Trend Vision One Endpoint Security Reviews

We utilize Trend Micro Apex One for endpoint security across all of our clients, managing it centrally alongside the entire Trend Micro suite.

We implemented Trend Micro Apex One to improve our endpoint security.

Trend Micro Apex One is able to identify threats and notify us to investigate from a central location. From there we are able to inform the client and disconnect the affected device to protect the environment.

Apex One employs advanced protection features, including behavior analysis, to adapt to and defend against unknown threats. Apex One's ability to recognize abnormal behavior and terminate processes is crucial for safeguarding our organization's security.

Apex One utilizes runtime machine learning to detect ransomware, a crucial feature for safeguarding our data from ransomware attacks.

We utilize Apex Central as a single unified console for comprehensive management, enhanced visibility, and effective cross-layer threat detection, hunting, and investigations. As managers of Apex One, we require a centralized console for comprehensive threat detection, investigation, and hunting across all layers of the environment to effectively monitor and manage client performance.

Apex One's single console provides end-to-end visibility into the entire IT security environment.

The end-to-end visibility has significantly reduced our response time, enabling us to respond within five minutes.

We have integrated Apex One with other security products. Apex One is able to deploy rapid updates within ten minutes of detecting threats in the network sandbox. 

The ability to deploy updates immediately is crucial for me as a security manager.

Apex One is easy to learn.

Administering Apex One is more straightforward than the other products I manage.

Apex One has helped improve our production. We were able to see the benefits within two months.

Apex One offers virtual patching to mitigate vulnerabilities that attackers could exploit.

We have seen a reduction in viruses and malware since the implementation of Apex One.

Apex One has reduced our administrative overhead because it is easy to use.

Trend Micro Apex One's centralized management is user-friendly and efficient. It provides comprehensive visibility into all client logs and seamlessly integrates with other products, such as CM. This well-structured design facilitates effortless monitoring of the entire environment from a centralized location.

The time required for Apex One to notify us of detection in the central console should be reduced.

I have been using Trend Micro Apex One for almost seven years.

I would rate the stability of Apex One nine out of ten.

Apex One is scalable and can easily manage up to 5,000 endpoints.

Our client has 5,000 employees, and each employee uses two laptops. Therefore, we have plans to increase the usage to cover 10,000 endpoints.

The technical support is good. They are able to action our requests.

Positive

We previously used Kaspersky Endpoint Detection and McAfee. We switched to Trend Micro Apex One because it offered a lower price, better central management, and is a popular solution in our country.

The deployment was straightforward and took approximately six hours to complete. The vendor provided us with resources in advance, including database and IS configurations, before arriving to implement Apex One. This facilitated the download, implementation, and licensing of Apex One. One person was required for the deployment.

The implementation was completed by a third-party vendor.

The price of Apex One is competitive and lower than the prices of the solutions we compared it to.

We evaluated the different Kaspersky and McAfee offerings in addition to Trend Micro.

I would rate Trend Micro Apex One nine out of ten.

Two people are required for maintenance.

I recommend Trend Micro Apex One. It is a good solution.

My company is working with multiple Trend Micro solutions, including its MDM solution, but I think they have removed that one. We are using One Endpoint Security for endpoint defense. Most companies need security installed on the server and agents on all organization's devices that can be managed from the same command console, so you can apply consistent policies to everyone. Trend Micro also offers an XDR solution called Vision One. 

Before implementing One Endpoint Security, we didn't have another security product, so we can't check to see if there has been an improvement from one over the other. You can save time with Apex One. For example, you can typically save about two hours of investigation time. You can save more time if you identify the problem device earlier and block it.  Also, the action is immediate. You don't need to check, read, and understand what happens, and then perform an action. All you do is take the action. 

The XDR is helpful because it requires less work to manage the endpoints. All the alerts are inside the window, and you can apply the different tools from the same console. You can find all the information and hold it in the sandbox for 30 days in case you need to check something. You can also make a bigger sandbox with more logs, but you don't need all that normally.

I like One Endpoint Security's playbooks because they make it easier to set rules and policies. You can customize the playbooks and use them in more than one company. If you manage multiple businesses, it's a great way to set separate policies for each group. You can check for vulnerabilities, attacks, bugs, or anything strange. It also allows you to conduct performance analysis. 

One Endpoint Security protects against unknown and novel threats. There are different processes you can set to monitor a vector and see if something is strange, like if a process has been modified or a new tenant has been created. If so, you can block them. I have already set rules that block when you install this for the time. You can manage them on the tab. Once all the rules are set, I can sleep well knowing that anything suspicious will be blocked. The next day, I can check the logs for any device or user account and see what happened.

There isn't a single application firewall that can filter all the malware. We have different applications and build multiple layers around the business. One of these is the antivirus, but we also have something on the DNS level to control access to the DNS.

