dashboard.

Our Infrastructure as Code effectively identifies potential problems in templates and configuration files during the preproduction phase. This information is then relayed to our support team who can address these issues proactively.

Before implementing PingSafe, our cloud security was inadequate, resulting in inaccurate data visibility. To ensure complete data encryption and client invisibility, we adopted PingSafe, which successfully secured our cloud environment.

Reducing false positives has strengthened our security posture. While we transitioned from Prisma Cloud to PingSafe for our GCP and AWS environments, Prisma offered more advanced features. However, PingSafe prioritizes customer requests, addressing security needs faster than Prisma's release cycle, ultimately improving our security efficiency.

PingSafe has strengthened our risk posture by implementing access controls to ensure only authorized personnel can reach our data, and by safeguarding it to minimize security risks.

PingSafe has reduced our mean time to detection by 15 percent.

The implementation of PingSafe has improved collaboration between our cloud security application developers and AppSec teams. By granting those teams write access, PingSafe streamlines interaction and fosters a more efficient working environment.

Our engineering time has been saved thanks to the visibility that PingSafe provides.

The visibility PingSafe provides into the Cloud environment is a valuable feature.

The user interface is well-designed and easy to use, and retrieving data is smooth and effortless. 

PingSafe's cloud filtering has a limitation: implementing single sign-on requires a pre-class account feature, which is currently not available.

I have been using PingSafe for one year.

I would rate the stability of PingSafe seven out of ten. It is stable when it comes to securing our data.

I would rate the scalability of PingSafe eight out of ten. We have scaled many times.

The technical support team is both responsive and efficient, promptly resolving our issues.

Positive

While Prisma Cloud initially managed our cloud security, their slow feature implementation ultimately led us to switch to PingSafe. PingSafe's responsiveness in delivering the features we need has been a major improvement. Also, the visibility and dashboard of PingSafe are superior.

The deployment of PingSafe spanned several weeks as each cloud platform we deployed it on required one to two weeks for the process to complete.

PingSafe is affordable.

I would rate PingSafe seven out of ten.

We have around 20,000 users and have PingSafe deployed in multiple locations.

While PingSafe does require maintenance, our engineering team prioritizes keeping it up-to-date to ensure the accuracy and security of the data that underpins our cloud security posture.

I recommend PingSafe to others.

We use the tool for cloud security management. We check the vulnerabilities in the cloud during the configuration phase using PingSafe. We check how many cloud assets are being covered and how many issues have been identified from multiple cloud assets. We check different types of issues. We look into cloud network configuration, Offensive Security, Kubernetes security, and vulnerabilities. We also use the ThreatWatch option to check for active attacks happening worldwide. We can also check compliance, analytics, and asset inventory. We use the tool in multiple locations.

Without the product, we cannot know the configurations and the issues that are present in the cloud assets. PingSafe helps us to know such details easily. It guides us and shows the flaws or vulnerabilities present in the cloud assets. It also provides good remediation processes with screenshots. It is easy to tackle and remediate the issues present in the cloud assets.

The solution provides detailed visibility into the security state of the assets and workloads across all the platforms. The remediation process is good. It clearly provides every step required in the resolution with screenshot links. I like it very much. The product helps us identify the misconfigurations and flaws present in our organization. We meet with the concerned teams and resolve the issues. It helps us a lot by finding all the issues in the cloud assets.

We use the solution's agentless vulnerability scanning. There are different categories in the product. It is useful for us that PingSafe includes proof of exploitability in its evidence-based reporting. It is required for every company that uses clouds. PingSafe has helped reduce the number of false positives we deal with. Most of the time, we do not get false positives. It is usually below 10%.

The product has improved our risk posture by 50%. We can detect vulnerabilities faster. PingSafe has sped up the process by 80% to 90%. PingSafe provides us with the remediation process. It has reduced the mean time to remediate. Without the tool, we wouldn't know the process to remediate. We can get some things on Google, but the product provides the exact process we need to follow. The solution improves the mean time to remediate by 70%. It is a very helpful tool for remediation.

PingSafe is a collaborative tool. It is very easy to use. Anyone can easily use it. We can easily check the flaws and collaborate with other teams. PingSafe has helped us save engineering time by 50%. We use other tools for compliance. We have endpoint security solutions and antivirus products for normal assets. Similarly, we need a tool for the cloud assets. I will recommend PingSafe to everyone who uses the cloud.

Under the containers section, we have a cluster. It is a link between the organization and PingSafe. We don't get any notifications from PingSafe when the clusters are down. The PingSafe database doesn't receive any updates. It doesn't trigger any alerts. We must check things manually. It must be improved in future releases. If notifications are available, then it will be more helpful, easy, and time-saving. We can easily contact the team, check why the cluster is down, and restart things.

