Skybox Security Suite Reviews

I mainly use Skybox to harden firewall rules and for rule usage analysis and compliances. We also use it for configuration compliance for firewalls, most of the Cisco switches and routers, and enterprise firewall vendors.

The most impressive feature is optimization and clean-up.

Skybox should improve their UX features by making them easier to use. They're also trying to transfer from Java GUI to web-based systems, but it's not consistent right now, so they need to develop and improve the features on that side. I mean, the native Java based GUI results and the new Web GUI results are not always the same. I have experienced some inconsistency results among them. So, I need to trust newer GUI for results.

I've been using Skybox Security Suite for more than five years.

Skybox is scalable.

Skybox's technical support is fine, but getting help takes some time because they request rules and models and pack logs instead of offering a remote session.

Neutral

The initial setup was extremely straightforward - the installation took about twenty minutes, but the integration took some more time because there were lots of different vendors and integrations. We also had some problems with login and port rules, which delayed integration. 

Skybox comes with extra licenses and has a change management license. The licenses are expensive, but they come with extra value.

Skybox is a full-feature product that comes with different modules like firewall and network assurance, network mapping, and a vulnerability control module. It's a very, very good solution for medium and large companies. I would advise anyone thinking of implementing Skybox to use a professional team to do the integration. I would rate Skybox seven out of ten.

We primarily use the solution for our management and optimization.

The solution's simplicity of use is its most valuable feature.

The solution needs more detailed reporting. In Skybox the reporting is good, but it could be improved.

The solution needs to add more automation and orchestration capabilities. Those features would make the solution much stronger.

I've been using the solution for about four years now.

We've found the product to be quite stable. We haven't come across any bugs or glitches. We also haven't experienced any crashes that would lead us to believe there was instability.

The scalability of the solution is very good. There's nothing stopping a company from expanding if they need to.

Reaching out to the solution's technical support wasn't in my remit. I'm the enterprise architect, so I don't get involved in tech support issues.

We did evaluate other solutions before choosing this one. In fact, I'd recommend other companies to also take a look at Tufin and AlgoSec. Evaluating each of these will help organizations pick the best solution for their needs.

We're just a customer. We're not a partner or reseller of the solution.

I'd rate the solution seven out of ten.

I'd recommend those considering the solution to also look at Tufin and AlgoSec. I'd advise anyone considering any of these three options to compare them together and request a detailed proof of concept.

In general, I'd recommend the product. 

We have been reselling Skybox for probably about five years now, so I'm pretty familiar with it. I've done numerous POCs and I've had hands-on with it quite a bit.

Because I get to work with a bunch of different customers, I get to see just about every use case for Skybox. The first one, which is pretty simple, is auditing firewall rule sets; taking a look at all the configurations that are on the firewalls and ensuring that they're locked down. What we run into a lot of times are firewalls that are set up with excessive permissions, meaning they allow a lot more traffic than they should. Skybox is essential to tearing that down.

Network visibility is another big use case, learning where all the assets are located on the network and how they can talk to each other. 

The last one that I deal with quite a bit is the vulnerability/exposure-monitoring piece. Looking at those vulnerabilities that are on the network, providing the context of network-based mitigation, and then reprioritizing or recasting those vulnerabilities.

Specifically, in the Vulnerability Management piece, vulnerability management products are very noisy and they provide this arbitrary score called the CVSS that rates the criticality of the vulnerability. How bad would it be if somebody were to exploit this vulnerability? That doesn't matter if I have something on the network that prevents that vulnerability from being exploited. What Skybox does is to allow organizations, including three of my largest customers, to reprioritize the vulnerability they attempt to patch and mitigate, based on the contextual awareness of the network.

Also, for the vulnerability, it's the operational efficiency of the patching team. Patch management programs are very expensive to run from a headcount cost, and also from a potential downtime cost, and there is a never-ending stream of vulnerabilities. The ability to contextualize those and recast them in a meaningful way to my organization, and to all my customers, has been very valuable in increasing the efficiency of the patching process.