You can detect ransomware with machine learning. There are multiple options for that. The threat database compiles all the knowledge of the attack methods and they are synchronized among the different companies. Information is coming from different regions, like Europe and the United States, or other systems.

Having a single console for threat hunting and investigation is the best thing about One Endpoint Security. If you buy the complete package, you also get Vision One, and you can manage both from the same console. Before we deployed Vision One, we had different windows and consoles. Trend Micro is like eight consoles in one. It's great. 

You can integrate One Endpoint Security with some products. In our case, we have only integrated it with Microsoft 365 products, so we can scan data or filter messages that are coming from outside. 

I want more options and flexibility when creating rules. I want to set rules that are contingent, like "If this happens, then this, this, and this will happen." 

I rate One Endpoint Security eight out of 10 for stability. 

One Endpoint Security is highly scalable. We're covering more than a thousand endpoints. 

I rate Trend Micro support eight out of 10. The quality varies depending on the technician.  All of them are qualified, but some have more qualifications than others. However, I'm happy with the support overall. 

Positive

I previously worked with Kaspersky and McAfee, but we are new to the XDR. It's a relatively new service and there are only a few competing products. For example, Check Point also has this option.

I don't think that there is a significant difference between One Endpoint Security and other solutions, but I think this is an expert solution. I have not tried all of them, so I can't say definitively if they are better or worse. However, one difference is that an agent uses up processing power and computer memory. Kaspersky uses a lot of memory, whereas Micro Focus doesn't seem to cause the computer's performance to slow down. Maybe if you perform a huge scan, you'll notice it's working slower, but usually, it isn't too much.

One Endpoint Security was already deployed when I joined the company, but it's straightforward. You can do it alone, but I always prefer to have someone from the support team available to address any issues I might have. 

I find the price of One Endpoint Security to be reasonable. The pricing varies from company to company. Your business will have a different price than what we have because the product's price depends on the number of users. 

The product will likely cost more in the future because they are adding more features and will probably offer various modules, such as DLP. We will renew our license in 2025, so we will see if the price goes up. 

I rate Trend Micro One Endpoint Security eight out of 10. I only have good things to say about this product.  This solution is constantly improving and could easily become a big name. If you want a better price, you can always check out the other products on the market. More and more products can do the same thing as One Endpoint Security. One Endpoint Security will work as expected. It matters how you deploy the service. If you install it on-premises or in the cloud, they will give you a different price. 

Using One Endpoint Security isn't easy at first. It's like learning to drive a car. You won't be able to do it the first time. You will need the time to learn about this product and use it in different situations to practice.

We use Trend Vision One Endpoint Security to protect against ransomware.

Trend Vision One Endpoint Security does a good job protecting our endpoints against threats such as malware, ransomware, and malicious scripts.

Trend Vision One Endpoint Security has partially advanced protection capabilities that adapt to protect against unknown and new threats.

Machine learning helps detect and block ransomware attacks.

Trend Vision One Endpoint Security provides a helpful single console for cross-layered attack action, threat hunting, and investigations.

Trend Vision One Endpoint Security is easy to use.

The learning curve is not steep.

Before Trend Vision One Endpoint Security, we lacked threat-hunting abilities. Now, we can swiftly pinpoint threats and establish connections between email and endpoint data.

We are using the Trend Vision One platform for consolidated security across hybrid environments. This consolidation has improved our security operations and saved us time.

Trend Micro's Vision One platform offers a full view of our entire IT estate and empowers us to manage cyber threats more effectively. It achieves this through a combination of Zero Trust security principles, and ongoing monitoring for vulnerabilities in our attack surface.

Virtual patching helps protect our endpoints within minutes of detecting a vulnerability while we wait for the full patch which can take some time.

Trend Vision One greatly reduced the viruses and malware we receive. Before Trend Vision One we would receive five callbacks each month but now we may see one or two in six months.

The managed XDR adds great value to Trend Vision One Endpoint Security because we can manage everything from one place.

The most valuable features are behavior analytics, machine learning, and virtual patching. 

To gain complete visibility across our entire IT security landscape, we need additional Trend Micro products to complement Trend Vision One Endpoint Security. We're also integrating a third-party solution with Trend Micro for a more comprehensive approach. The integration aspect has room for improvement.

The console is unstable, meaning it frequently malfunctions or lags, making it unreliable.

Trend Vision One Endpoint Security initially offered a user-friendly administration experience, but its manageability has declined over time.

The technical support response time has room for improvement.

I have been using Trend Vision One Endpoint Security for five years.

We currently have issues with assets not showing up on the console which has been lagging.

Trend Micro Vision One scales its endpoint security based on the number of licenses we purchase, allowing us to secure more devices as our organization grows.

