Trend Vision One Reviews

We have been in contact with Trend Micro for a very long time. We have a Domino server, which is the alternative to an Exchange server, and we have implemented their virus scanner there. Because of that, we decided to stick with the company and integrate Email Gateway Protection as well. It is important for us because we host our own mail server, and we receive a huge amount of spam. The goal was to reduce that. So far, we have reduced our email traffic by almost 50%—thanks to email filtering. This means our employees do not have to handle those emails anymore.

We receive around 1,000,000 emails per year and 500,000 of those are junk. That was a key factor in saving work time. Every email that lands in an inbox has to be handled—either deleted or responded to. We tested this with different employees and found that deciding whether an email is relevant or junk takes about 10 to 15 seconds per email. With 500,000 unnecessary emails, you can imagine how much time we are saving company-wide.

Another major reason we implemented this solution is phishing emails. This is a huge issue. Trend Micro offers phishing awareness training, but ideally, these phishing emails should not even reach our company, as they are highly dangerous. So far, Trend Micro has filtered out around 3,700 phishing emails for us.

There is another extremely dangerous issue—malicious software hidden in attachments. If an employee clicks on such an attachment, files could get encrypted. In the past year, Trend Micro has intercepted 60 such cases, meaning 60 incidents where our files did not get encrypted.

This is why we use this solution. Of course, there are other providers, but we find Trend Vision One's interface very user-friendly. We also have a dashboard where we can track everything and pull these statistics.

In Germany, such a security solution is very important. Due to a change in the law, company management is now obligated to ensure that IT security is based on best practices. If they fail to do so or are unaware of their security status and neglect it, they are now personally liable with their private assets. I also need a tool that allows my management and board to monitor our security status. One of the reasons why we chose Trend Vision One was that it provides the option for the board to check the dashboards. This means that every morning while having coffee, they can see the security status of the company on their phones. They can also ask, "Hey, why is our security score high? Is our IT department not working properly? Or do we have a real problem that requires additional software or other measures?" Additionally, negotiations become easier for the IT department, for management, and for us. If security gaps arise, we can say, "Hey, we need software or an investment of a certain amount." We now have a solid foundation for our case.

We use email security and endpoint protection. Endpoint protection is installed on every computer and server, with enhanced sensors on the servers. These security tools are crucial for us—without them, we would be blind in IT. They allow us to monitor the health of each system and user activity, including preventing access to inappropriate websites.

We have a lot of remote work, and we used to struggle because we could not properly monitor devices outside our network or firewall. Now, we can control things like applications, websites, USB sticks, and external hard drives, which was previously impossible. A key feature of our endpoint protection is that if a computer reaches a certain security risk score, it is automatically blocked by the software. This means that if an attack occurs, the affected computer is isolated from the network, preventing further spread.

Our biggest challenge is not direct hacking attacks—our company is not a high-priority target. Instead, phishing emails are the main issue. These emails attempt to trick employees into making fraudulent payments or providing access to our systems, allowing ransomware installation. Email security is our biggest focus area.

It has significantly reduced email volume, which is crucial, especially for our security team, as they do not have time to review every message. IT also receives fewer inquiries about whether emails are legitimate. Additionally, phishing training has helped—our employees recognize phishing attempts better, and our click rate on phishing simulations has dropped to zero. Previously, conducting a phishing simulation would have cost €2,500 per test, but now, we can run one or two tests per month at no additional cost. This provides great value.

It is important for us that Trend Vision One has AI built into its platform. It is essential for detecting abnormalities quickly. Humans may not notice certain threats, but AI can. However, AI is not perfect and sometimes lets suspicious emails through, which we then manually review in quarantine. AI is constantly learning, and the more it improves, the less manual intervention is needed, which is beneficial for us.

We now have visibility. Previously, we were blind and could not assess our security status.

Trend Vision One helped reduce our time to detect and respond to threats. Previously, we relied on reading security forums and websites to identify vulnerabilities. Now, we get real-time alerts and can take immediate action.