With the Firewall Assurance, that changes the way applications are introduced into the environment. So instead of asking for firewall rules which may or may not be relevant, or could already be there, or could be over-permissioned, Skybox can be used to map out the resources that that application is going to use and provide the exact rules that an application would require to function correctly. If the traffic isn't able to flow for the application, if it's erring out, Skybox can be used to troubleshoot that and say, "All right, where is the traffic being stopped and why, and how do I fix that."

The Vulnerability Management module is among the ones we talk about the most and the one that customers are biting off on quite a bit.

Skybox, in general, has quite a few features that are particularly useful to large clients, but their scalability is unparalleled in the space. They have massive scalability, thousands of devices that they can pull from, hundreds of thousands of IP addresses for the vulnerability results and casting; that in itself is very unique. The way they do vulnerabilities, providing the additional context of the network mitigations is fairly unique and valuable.

The only place where Skybox has room for improvement, and they're working on releasing this, it's just a slow-go, is the UI. The user interface has historically been via a locally installed thick client. They are moving to a web-based console and it's slowly coming out. It looks really good right now. I've seen the previews. I've seen what's going GA. Really, it's just building in that feature parody, to take all the features that are currently in the thick client and move them into to the thin client of Web-based GUI.

Skybox is in three of my largest clients and they have hundreds of thousands of IPs and thousands of devices reporting into it. It has never been unstable for them. It's always available.

It scales just fine. The way that it's built with three-tier architecture, it makes it very horizontally scalable, so I can have multiple fallbacks. If one machine does fall offline, there are four other machines that are doing the exact same job to pick it up. But I've never had a problem where fault tolerance was necessary. It's just an available option that makes everything a bit more robust.

I've only had to call in twice, and the first-line support was able to resolve the issue within around 10 minutes. It was a pretty quick phone call, and it was immediate. Their tech support has been phenomenal.

I'm a reseller of this product but I represent a hundred security products to my customers. The other ones that I've looked at or used, or I have seen used in the past, are Kenna Security, FireMon, AlgoSec, Tufin. There are a couple others too, but these are off the top of my head.

Setup is not complex, but it is a little bit more time consuming because of the three-tier architecture. It scales really well, but that means there are more pieces to install during the setup, although it's not hard. Everything is just "click, click, click, next." You get through it really quickly. It's just a lot to do.

It also depends on how you deploy it. If you stand it up bare metal, it's a lot to do, but it's not exceedingly difficult. If you stand it up as an OVA, it's a five-minute installation. 

So it depends on which route you go on the installation.

In terms of licensing, it's about defining use cases. If somebody were to say, "Hey, how should I go about the licensing?" I would say, "Define what use cases you're looking for. Look at Skybox's entire portfolio and decide what is important, or what would improve your organization and then just license accordingly."

I have some customers who only purchased Firewall Assurance. That was all they're interested in, and they eventually grew into the Vulnerability Management. Then I had the exact opposite where they started off with Vulnerability Management, looking to improve their operations efficiency, and then they eventually branched into the Firewall Assurance module.

The only piece of advice I would have is, feed it all of the data sources. Skybox can take in a lot of information; structured, unstructured. It has a ton of integration partners. Even if you don't know if you'll need to use them all, just integrate everything you can into Skybox as a centralized platform, because it does quite a bit more, the more data you feed it. You increase its capabilities when you give it more data sources to look at.

I'd rate Skybox at 10 out of 10. I'm the Director of Security Architecture, so I'm very customer-facing and senior when it comes to product management and security architecture development. I tend to develop a baseline of programs whose capabilities I feel every organization should have. The ability to appropriately prioritize vulnerabilities inside the environment, and then to have visibility into the traffic and rule sets of an organization, are two of the top capabilities that I recommend. Skybox is the only one that does both of those in a single platform.

When I go into an organization, especially larger ones that are 5,000 or 10,000-plus employees, the first things I'm looking for are: How are you doing your vulnerability scanning and what visibility do you have in your firewall traffic? Typically, the answer to both of those is, "We don't have a lot there," and Skybox is one of the first things I'll recommend because it's almost imperative to get operational efficiencies. Firewalls are very basic. Firewalls are the front line against inbound traffic. If you don't have something like Skybox inline, able to see what's going on with your traffic flows, you can't appropriately implement those firewalls. So Skybox is typically one of my first three recommended products for just about every client I step in front of.