The technical support takes a long time to get back to us.

Neutral

We've switched from McAfee because it was resource-intensive and some users reported missing malware detection.

The initial deployment was straightforward. The only time-consuming part was deploying across different locations. The deployment took two months for 5,000 users. For the deployment, we have to download the console from the agent. No more than three people are required for the deployment.

I would rate Trend Vision One Endpoint Security seven out of ten.

Two people are required for the maintenance.

I recommend waiting until Trend Micro fixes its stability problems before implementing Trend Vision One Endpoint Security.

We use Trend Micro to troubleshoot and monitor. We implemented it to gain more visibility into the networks we manage. Automatic network mapping helps visualize the network.

Trend Micro reduces our response time by around 40 percent. We can patch vulnerabilities and create specific rules to fix issues before an official solution is available. We've also reduced viruses and malware by about 30 percent. 

The Trend Micro security products are well-integrated with each other, creating a lot of value for the company. We need a comprehensive solution for preventing all cyberattacks and problems users cause when they don't understand the dangers of clicking on phishing websites, emails, attachments, etc. The company needs to reduce its exposure to threats. If we lose the data, we lose the company. 

Apex One provides a single console for receiving information about each machine, virus, malware, etc. The console receives telemetry from each machine that we can consolidate and view on one dashboard. We can see all the problems and vulnerabilities to make the best choices to prevent, restore, or recover. It gives us unified visibility into our entire IT environment. It's easy to administer Apex One. There are some advanced settings, but they aren't difficult to understand, and the documentation is detailed. 

OfficeScan wasn't 100 percent perfect when it was rolled out, but integration with Apex One improved its efficiency for dealing with trending attacks or ransomware. Initially, it wasn't very good, but now we can better control the environment. 

Trend Micro has advanced protection capabilities that cover unknown and advanced novel threats. It's critical because restoration could be complicated if we lose machines or information on the machine. If we lose some business information, we might run afoul of the law. Apex One can prevent all these incidents. It's an excellent solution.

Machine-learning ransomware detection is essential, as ransomware attacks can be difficult to contain. Without this agent, we wouldn't know that we lost all this information, and we might be forced to close the company and lose money.

Initially, it isn't easy to understand the console because most of the applications integrate through Visual One. When we create a new dashboard, it takes some time to adapt, but the IT staff does not have any problems.

We have used Trend Micro for seven years.

Trend Micro's support has been very helpful.

Deployment is simple. The engine was difficult to install the first time, but the latest versions are different. The package is small and doesn't affect the performance. It deploys quickly and we start receiving the telemetry on the console fast. 

Trend Micro reduces equipment costs. We don't need to buy services for an on-prem data center.

In Brazil, Trend Micro is cheaper than its big competitors like CrowdStrike and Symantec.

We evaluated several products and landed on the Trend Micro stack because it can be integrated with different solutions. They also have products covering various IT areas, such as networks, email, etc., that we can control from one place and manage from our mobile phones. The appeal of Trend Micro is that we can consolidate all our security and IT tasks into one console.

I rate Trend Micro eight out of 10. 

It serves as a comprehensive solution for antivirus scanning across all endpoints. It facilitates the deployment of the application portal within the access center, ensuring device control for vulnerability protection which enables the implementation of device-blocking measures to enhance security.

It safeguards endpoints by detecting threats like malware or malicious scripts, employing features such as behavior monitoring and machine learning. This includes detecting zero-day attacks and analyzing application behaviors for enhanced security. It delivers excellent products for effectively safeguarding endpoints, utilizing advanced features that enhance protection and mitigate various threats. It is equipped with advanced ransomware detection capabilities through real-time machine learning. 

This detection is not solely reliant on signatures; instead, it incorporates built-in features for proactive identification of ransomware threats, offering an advanced and pre-emptive approach to detection. A single console facilitates cross-layer detection, and access to the central console is necessary for on-premises solutions. In the SaaS-based model, the EDR console serves as the unified interface. 

This single console allows for threat hunting, investigations, incident management, playbook creation, and incident response. It is essential as it provides end-to-end visibility into the entire IT security environment, especially in EDR. However, challenges may arise when dealing with endpoints that contain files lacking signatures or behavior detection capabilities. To address this, a sandboxing solution becomes crucial to analyze and understand the behavior of such files. 

It offers the capability to swiftly deploy updates to endpoints, allowing for the immediate deployment of patches or signature files in response to incidents or attacks. In scenarios with no existing signatures, the support team from the OEM can provide the necessary signatures, and these can be promptly pushed to the Apex One Center. 

Timely updates are crucial for us as they help us maintain security. 

Since transitioning to Apex One, we have observed a notable decrease in viruses and malware. 