I have been using the solution for one and a half years.

The solution is stable. I rate the stability an eight out of ten.

We have eight users in our organization. The solution does not need any maintenance. I rate the scalability a nine out of ten.

The technical support is good. The team responds within 24 hours and resolves all the issues we raise. The team also arranges monthly meetings for updates. The support team educates us about the upcoming updates in the tool. The team helps us if an individual or a team has issues with PingSafe. The support people also help us with the remediation process if we are stuck at any stage.

Positive

The tool is deployed on the cloud. The deployment can be done in a day. One or two people from our organization and two to three people from the development team of PingSafe were involved in the deployment. The solution was easy to deploy. It was not complicated.

The product has saved us time, money, and resources. We have saved 80% of time, 20% of resources, and 80% of money.

The tool is cost-effective. It is neither cheap nor expensive.

The tool is easy to use. Compared to other products, PingSafe is the most easy to use. There are different severity categories, such as critical, high, medium, and low. We get notifications for critical things. Critical issues have the highest priority. The ability to prioritize the issues is helpful for us.

Overall, I rate the product an eight out of ten.

We primarily use PingSafe for compliance purposes because we work with banks and the fintech industry, so we must follow some standards like PCI DSS.

We use PingSafe for compliance and security purposes, and it has helped a lot. We face many audits, and during each audit, we must conduct a vulnerability assessment. PingSafe gives us a list of vulnerabilities that we remediate to raise our compliance score. It's our only tool for vulnerability assessments. The benefits are mostly immediate. PingSafe helped reduce the number of false positives, which has been difficult.

We like PingSafe's vulnerability assessment and management features, and its vulnerability databases. The interface isn't too complex. It's quite easy to use. The agentless vulnerability scan is the feature we use the most.

The categorization of the results from the vulnerability assessment could be improved. 

We have used PingSafe for 2 years. 

I have never faced any downtime.

PingSafe's scalability is quite good. We have multiple projects, and scalability isn't an issue. 

I rate PingSafe 8 out of 10 based on the features I have used. I haven't used all the features, but I give the vulnerability and compliance features 8 out of 10. I can recommend PingSafe for vulnerability scanning and compliance. There are many competitors, but I find PingSafe quite good, which is why we haven't switched to something else for the past 2 years. 

We have multiple AWS accounts and we use it for our products and deployments, et cetera, and they are being monitored by PingSafe for best practices and good security. In the past, we've had code exposed to the internet, and PingSafe has been able to catch such instances. Basically, it is for security and monitoring purposes. 

We've been able to integrate PingSafe with out AWS and deployed their agents to Kubernetes. For production and compliance purposes, it allows us to monitor actively for issues from one place. 

The solution reduces notifications.

We mainly use it for monitoring and security guidelines only. It's been really useful for us in terms of the developer accounts. If any have been exposed, we get notified and we can take care of issues before anything happens. 

We haven't seen any server downtime. It's always been available when we've needed it. 

The UI is very nice, and feature-wise, it's very good.

It has very good documentation. 

Support has been very helpful and provides regular feedback and help whenever needed. They've been very useful. 

The solution is very easy to use. We have not had to spend much time customizing or integrating items. We were able to integrate all four AWS accounts in order to centrally monitor everything.

There is evidence-based reporting which can help prioritize and solve cloud security issues. We haven't actively used it or set it up.

We use the infrastructure as code scanning feature. It's good for identifying pre-production issues. 

About six months ago, there was a major upgrade. We can see the containers running and which vulnerabilities appear, et cetera. 

We haven't seen any increase in false positives since using the solution. 

It's helped us improve our risk posture. We're more confident now that things aren't happening and getting missed. We're on the right track to adapting proper security rules.

More than saving engineering time, this solution has helped promote confidence is the security of our cloud accounts. We're more sure of our configurations and security posture. Since we don't have a cloud expertise team that might identify issues, it has helped us gain confidence in SQL deployments. 

There should be more documentation about the product. Sometimes we have to go to customer support to get clarification.

I've been using the solution for 1.5 years. 

The solution is stable. I have not seen any downtime.

We have around 15 users leveraging PingSafe. They are mainly admins and engineers.

Technical support is very helpful. However, the documentation needs to be better.

They tend to resolve issues within an hour or so. With most issues, they are very helpful 

We have a different pipeline product working in parallel to this solution that is also helping us reduce vulnerabilities. Something else, for example, monitors compliance for us. PingSafe is more of an additional tool than our main solution. We have been using open-source tools for scanning.

