Many clients come to us after they have been attacked by ransomware. They often ask us to immediately remediate the situation, but this is not possible once a system has been compromised. However, we can usually install Trend Micro Apex One or a Cloud One product right away. This is our standard response to these situations.
Most of the clients I work with are hospitals. They have been using a different endpoint security solution, but they were attacked by ransomware and reached out to us for a different solution.
In one of the use cases we worked on, we simply installed an endpoint security solution. During the proof of concept, the hospital actually encountered a ransomware attack. There were two systems that were attacked: our test PC running Apex One and the other that was using the existing endpoint security solution. The Trend Micro-installed PC was able to navigate the attack, but the files on the other PC were corrupted.
We also simulate other attacks, such as ransomware or simple malware, using the Intelligent Content Analysis and Response tool. We then check the Device Control feature. Apex One also has data loss prevention and application control features. The DLP feature is not as comprehensive as a full-blown DLP solution, but it can be used to leverage regular expressions, specific keywords, and specific attributes. We also test the application control feature.
Our most recent testing has been with the new Vision One product. This is an extended detection and response platform that can be integrated with not only Trend Micro's other solutions, but also with other security solutions from different vendors, such as SIEM, firewalls, NDR, and vulnerability management systems.
When we test the integration of Apex One and Vision One, we focus on automation, remediation, and cost analysis. We can see how an attack was carried out, down to the file level, hostname, and user. If Vision One is integrated with Active Directory, we can also see who the user was at the time of the attack.
This is the scope of the usual use cases we perform during proof of concepts for Trend Micro Apex One.
I would rate Apex One nine out of ten for its ability to defend endpoints against malware, ransomware, and malicious scripts.
Apex One can defend against zero-day attacks and stealthy attacks. This is important because in-house applications can have many vulnerabilities, such as coding errors and misconfigurations, which attackers can exploit. Having Apex One as an advantage would give clients a head start in defending against unknown threats.
It uses runtime machine learning to detect ransomware. Machine learning allows us to monitor activities and suspicious behaviors running in our system, not only at the file transfer level but also at the library and registry level. This is important because it allows us to identify potential threats. Runtime machine learning can see any entry points that ransomware might use to infect a system.
Trend Micro has announced that they will be migrating the Apex One platform to Vision One, which can be integrated with an XDR.
Our clients have integrated Apex One with a vulnerability management firewall, SIEM, MFA solutions integrated with Azure AD, and the native security of Microsoft 365.
Apex One is user-friendly. For those familiar with an endpoint security solution, it will not be difficult to learn Trend Micro Apex One. However, for those who are new to the solution, they will need to take some time to learn the ropes.
Administering Apex One is straightforward, especially for the SaaS solution compared to the on-premises solution. This is because we only need to download the installer. The installer is large, around 400 MB. Once we install it on the system, we can communicate with the management console, which is the same for both solutions. We just need to make sure that all required communication ports, FQDNs, IP addresses, and ports are allowed on the firewall. We usually take into consideration the clients when we are doing POCs, and we need to work with the infrastructure team to check on this.
Apex One provides our clients with virtual patching to protect against vulnerabilities. From the perspective of an impending threat, if a client is able to patch the vulnerability in the meantime, Apex One can see the potential threat and take action to protect the client. This is done by identifying the signatures of the vulnerability and creating a virtual patch. It is important to make sure that clients understand that this is not an official patch, but rather a temporary measure that can be used while the official patch is being developed and applied.
Before using Trend Micro, many of our larger clients, which are hospitals, were constantly attacked by malware. However, after adopting Apex One, the viruses and malware have been significantly reduced or eliminated altogether. This is why they continue to renew their subscriptions to Trend Micro.
Most of the time, we recommend the SaaS version of Apex One because the on-premises solution from Trend Micro requires significant resources from the client. If they do not have the necessary monetary resources, they will need to take this into account. This is because when we build an on-premises Apex One, we need two servers: one for Apex One on-premises and one for Apex in Cloud. Additionally, if we leverage the entire SPE package, we will also need a server for mobile security and file and drive encryption.
The endpoint deployment in the cloud has helped our clients reduce their staff workload, especially on the maintenance side.
Apex One has helped reduce our client's administrative overhead.
Some of our clients use Trend Micro's managed XDR service and they love it because the automation makes things easier for them.
The ransomware protection and behavior monitoring features of Trend Micro Apex One are actually good. All endpoint security solutions are in the market to defend against and remediate threats. However, Trend Micro is particularly quick to identify suspicious activities. Any malicious virus or malware that can be extracted from the system is something that they can leverage and work on. One way they do this is through virtual patching. Most of the time, vulnerabilities come from legacy operating systems. These operating systems cannot always be updated, such as Windows 7. If Microsoft announces that it will no longer update a specific operating system, there is nothing that can be done about it. However, Trend Micro can anticipate specific vulnerabilities that can be exploited due to the lack of updates. They can then leverage these vulnerabilities to create a virtual patch that can be applied to the specific system. I believe this is one of the many highlights of Trend Micro Apex One.
One of Trend Micro's weaknesses is its high resource utilization. Many of our clients have complained about this, and it is a valid concern. However, we assure our clients that the level of security that Trend Micro provides is worth the high resource utilization. Trend Micro is very fast at detecting and protecting against threats. For example, they were able to identify suspicious signatures for a ransomware attack that was happening worldwide months before the attack actually occurred. We believe that this level of threat intelligence is a major strength of Trend Micro. Of course, no security solution is perfect. There are always ups and downs. However, we believe that Trend Micro's strengths outweigh its weaknesses. However, we do not only offer Trend Micro for this reason.
I have been using Trend Micro Apex One for four years.
Trend Micro has consistently been in Gartner's Leaders Program year after year. Apex One is stable.
The initial setup is straightforward. We usually plan and gather data before implementing. We ensure that there are no residual old endpoints installed in the system. We then set expectations with the client and proceed with setting up the management console. We install the system step-by-step and then work on the policies. We also integrate with other systems and transfer knowledge and troubleshooting skills.
I usually complete the deployments on my own, but for our larger clients with over 2,000 endpoints in different locations, we need to be on-site. For a three-month deployment of those 2,000 endpoints, we allocated three engineers. There was also one time when we had to allocate a lot of engineers for a government agency with eight thousand employees.
The pricing for Apex One is midrange, and worth the costs.
I would rate Trend Micro Apex One an eight out of ten.
All security solutions require maintenance. But with SaaS deployment and SaaS security solutions, most of the maintenance is actually covered by the principal itself.
Apex One can be resource-intensive and have high utilization, but it does a great job protecting our clients' endpoints.