Our product now detects threats much faster, leading people to express confidence in the effectiveness of our custom machine-learning capabilities, evident in the significant reduction in detection times. Utilizing an independent cloud has significantly reduced the workload for our staff by eliminating the need to manage hardware, operating systems, and applications. 

Daily tasks such as console endpoint restarts, application protection, and agent communications compliance become more straightforward. The ease of managing these aspects is a notable advantage. 

Moreover, the SaaS solution proves particularly beneficial when customers are unable to provide on-premises infrastructure for applications. Users can effortlessly log in, deploy agents, and manage tasks without the complexities associated with on-premises solutions, which depend on factors like hardware, databases, operating systems, networks, proxies, and other variables.

The standout and highly valuable feature of Apex One is its XDR capability. 

Featuring advanced protection capabilities that dynamically adapt to defend against evolving and emerging threats, Apex One stands out. Detecting ransomware and utilizing machine learning capabilities are crucial features, especially for safeguarding customer environments. 

It stands out as a pioneer in incorporating these features within its antivirus solution. Trend Micro was the first to integrate behavior-based analysis, signatures, and reputation-based detection to enhance protection against ransomware and other threats. 

The learning curve for Apex One is minimal, as it is a straightforward and user-friendly product. The graphical user interface is simple, making it easy to navigate without the need for additional training or complex documentation. 

The terminology and features are presented in a common and basic language, ensuring that anyone can comprehend and work with the product easily. 

Administering it is also a straightforward process. It offers virtual patching capabilities to safeguard against significant vulnerabilities. This involves an active signature-based approach to virtual patching. 

The added value that managed XDR brings to our Apex One deployment is significant.

There is room for improvement in the reporting aspect. Custom-level reporting is crucial for in-depth analysis and its significance is evident in the effectiveness of managing and prospecting products.

I have been working with it for fifteen years.

In terms of stability, Apex has proven to be a reliable product with no reported downtime requirements. In my experience, I haven't encountered any significant challenges. The only instances of the console being down were typically related to database issues, such as log saturation or routine database maintenance.

It's a scalable solution with good performance.

The support has been challenging, particularly when utilizing bots during customer calls, as it often results in ineffective solutions. The primary issue revolves around prolonged resolution times. Even with ongoing follow-ups, cases remain unresolved within the anticipated timeline. The consistent request for logs implies that multiple submissions may be necessary for a potential solution or resolution. Enhancements in specific areas are required to improve the overall support process. I would rate it seven out of ten.

Neutral

Deploying the on-premises solution is a seamless process, especially when dealing with the application components. Apex One or Apex Central is the management console, with Apex One managing antivirus consoles, groups, and parts. Policies can be efficiently pushed through Apex Central. The agent itself is equipped with XDR capabilities for on-premises solutions. Conversely, an additional service installation on endpoints is necessary for cloud-based implementations. The deployment process is relatively quick, typically taking around half an hour

Opting for cloud solutions can provide a more cost-effective and efficient alternative, with fewer dependencies on physical setups and unexpected costs associated with on-premises tasks.

Integration capabilities exist for Trend Micro with its own suite of security products, allowing seamless collaboration. However, integration with Apex One may not be supported regarding other security products from different vendors or OEMs, such as Central One, CrowdStrike, or Palo Alto. Overall, I rate it nine out of ten.

We use the solution for security for endpoints. 

I do a lot of POCs to measure response. 

Trend Micro uses agents to communicate with servers. We're using the service gateway. 

We use the cloud and take advantage of virtual patching. Most customers now use the platform. However, I also have a lot of experience with on-premises setups. 

I work on various models and work on multiple Trend Micro products.

If a machine is not patched properly or the required certificates are not installed, Trend Micro has the ability to remove the existing end device. 

We can access all products and policies now from One Endpoint Security. We can deploy policies and do everything directly from One Endpoint Security. 

The monitoring is very good.

It offers good server protection. 

There's event monitoring and monitoring for duplicate system files and suspicious behavior.

It has a lot of features that are not available with other OEM products. Trend Micro offers good virtual patching. Many OEMs rely on Trend Micro based on its bug bounty. Many submit bugs to Trend Micro, and Trend Micro pays people to find bugs. 

The IPS model will protect users until they patch to the latest updates.

There's a malware module that was recently released. It offers damage cleanup services and protection against viruses. It offers real-time protection. 

There's machine learning that protects against unknown tests. If the behavior looks suspicious, Trend Micro will kick in to secure the customer. 

It adapts to protect against stealth threats. Most customers are using One Endpoint Security with XDR. We can analyze potential threats. If there are any glitches running continuously, if any lateral movement is detected, we can move in to secure the endpoint. It helps us move in immediately. We'll be able to recognize things that aren't part of our processes.

It has the capability to integrate with our Active Directory.