The development was just one configuration, and we were able to implement PingSafe in about an hour.

The solution does not require any maintenance. 

We have noted an ROI based on the amount of confidence we've gained having visibility into our vulnerabilities. I do not have specific metrics on hand to illustrate that, however. 

The pricing is reasonable.

We're a customer and end-user. I'm a DevOps engineer.

I'd recommend the solution to others. I would rate it 10 out of 10 as it currently meets all of our requirements. I can't speak to other companies that may have different requirements. 

We use PingSafe as our Cloud Security Posture Management tool.

PingSafe is easy to use. While some features, like advanced graphics and custom drag-and-drop filters, might have a learning curve, most functionalities are intuitive. Clicking on "Asset Inventory" provides a clear list of all our assets. The filters are logically organized by resource type, account ID, and other relevant categories. In short, most of the platform is straightforward, allowing users to become comfortable within 15 minutes. However, advanced capabilities like custom visualizations and automated filtering through drag-and-drop may require additional time to master.

PingSafe creates a comprehensive inventory of all resources within our cloud infrastructure. It automatically identifies any misconfigurations for each of these resources. The easy-to-track capabilities are further enhanced by automatic integration with Jira. Additionally, PingSafe serves as the primary source of evidence for audits and compliance purposes. It documents the resources we identified with misconfigurations and demonstrates that we have rectified them. This functionality simplifies the process of providing evidence to auditors.

We experienced the benefits of PingSafe immediately after onboarding our entire Cisco setup. However, there was likely a waiting period of up to six hours for the platform to fully populate with information about our infrastructure, resources, and so on. Despite this wait, some immediate benefits were gained. PingSafe likely identified a list of potential misconfigurations across our accounts. This provided a starting point for further investigation and remediation. Of course, to fully leverage PingSafe's capabilities, we might need to integrate it with our existing external tools. However, the initial onboarding process itself yielded some valuable insights.

PingSafe reduces the number of false positives we encounter. Initially, we relied heavily on custom engineering, which created a lot of noise. The code might not have been scalable, or it might have only triggered under specific conditions. We struggled to manage this custom tooling as our environment grew. When we considered scaling our operations, we realized this approach wouldn't be sustainable. PingSafe provided a well-designed system that addressed these challenges. Even during configuration, PingSafe can determine if something is misconfigured or not. However, PingSafe also allows us to suppress findings that might be flagged as security vulnerabilities in a traditional sense, but are expected behavior in our specific context. For example, we might have developed a custom way to handle a specific situation like a three-bucket container for a site. PingSafe allows us to suppress these findings, resulting in a significant reduction in false positives. Integration with PingSafe was very straightforward. Furthermore, suppression occurs at the source where misconfigurations are generated. This eliminates the need for an additional filtering layer. Imagine having 100 issues to address, and needing to manually filter out the ones that are not genuine issues. PingSafe takes care of this filtering within the platform itself.

PingSafe has improved our risk posture by giving us greater visibility into our infrastructure. This includes niche resources and misconfigurations that we weren't previously tracking or aware of. Unlike traditional tools that focus on specific resources or make assumptions, PingSafe performs a holistic scan of our entire account. This has given us a much better understanding of our current attack surface. Once these vulnerabilities were identified, we were able to prioritize and remediate them, leading to a long-term improvement in our overall security posture.

PingSafe has reduced our mean time to remediation. It's slightly better than our previous approach because we were also scanning daily. However, PingSafe also includes scanning for many more resources than we were managing ourselves. So, while the time to fix individual problems might be similar, perhaps slightly less, the reports generated by PingSafe are more comprehensive and complete than what we had before. Additionally, PingSafe helped us identify a number of additional resources that need fixing, which we weren't adequately tracking in the first place. Once a problem is identified and confirmed as a true positive, it takes no more than 15 minutes to fix it.

PingSafe facilitates collaboration between our teams. We have three main groups: application security, infrastructure security, and compliance. The infrastructure team handles the entire PingSafe process, from generating reports and onboarding resources to acting on them. This has streamlined our workflow by consolidating everything into a single view. I now have all the information I need in one place. However, it's important to note that our application security team doesn't currently interact with PingSafe.

The most valuable features of PingSafe are the asset inventory and issue indexing. Once I've onboarded all the cloud accounts I want to manage with PingSafe, it can automatically create an inventory of all resource types across AWS. Additionally, it can identify misconfigurations for those specific resources.

Another key feature we appreciate is the ability to create custom rules for up to ten users. This functionality is useful because PingSafe also collects generic information and metadata about each resource. This allows for granular filtering. For example, we can easily query to find only servers with a specific tag. This filtering capability is valuable for investigations, ad-hoc queries, and data gathering.