Our speed has increased significantly. We can update and patch security threats daily, whereas before, it took weeks or even months.

Trend Vision One has helped our organization reduce its cyber risk, especially through endpoint protection. For example, our field employees used to connect unknown external hard drives, which posed a risk. That is no longer possible, eliminating a major threat vector.

Trend Vision One has helped consolidate our use of security vendors. Previously, we only had basic endpoint protection from another provider, which we replaced with Trend Vision. We now have more security software, not less, because our company has grown significantly—from a small business to a mid-sized enterprise. The IT department was lagging behind, and security was not a priority. Now, we manage everything with one provider, rather than multiple vendors.

Our primary use case is to secure our endpoints and servers via Managed Detection. We secure them using XDA and Trend Micro’s SOC. We secure it based on behavior so that we have someone to respond if there are unusual issues with PCs, even on weekends and holidays when we’re not onsite, and then they inform us. That’s why we chose Trend Vision One.

We have it deployed on all of our PCs, both Windows and Linux laptops.

The security coverage is very important for my company's network. It is a requirement under the NIS2 directive, which is now coming into effect in the EU. The coverage is also important for us because we operate 24/7, but our IT staff is not available around the clock. To fill this gap, we opted for Trend Micro’s XDR solution. Trend Micro’s SOC team can respond even when no one from our team is available.

They also make sure we are properly notified because if an email comes in at 3 AM on a Sunday, no one will read it but if Trend Micro's SOC team calls, someone will check immediately. That’s why we chose this solution.

The security coverage is also particularly important for us because, as a hospital running 24/7, we must ensure the security of patient data and maintain the IT infrastructure's operational capability. If our systems go down, it could directly impact patient treatment. Around 10 years ago, before we had Trend Micro, we experienced an attack and our IT systems were down for an entire week. That was incredibly difficult.

With increasing digitalization and more medical processes relying on computers, doctors need easy access to X-rays, prior medical examinations, and other records. Since all of this data is stored digitally, solutions like Trend Vision One become even more essential. Availability must be guaranteed, and we cannot afford a situation where a system gets attacked and taken down. That’s why it is crucial for us to have this protection in place.

The biggest security challenges in my organization are:

1. Preventing unauthorized external access.

2. Reducing the risk of employees unknowingly giving attackers access to the network due to inexperience.

That’s why we use these solutions, in combination with Apex One and Deep Security, to prevent such incidents. If a user mistakenly clicks on something they shouldn’t, the system can respond immediately and prevent damage before it occurs.

With Trend Micro Vision One we now have a comprehensive overview of our entire network of all of our endpoints and Active Directory. We also have an industry comparison feature that allows us to gauge our security status.

For example, our advisor recently reviewed our security score and confirmed that we are in a good position. That gives us peace of mind.

Our use cases are essentially all the classic defense mechanisms that are used to protect devices, secure emails, and ensure that we don’t pull in anything harmful. We also monitor Internet and Intranet traffic to detect abnormal behavior and address it. This has helped us in many situations where we’ve faced external attacks, which then usually try to go back out. I always say that they try to drill through the wall and get back out, and in that way, we’ve been able to recognize when someone has gained access to our devices. 

We operate in 60 countries with 4,000 to 4,500 employees, of which nearly 2,000 are based in Frankfurt. All of the end devices of our colleagues are under IT security monitoring. The Deep Discovery Inspector is implemented at three global locations: one in Europe, one in Asia, and one in the USA. This allows us to detect any issues early on, and with network segmentation, we can minimize potential damage in case of an incident.

The biggest security concerns in our industry are not really industry-specific but are intrusions. Identity theft is a challenge and then there are issues where people are manipulated into making money transfers to what seem like customer accounts that don’t actually exist. 

Another is the classic attack, where ransomware is used to infiltrate systems and gain access through encryption and similar methods. 

Additionally, we also have the issue of IP protection.