It has ransomware detection capabilities. Users may not know which emails are suspicious. However, we can control access via the gateway. It helps protect against unknown suspicious activity.

One Endpoint Security provides a single console across layers for detection, threat hunting, and investigation. It's very important for customers to have this single console so that everything can be located in one place. This single console provides end-to-end visibility into the entire IT security environment for our customers. The configuration and monitoring are important. Every machine must remain compliant in order to ensure no threats can break through. We work hard to make sure every machine is up to date.

The learning curve of Apex One is very low. It's easy to use. 

It's easy enough to administer One Endpoint Security. 

We've seen a reduction in threats and viruses since moving to One Endpoint Security. We've seen a drop of 60% to 70%.

We do use One Endpoint Security as a service. We recommend that our customers use the SaaS offering. It has fewer limitations. It helps reduce the workload for customers by 60%. Overall, the administrative overhead has been reduced by 65%.

The performance could always be improved.

The solution has separate XDR agents. They should be working as one agent with One Endpoint Security.

I've been using the solution since 2019.

I'd rate the stability eight out of ten. Sometimes, there may be performance issues. 

We have customers with as many as 10,000 or 15,000 nodes.

The solution can scale. I'd rate scalability eight or nine out of ten. I haven't had any issues with scaling. 

We've been satisfied with the OEM support. 

Positive

I've also worked with McAfee, Symantec, Kaspersky, and AVG. I work with a lot of cybersecurity products. Prior to this product, I specifically used Symantec.

I also worked with Crowdstrike; however, it works using a different algorithm. One Endpoint Security is based more on data and works more on a behavioral basis, and Crowdstrike does not work like that.

I tend to do POC setups and sometimes manage troubleshooting for customers. On-premises, we can install an agent from the console if there is an Active Directory. 

The deployment itself takes two to three minutes. 

If there's centralized management, it's fast. We might do a more manual process if it's a smaller organization. If there are more than 5,000 to 10,000 nodes, we need a team to help deploy it. 

Typically, one person is enough to handle maintenance. 

I don't directly deal with pricing. 

I did not evaluate other options. 

We use both on-premises and cloud SaaS deployments. We're a Trend Micro partner. 

I'd rate the solution nine out of ten. 

We use Trend Micro One Endpoint Security for endpoint security. We are using the SaaS version of One Endpoint Security. 

I am confident in One Endpoint Security's capability to defend endpoints against threats like malware, ransomware, and malicious scripts. 

One Endpoint Security has predictive machine learning and behavior monitoring, which are essential for endpoint security. Our file scan also scans the memory for malware. Behavior monitoring is particularly effective at detecting ransomware attacks because it can check for unusual encryption methods.

I like the way Trend products integrate with each other. The servers are all tied into Central, which is now integrated into my Vision One console. The on-premises stuff is also integrated with Azure.

We use a single dashboard through The Central to view detections, threat hunting, and investigations. The visibility through the single console is important. When we open the dashboard, it tells us what it has found. For example, I am currently looking at the SaaS version. If I go to One Endpoint Security, I can see all of the agents that are currently connected. It takes a few moments for all of the agents to load. We are currently in a downtime during the summer months. We are a school board, so there are fewer staff members on-site, and not all of the schools are open. We have 12,000 employees and 80,000 students. However, not all of the students are online right now as they would be during the school year. Next Friday, we will have more staff members in the office. When school starts after the Labor Day long weekend in Canada in September, everyone will be back online. Currently, the dashboard only shows 9,140 agents. Last week, it showed 6,400 agents. I have the system set up to remove inactive agents so that the system does not have to constantly scan a bunch of systems that are not even there. I have seen up to 17,000 endpoints on our system.

Vision One is now monitoring my Cloud One workload security and My Cloud Central. This means that Vision One is collecting data from both systems and giving me a comprehensive overview of my security posture. When I open Vision One, I will be able to see visibility into my entire organization. I have configured Vision One to send data to our Syslog server and receive data from our Qualys server. The Qualys server scans my servers for vulnerabilities and reports back to Vision One. I have also set up a service gateway and a workload security data center gateway. The workload security data center gateway feeds data from my VMware ESX servers into Vision One. This allows Vision One to see the real-time status of our VMs, including which ones are powered on, which ones are running the Deep Security Agent, and which ones are still running on my on-prem Deep Security server. Vision One provides me with a risk overview, an exposure overview, and an attack overview. This information includes details about credential access, lateral movement, collection impact, and suspicious mail forwarding rules.