Finally, the integration module deserves mention as well. We use Jira internally to track all our tools, security reviews, and bugs. PingSafe can directly push issues to Jira, making it very easy for us to track them. This eliminates the need to constantly return to the PingSafe platform to see which issues were generated.

PingSafe can be improved by developing a comprehensive set of features that allow for automated workflows. While the current dashboard is functional, it could be made more actionable by incorporating additional functionalities. For instance, drag-and-drop functionality would simplify the creation of integrations. Additionally, valuable data can be retrieved from the platform using APIs and displayed on the dashboard, potentially using tools like Tableau for visualization. This is just one example, but it highlights the potential for expanding PingSafe's capabilities by enabling greater integration with other tools, even those not currently supported.

I have been using PingSafe for six months.

There was a phase where we built a proof of concept using the PingSafe platform to understand if it could directly address the problems we're currently facing. After finalizing the POC, we conducted testing and identified a baseline for future comparisons. Then, we moved into the implementation phase, and now the system is fully operational.

PingSafe is stable.

PingSafe is scalable. We have not encountered any issues with the number of accounts and services we are using.

Previously, we managed our cloud security posture with in-house solutions built using open-source tools and custom code. However, as the number of accounts grew, this approach became difficult to scale and maintain. Additionally, the reporting capabilities of our custom tools didn't meet the increasingly stringent compliance requirements. To address these challenges, we sought an external, vendor-managed Cloud Security Posture Management tool.

The initial deployment of PingSafe was easy because their implementation team collaborated closely with one of our cloud security engineers. Since there were no agents or software to install, onboarding accounts simply involved creating a role for them. This role grants the platform read-only access to our infrastructure. The process is very streamlined; our team can onboard an entire account within minutes. However, the first time an account is onboarded, it takes some time to ingest all of its resources and information.

The entire deployment took less than a week. This included not only onboarding accounts but also gaining a holistic understanding of the platform and its capabilities. PingSafe also came to our office to showcase the modules we could leverage and how we could use them effectively. Since this was our first time working with PingSafe, our team actively collaborated with them to resolve any issues we encountered.

One engineer from our organization worked with a team from PingSafe to implement the solution.

Pricing is based on modules, which was ideal for us. We weren't interested in the platform's full capability at first. Our priority was to establish foundational practices like maintaining an asset inventory and identifying misconfigurations. We then aimed to streamline these processes. Thankfully, PingSafe's modular pricing allowed us to pay for only the features we needed, unlike Wiz. With Wiz, we would have paid for the entire platform upfront, potentially leaving us with unused features. This would have been a poor return on investment, especially considering Wiz's high cost. In essence, their pricing model wouldn't have suited our needs. Even if we had eventually used all of PingSafe's features, the initial cost would still have been lower than Wiz in the long run.

After evaluating several options, including PingSafe and Wiz, we determined that PingSafe was the best fit for our needs, particularly in terms of cost. PingSafe provides a comprehensive view of potential security issues in our cloud infrastructure, allowing us to map them to relevant compliance frameworks, custom security requirements, or internal engineering standards. This enables us to effectively track and remediate these issues, ensuring a more secure cloud environment.

The Wiz platform offered a wide range of features that weren't essential for our current needs. For instance, they provided data security and AI-powered security posture management. However, our current security maturity level wouldn't allow us to fully utilize these capabilities. Additionally, Wiz is a comprehensive platform, and individual modules aren't available separately. In contrast, PingSafe allowed for closer collaboration. They could customize the platform's functionalities to meet our specific requirements. Moreover, PingSafe was significantly more cost-effective. While I can't recall the exact price difference, it was a substantial saving. Furthermore, PingSafe's support team was incredibly responsive. They were receptive to our suggestions for features that might be beneficial in the future. This flexibility, along with the platform's affordability, ultimately led us to choose PingSafe.

I would rate PingSafe eight out of ten.

We initially considered the agentless vulnerability scanning as a cloud security management tool, not a host-based security solution. Therefore, we opted against installing agents. Instead, we simply connected our AWS accounts through IAM, allowing the scanner to comprehensively scan all necessary resources and gather the required information.

The maintenance is taken care of by PingSafe directly.

Before deploying PingSafe, it's important to fully understand all its capabilities. While we're currently using one specific feature, PingSafe offers a wide range of functionalities. Gaining a clear internal understanding of your specific needs for PingSafe will help you determine the optimal model. Focusing solely on features without a defined purpose can lead to unnecessary costs. It's more efficient to obtain a quote for the model that aligns with your current needs. As your requirements evolve, you can then expand functionality by integrating additional modules.