Trend Vision One has significantly improved our company because we can now track and see how many attacks we have. Since we’ve implemented it, we haven’t had any major attacks that have successfully entered the company. So, we know the defense mechanism is working.

In terms of our ability to manage risks, we already had the stances for risk management in place, from our side, from a purely conceptual standpoint. Through a solution like this, we always want to get a more concrete approach for the operational side. We aim to identify and assess risks and then determine the measures we can take to mitigate those risks. That’s where Trend Micro is very helpful.

Trend Vision One has significantly helped reduce our time to detect and respond to threats. 

In terms of whether or not Trend Vision One has helped my organization reduce noise from false positives, it’s always a matter of perspective in terms of whether or not the number of alarms has truly been reduced or if they were false alarms. We rolled out the solution across the company, and as a result, we now monitor more devices and have a more comprehensive view of security. Therefore, the number of alarms and false alarms has certainly increased, because we are now looking at all devices. Previously, we didn’t monitor them, so we didn’t notice them.

We have always seen alarms and false alarms. However, we have incorporated mechanisms to identify where the false alarms are coming from, and we continuously refine the system. Sometimes, activities in the internal IT administrative area trigger alarms that are not actual threats, and we continuously adjust and refine those rules to reduce false alarms. We didn’t have a solution in place before to compare whether or not it has reduced false positives. The mechanisms we have now allow us to assess both alarms and false alarms in detail and, in the case of false alarms, to trace where they come from and implement rules to prevent them from happening again. 

Trend Vision One has definitely reduced my organization's cyber risk. We took a holistic view of all devices, became more aware of IT security risks from the outset, and then integrated all devices into that view. In the incidents we encountered at the beginning, as we increasingly implemented and observed this solution, a clear path was outlined on how to address and resolve these issues.

Vision One is the primary endpoint security product we use to protect our Macs and PCs. We also use the server product version, so it runs on my servers as well. We exclusively purchase Trend Micro's endpoint products. They have network and firewall products. We were using their email product until last month, and I ended up selecting a different provider. We stayed with them for the endpoint, but I moved off of them for the email product.

Vision One was a big deal to us immediately because we did not have context-aware before. We saw everything we had no idea was happening. It was a big deal three years ago. 

It certainly reduces time to detect because a lot of the time, I didn't have it before. I didn't have that information until it gave it to me. The speed of response helps me know much more about what's happening quicker. They have some improvement to do in terms of automated remediation. It probably makes investigations 30 percent faster because of what it puts together. 

We use Trend Micro XDR for rapid response to end-user computing and security concerns.

As a health system, one of our core challenges is ensuring full visibility into our attack surface. We have many thousands of endpoints and end users that must be properly secured and protected. Our primary use case was to improve visibility, and response time, and reduce complexity. That is why we chose Trend Micro XDR.

Trend Micro XDR is deployed on Trend Micro's private cloud.

We are using Trend Micro XDR on our endpoint and server infrastructure. The coverage is extremely important to our organization.

Trend Micro XDR provides us with centralized visibility and management across protection layers.

The centralized visibility and management across protection layers have helped our efficiency. The most significant advantage is that we used to manage these platforms with three or even five engineers, and now we're managing them with one.

It is extremely important to us that we can drill down from the executive dashboards into XDR detections. This provides us with the single pane of glass view that I mentioned previously. Being able to see at a high level that there may be systems that are behind on patch levels or need additional service or support, and then being able to drill down specifically to an individual machine, which may be unique in our environment, is very helpful.

We use the risk index to evaluate ourselves holistically, including our performance against best practices and security, as well as our performance against other healthcare systems around the world. This allows us to identify areas where we may have vulnerabilities or where we are particularly strong so that we can focus on improving in the areas where we need to.

Trend Micro XDR has helped us improve our resource utilization through automation, reducing manual effort and enabling faster response times. In under a week, we had tuned our environment to perform optimally.

Trend Micro's Managed XDR service has significantly reduced our team's workload by nearly 50 percent, providing a big improvement in our overall threat intelligence and endpoint security.