We have our Azure system for Office 365 and on-premises Azure Active Directory also connected to Vision One. This means that Vision One can see all logins to our Azure system and our on-premises AD. I have agents running on our on-premises directory controllers, so this data is also being fed into Vision One. Vision One can also see our Azure domain controllers and our DMZ. I receive alert emails when something serious happens. I haven't received any of these emails since we started using Vision One. However, I receive emails about endpoints that have had files quarantined. The file on the endpoint was too large to move to the main server quarantine, so Vision One just gave me a small error message. Currently, the endpoint protection dashboard shows that out of 19,678 endpoints, agents have been deployed on 13,675. This includes Macs. The dashboard shows one Linux endpoint, which is my service gateway. There are 882 Mac OS endpoints, which is lower than the usual number of 1,100 because not all of them are turned on. There are 12,792 Windows endpoints. The dashboard also shows that 6,003 endpoints have no security protection. These endpoints likely include network equipment, certain Linux servers that are not running Trend Micro software, and proprietary operating systems that are used by our network team and other IT groups. There are also endpoints that are listed in our Active Directory, but they are either turned off or do not have any active systems.

Updates are applied on an hourly basis. If an exploit gets through and an endpoint has not been updated, it will receive the update on the next cycle. The most common reason for an endpoint not receiving an update is a network issue or the endpoint being powered off. Once an endpoint goes online, it is configured to automatically retrieve security updates from the server, or directly from Trend Servers over the internet if the server is unavailable. The first thing the endpoint does when it goes online is update its security patches, signatures, and scan engines. When a detection is made, the endpoint first deletes the file and quarantines it. It then blocks the action of whatever the file was trying to do. The endpoint's virtual patching, behavior monitoring, and predictive machine learning then stop any unusual activity. This may even include an activity that is supposed to happen. We have had members of our ICT department complain that they were unable to install software because the antivirus protection was blocking it. In some cases, we have groups within our organization that are responsible for maintaining their own servers. When they are doing upgrades, they may schedule us to temporarily disable the antivirus protection so that they can complete the upgrade. Even if malware does not get detected by the web reputation system and is downloaded by a user, it may still be detected by the signature-based malware detection system. If it is not detected by either of these systems, it may still be blocked if it tries to contact its master. These master addresses are often common addresses on the internet that are used by bots to communicate with a server that is maintained by the threat actor. If a bot is blocked from contacting its master, it will be unable to function. If we see a large number of bots being blocked, we will investigate the system to see what is causing the issue. In many cases, it turns out to be a legitimate activity that is being blocked by the system. For example, we may have custom scripts running on certain servers that look suspicious to the system. We can manually whitelist these scripts so that they are not blocked. Overall, the system is designed to be overprotective. This is because it is better to block something that is legitimate than to let malware through. We can always fix a false positive, but it is much more difficult to fix a security breach.

I started using One Endpoint Security in August 2020. I learned how to move agents, install software, and get the agent onto the server. I also learned from the documentation, knowledge base, forums, and other users. I found One Endpoint Security to be more difficult to learn than PaperCut because the terminology and concepts are different. PaperCut is just about printing and monitoring, while One Endpoint Security is about cybersecurity. There are also many caveats to consider with One Endpoint Security. I found the scan settings to be particularly challenging. Trend Micro has helpful best practices documents, which I used to learn what the normal settings are for servers and workstations. For example, servers don't need to be scanned for office document exploits because they typically don't have Office installed. I also learned that it's important to balance security with performance. We don't want to scan servers so heavily that it slows them down, but we also don't want to skip important security checks. In January 2021, we changed our policy on security settings. We now tell users that if there are any problems, we will fix them. We would rather have a small problem that we can fix quickly than have to restore a server from backup, which can take days.

One Endpoint Security provides virtual patching, also known as vulnerability protection, to protect against vulnerabilities before they are exploited. Deep Security and Workload Security call this feature intrusion prevention, but it is essentially the same thing.

Workload security now has a feature called Activity Monitor for each endpoint. This is a free version of their Endpoint Basecamp product that is automatically installed with every One Endpoint Security agent. Even if we are not licensed for Endpoint Basecamp, it will still be installed. On the servers, I had to remove the Endpoint Basecamp and then deactivate and reactivate the workload security agent to get the Activity Monitor working properly. However, I am glad that we get free monitoring for our servers, even though we do not get it for our workstations.

The agent program version column in the agent screen, we could never sort by. It's so handy to be able to sort by that now. We can go to one end of the scale to see the lowest agent version, and then go to the other end to see how many are updated to the latest agent.

Microsoft's new Azure Code Signing is causing a lot of issues for us with One Endpoint Security. We currently have two systems in operation, on-prem and SaaS, and many of the agents won't upgrade beyond version B11564 because these newer versions require Azure Code Signing compliance on the endpoint. If we are not up to date with our Windows updates, we don't have this compliance. Irrespective of the Windows version we are running, we have to apply patches to the machines, if the OS is not damaged, to make them compliant. After that, we can upgrade to the latest version of the respective agent. This process also applies to both Deep Security and Workload Security.