It's for integrating with firewall logs, and we are looking for automation where we can actually select all of the network architecture. Then, we can understand the rules that are available. We can look at the complexity as to whether the rules are compliant as per the standards or not. It's depends on the compliant order.

We are currently working on rule review and compliance. The logging features are good.

As for room for improvement, there are issues in logging. The logs are not coming into the log.

There are multiple dashboards but no custom dashboard. It would be good to include a custom dashboard so that we can actually choose which field and what kinds of things we want to look at.

We've been using it for probably more than six months.

In terms of scalability, I would give it a six out of ten. The logging features are good, but zones and zone mapping to get interactive topology are not straightforward.

I would give technical support an eight out of ten.

Positive

I used AlgoSec at another company. Skybox Security Suite is nicer than AlgoSec.

The initial setup is pretty straightforward. It gets more complex only when you try to integrate with the logs.

The implementation of Skybox is straightforward and you can integrate and get the logs and compliance reporting.

The integration might be a little tricky and may need tweaking.

Overall, I give Skybox Security Suite a seven out of ten.

The performance could be good because we chose it at the time, but it is too complex for us to appreciate its performance because we lack the necessary skills.

They are not satisfied with the complexity of the solution and the price.

To be used, we must have proper skills that require additional support, and the entire potential of the tool is not utilized and addressed. As a result of a lack of skills, it is complex.

Network auditing, which AlgoSec does, could be included, or perhaps Sky Box does but we don't know how to use it.

The company has been using Skybox Security Suite for quite a while, and they are thinking about changing the solution.

They have been working with it for at least three years.

We are in a complex environment, and we have three teams, with approximately 30 people using it on various entities.

We did not contact technical support. We attempted to have the necessary skills in-house, but it was insufficient. That is why we are seeking alternatives.

We also, work with Tufin. We have not been working with it for that long, we are in the POC phase. We are testing the tool.

We are also considering AlgoSec. I believe that is our current favorite, but we don't have a final decision at this time, but it appears to be AlgoSec.

The environment is very complex.

The deployment took a long time. We are considering changing it because it simply did not finish. It's as if we didn't do it properly.

We have a team of two to maintain this solution.

The licensing fee is paid yearly and is approximately $100,000.

I am researching firewall security management tools like Tufin, and AlgoSec.

As a product manager, I don't work with any products. I am just assisting team members in finding alternatives. I am a consultant.

I believe it is a management contract. I believe that such solutions should not be handled on-premise, and we must obtain a proper support contract with SLAs from the service provider. When we do install it on-premises, we have no support, no feedback, and no commitment, except to extend the contract.

We are both customers and a partner with Skybox Security Suite.

I would rate Skybox Security Suite a five out of ten.

We primarily used the solution for model sites, on the configuration side of things. We also used it to review certain port services, etc.

The port division management was the solution's most valuable aspect for our organization.

The solution was quite technical. It would be easier to manage if the solution was more specific about certain aspects and provided more advisory around how to use it effectively. It would help users a lot if they were more clear about everything.

The solution requires more integration in terms of automation features.

It would be great to have proxies, IDs, IPs, firewalls, certain network centers, etc. on the solution. If more of that can be looked at or reviewed from a Skybox standpoint it would be helpful. The solution needs to expand its scope.

We had been using the solution for about a year. It hadn't been too long.

For us, the stability of the solution was okay. Our organization managed to use it just fine.

The solution isn't great at scalability. I'm not saying it is not scalable, but then, of course, companies have to test and see. For us, when it came to scalability, there were always question marks as to if it could be done effectively. We were never 100% confident in its capabilities. For us, and the environment we worked in, we were somewhat sensitive to scaling with this solution.

There were two types of users for this solution in our organization. One type of user had full access to the tool and they were the leadership team, IT and security. The other type of user had access to automated reports. There were about 200 people who had access to this.

We were never in touch with technical support. I can't speak to how helpful they were. We had a team that dealt with technical support, but I don't recall ever hearing from them about how good or bad the service was.

We've since moved from Skybox to another solution, therefore, we aren't using it anymore. About four to six months ago, we migrated from Skybox to another tool called AlgoSec.