I have two production servers: one for Windows and another for Mac. These servers are available in both on-premise and SaaS versions. Additionally, I have a test server that is located on-premises. The significant distinction with the SaaS version is the absence of a test server where I can install a new version. This means I can't allow the agents on it to upgrade and then perform testing. In contrast, with the production SaaS version of One Endpoint Security, I have numerous agents transitioning and coming online. It's essential that these agents upgrade to a newer version. Among these agents, there are five or six different versions, not counting the really old ones that have yet to upgrade due to ACS non-compliance. I can't leave the testing phase for an extended period because I still have outdated agents that need to be updated. These agents can't be left hanging while I wait to test the newest version that has just been released. New versions seem to come out every couple of months in the SaaS environment. In the past, when I solely used the on-premises version, I would review security bulletins for the SaaS version to identify any issues. I'm apprehensive about potential future situations involving this, primarily because the majority of our agents now operate on the cloud version. If a problem is discovered, rolling back on those agents would be challenging. It would require careful operation to revert them to a different version.

The on-premises version of One Endpoint Security has an update function that allows us to manually update a bunch of servers. For example, if I just turned on a policy, I can force the agents to quickly download the policy and start following the update procedure or update settings. However, this function is not available in the SaaS version. This is because the system cannot communicate with the agent through the firewall. The SaaS version has an automatic update function and an update source entry in the update agents sub-menu, but it does not have a way to force agents to update. This is a problem because we cannot automatically update the agents. We have to manually log in to the machines and give them an update command. Currently, we have no choice but to wait until the agents find the updates themselves.

I have been using Trend Micro One Endpoint SecurityOne for three years.

I have the enterprise version, so I can usually talk to someone in the Philippines even during after-hours. I only do this when it's something that can't wait until the next day. If it can wait, I'll let it go until then. But if something is broken and needs to be fixed right away, I'll get in touch with the Philippines team. They have some good people there, and the support is really good. I think Trend's support is probably the best of any of the vendors I work with.

I have a few open tickets, and one of them involves the developers. They keep coming back to me with questions that they have passed on to the service representative I'm working with. The developers want to know why I'm seeing something that they think I shouldn't be seeing. I'm generating a report that is supposed to show me all the endpoints on our workload security server that do not have agent self-protection enabled. This is part of the Vision One report. One of the endpoints that the report identifies is our service gateway. It is running Ubuntu Linux and has a Deep Security agent installed, but agent self-protection is not enabled by default. There is a way to enable it, but it's not typically done for Linux systems. Agent self-protection prevents unauthorized configuration of the Trend Deep Security agent service settings. This means that we can't change or stop the service without first disabling agent self-protection.

Positive

I would rate Trend Micro One Endpoint Security ten out of ten.

My concern arises when an endpoint lacks One Endpoint Security, as we are not actively monitoring for this. While we possess a scanner, this is why I intend to maintain the on-premises system's functionality. I plan to transition away from the deep security system and migrate the application team to the cloud version, although this transition process is currently pending. I need to retain the on-premises One Endpoint Security primarily for assessment scanning purposes. This involves scanning all items listed in our active directory, along with the subnets for our VPN, to identify unprotected endpoints. During a recent scan, I identified nine such endpoints and proceeded to install the agent on them. Occasionally, there are instances where the agent won't install, but no error message indicates a connection issue or existing installation. Some of them show as not having the agent installed, even though they do, which can happen when the endpoint is booting up during the assessment scan and the agent hasn't yet been loaded. Resolving this is relatively swift, although there are instances where devices not compliant with ACS will trigger a message stating that the agent cannot be loaded. These devices are then flagged, and I work on making them ACS-compliant to ensure proper agent protection.

The noteworthy aspect of One Endpoint Security is that we didn't begin using it extensively until the third quarter of 2021 when vulnerability scanning was initiated. Although we had an Central server, we were not using any policies on it. To enable Vulnerability Protection, we needed to implement endpoint policies in Central. Vulnerability protection involves virtual patching, where regular scans check our operating system's vulnerability to known exploits. It also includes monitoring applications for vulnerabilities and guarding against those vulnerabilities until they can be patched. This process is largely automatic, as the rules to counter cyber threats are introduced until the system is patched, at which point they are removed automatically. In contrast, on the Deep Security side, I need to execute this process manually. A weekly automated scan takes place, followed by an emailed report. This report aids in identifying missing policies or necessitated rule adjustments based on scan findings.