I'd advise other companies to scan the solution from time to time and be mindful of it. It's also important to make sure the services of the tool are enabled for the actions a company will need to handle or monitor.

I'd rate the solution seven out of ten.

We use this solution for data encryption.

We provide and deploy this solution for our customers and show them how to extract the reports. Our customers are really happy.

If they run into any issues, we resolve their queries.

It's a good product. We can extract the data from it very easily.

It's very supportive and very user-friendly.

We are not using the solution and rely on customer feedback. If the customer does not provide any, then we can't recommend what could be better.

If they have had any kind of issues, then we are able to know and have it perform better.

I have been using this solution for four months.

We are using the latest version.

It's a stable solution. We haven't had any issues with stability in the four months that we have been using it.

It's a scalable product. We scaled our internal projects.

We only have single customers who are using this solution.

We have not contacted technical support because we have not any issues.

Our clients have not had any queries. If they do, then we would contact technical support.

It's easy to install and deploy.

It took one month to deploy to all of the branches.

The integration was done by the vendor. We didn't do any kind of integration.

We purchase the license for the product.

Customers do not purchase the license, we take care of that.

When compared with other companies, the license is more costly.

The price could be cheaper.

We have deployed this solution for our clients and have not received any complaints.

I would definitely recommend this solution to others.

I would rate Skybox Security Suite a ten out of ten.

Our clients are using it from the firewall assurance perspective. They want to do an audit of their firewalls. So, the use cases are related to policy audit, such as which shadow rules they have and which rules are not getting utilized. 

We are recommending the latest version to our clients because sometimes, a lot of integrations are required with respect to different firewalls and virtual devices. If we are using an old version, some of the things are not getting integrated. That's why we are going with the latest or the latest minus one version.

To my knowledge, most of the deployments that we have done are on-prem.

It can be integrated with a vulnerability management solution. When a client comes, apart from pitching network and firewall change management, we are recommending having vulnerability management. So, rather than just having the audit of the firewall, they can integrate it with their vulnerability management solution, which could be Rapid7, Qualys, or any other solution. This provides them the most value out of the platform. That is the way we are approaching our customer base.

It is reliable, and their support is good.

Change Manager can be improved. If they can improve Change Manager so that whatever we want to do on a firewall, we are able to do it through Change Manager, it will be helpful for us. Whenever we are doing a change, it only does them at an L3 and L4 level, but all the firewalls are at the application layer. So, whatever needs to be done on the firewall, we aren't able to get it done through Change Manager. Currently, this functionality is not there because of which we are sometimes losing customers. I can create a role on Layer 3, Layer 4, but when it comes to the application layer, such as configuring and defining URLs or other things at the application level, it can't be done through Change Manager. Customers demand that they should be able to do everything through Change Manager. They don't want to do it through some other mechanism to accomplish their complete change management policy. They don't want to use a firewall manager because sometimes, they don't have any manager. They ask if they can use our solution so that a manager is not required. If Change Manager can do all the management automatically without involving any other manager, it will be great. They can also provide better integration with other managers so that everything can be done through a central point.

On the OT side, if they can provide more visibility, it would help. We are working on some of the features related to OT, so more visibility would be helpful.

We have been working with this solution for two to three years.

It is reliable. Whatever features are there, they are reliable.

As of now, we don't have any challenges with scalability. If we are fulfilling all prerequisites, it is okay. 

Earlier, in some of the cases, it was a bit slow, but if we are fulfilling all the requirements, it gives a good performance. For a PoC, when we were using an old platform, the performance was not up to the mark, but when we use the latest platform and hardware, the performance is good.

Their support is good. Support is not a challenge.

It is not complex.

We are acting as a vendor and distributor for Skybox in India. So, our team is taking care of whatever implementations are coming on behalf of Skybox.

Licensing is normally on a yearly basis. There may also be a perpetual license. Normally, the customers ask for a lower price. If you want to sell more, you have to think about it.

I would definitely recommend this solution. If you have a complex network with more than 20 firewalls, it is better to go with this solution. It might not be suitable if you have only four or five firewalls, but when the network is complex, or you are managing a data center with a lot of security challenges, I would recommend this solution.

I would rate this solution a nine out of 10.