We have to constantly monitor the systems to make sure it is okay. I have email alerts coming in from Trend Micro One Endpoint Security, and Central Systems. I have folders for workload security, deep security, and Trend Micro in my inbox. I check these folders even when I'm not online to make sure there are no major alerts. In a way, this gives me peace of mind. As long as the agents are running properly and there is enough memory and disk space, everything is fine. However, I still have to manually check the System Event Log to see if any One Endpoint Securityendpoints are running out of memory or disk space. We also use SCCM. I set up a scheduled script to create a report of all endpoints with less than 1 gigabyte of disk space. I put this report in a folder that is accessible to all of our school techs and team leaders. This way, they can check the report periodically to see if any endpoints need to be reimaged or have some garbage removed from the disk.

We normally use it as an antivirus and antispam solution. We use it to block USB ports on PCs and do other things like that.

By implementing Trend Vision One Endpoint Security, we wanted to block all the USB ports on the computers. That was our first target. We also wanted a centralized system where we could track and see all the computers at the same time.

It is a tool that is required for our company's security. There were some cases when the software brought it to our attention that we received some documents with malware that we should not open. It blocked the threat. It is very important for us.

Trend Vision One Endpoint Security has advanced protection capabilities that adapt to protect against unknown and stealthy new threats. The ability to adapt to protect against unknown and stealthy new threats is very helpful. We do not need to be concerned with some threats because it is blocking them. It is easy for us to track all the changes. We cannot install some of the applications by ourselves. We need to get approval from the top company.

Trend Vision One Endpoint Security can detect ransomware with runtime machine-learning capabilities. We do not need to be very concerned about attacks because the software is blocking them and protecting our machines internally. It also automatically sends reports.

It provides us with a single console for cross-layer detection, threat hunting, and investigation. We can have just one console and one system to track all the attacks and threats we have. For us, it is a matter of opening just one system and not navigating through a lot of systems to check what is happening. Everything is consolidated in one console. It saves time.

This single console does not provide end-to-end visibility into the entire IT security environment because we have another one for web filtering. Apex One is there as an antivirus and anti-malware solution for protection from threats.

We have integrated One Endpoint Security with Active Directory. It saves a lot of time for us. It is a worldwide solution. It saves a lot of time and a lot of work, especially for IT.

One Endpoint Security gives us the track for the attacks, and we can prepare our end users to be alert about the threats. We can also give them training.

One Endpoint Security is easy to learn, but when it comes to administration, it is not the easiest tool. It requires some adaptation to the system. Especially, if we do not use it every day, we tend to forget how to go to the system and obtain all the results that we need. It is average in terms of working with the system. It is not the easiest one.

It does not take much time to realize the benefits of One Endpoint Security. After we install the software, all the information automatically pops up on the console, and we can track everything from there. Because it is integrated with Active Directory, it is an easier way of managing the work.

It provides us with virtual patching to protect against vulnerabilities even before a patch is available for the source of the issue. This virtual patching is important.

It gives us safety. In spite of the training, users can forget and click on something they should not. We need the security that One Endpoint Security provides.

There has been a reduction in the alerts that we see. We still get some alerts, but not as many as we used to have before moving to One Endpoint Security. There is about a 75% reduction in alerts.

One Endpoint Security reduced the workload. It is integrated with Active Directory. It is much easier to manage and be aware of any threats. It has reduced about 85% of the workload.

Trend Vision One Endpoint Security saves a lot of time in configuration and management.

It is updated automatically without much intervention from our side. We can also get some reports easily.

The menus can be more user-friendly or easier. For example, if we want to enable access to the USB ports, it should be more user-friendly. It is not easy. We need to navigate through several menus to be able to give access.

I have been using Trend Vision One Endpoint Security for the last 5 years.

It is very stable. I do not remember any issues with One Endpoint Security over the last year. For us, it is very stable.

It is good. Most of the time, we do not notice any changes or upgrades. For us, it is straightforward. 

We do not have plans to increase its usage by a lot.

I have interacted with them just for updates, etc. My interactions were not a lot on the technical side. I would rate them an eight out of ten.

Positive

We had Trend Vision locally installed, and it was advised by the company to change to the Trend Vision One Endpoint Security. We wanted to centralize the corporate office.

Before that, I used Kaspersky. In a different company, I also used a cloud-based and centralized solution where we could track all the machines. Before that, I used to work with McAfee, but it was not centralized. It required individual management.

I was involved in the local deployment of One Endpoint Security and not the corporate one. We have several offices, and I was just involved in this one. It was straightforward.

It took five days because we had to go to all the computers and implement it one by one, but we did not spend the whole day just doing that. We were doing it in phases and by departments.

In terms of maintenance, we had to change the version. It took two or three days to perform the change.

We had two people for deployment. We deployed it across multiple locations.

Overall, I would rate Trend Vision One Endpoint Security a 9 out of 10. It is one of the best solutions in the market. It gets integrated with Active Directory. It is on the cloud. It provides good protection from threats and viruses.