The Managed XDR service has enabled our team to work on other tasks. This additional availability for our staff has allowed us to reduce our need for contractors. If we are overburdened, we will hire contractors to assist in other areas of the business. However, because we have become more efficient, I have been able to hire some of those contractors and reduce the burden of contract labor.

Attack surface work management capabilities have been extremely valuable. The user and identity services provided by CREM help us to focus on and improve visibility into end-user behavior, including that of endpoints such as laptops and desktops, the network, cloud infrastructure, and applications.

The ability to detect our blind spots has significantly improved our security posture. Seeing everything clearly in a single, easy-to-understand dashboard allows us to allocate our resources directly to where they are needed most, enabling us to respond faster.

The biggest advantage of Trend Micro XDR is that it has helped decrease our time to detect and respond to threats by around 50 percent.

Trend Micro XDR has helped reduce the amount of time we spend investigating false positive alerts by 60 percent.

Trend Micro XDRs automation capabilities save us around ten hours per week. 

As a security architect, I design solutions for our end customers. In previous projects, we've successfully implemented Trend Vision One for customers with cloud-based assets and email servers, enabling them to extend security coverage to their remote clients.

The current market trend in email security solutions focuses on mitigating threats like phishing attacks. These widespread attacks occur across various points in the cyber kill chain process. Whether initiated from the perimeter or targeting cloud-based assets, monitoring all north-south and east-west traffic is challenging. Trend Vision One helps by providing a comprehensive analysis of these email phishing attacks, identifying the attack origin, parameters, and information extracted from attack patterns.

Trend Vision One offers centralized visibility and management across all protection layers. This comprehensive view provides valuable information for CISO/CIO presentations, including attack patterns, threat actors, and areas for predictive analysis. Such insights are crucial for informing policy changes and other security enhancements. The visibility also helps with efficiency.

We can summarize any technical information we receive using widgets and then present it to executives in a dashboard format.

Our customers adapt the risk index feature to align with the specific needs and conditions of their individual environments.

We have used Trend Vision One in several projects where our customers consolidated security across hybrid environments. The consolidation effort, particularly utilizing Vision One's AI-driven features, streamlined investigative analytics. Furthermore, merging multiple solutions into Vision One provided comprehensive insights, which proved invaluable for policy development.

The ability to manage risk and maintain visibility has improved by approximately 20 to 30 percent, significantly simplifying our tasks. Operationally, this has led to a 20 percent reduction in effort.

Trend Vision One has helped reduce detection and response times by 30 and 40 percent, respectively.

Trend Vision One has saved more than a week's worth of effort in investigating false positives.

Trend Vision One's automation capabilities have helped us save between 60 and 100 hours monthly. 

We primarily use Trend Vision One for its XDR capabilities, email security features, and MDR services offered through ServiceOne. Leveraging these Trend Vision One products allows us to provide robust security solutions to our customers.

My customers range from small non-profits with 40 endpoints to large enterprises with over 2,000 endpoints across diverse sectors, including energy, manufacturing, finance, and software.

Vision One possesses machine learning predictive capabilities that have already proven effective. In the past week alone, it detected and blocked two scans for unknown threats. This capability is crucial, especially since our predominantly Canadian customer base faces an elevated risk of cyberattacks from China due to the recent government-level ban on TikTok. Consequently, we anticipate an increase in attacks. Trend Vision One boasts the largest zero-day initiative, renowned for its proficiency in detecting such threats.

The single console in Vision One streamlines cross-layer detection, threat hunting, and investigation, incorporating sandbox analysis and log search capabilities. It allows for endpoint isolation, remote shell establishment, and integration with tools like Active Directory and Microsoft Entra ID. Automated playbooks enable actions such as endpoint isolation, custom script execution, forensic investigations, user lockouts, and password resets, all of which are customizable. This automation is crucial for containing threats outside of working hours, as playbooks can be configured to automatically execute actions based on specific criteria, mitigating damage before staff return.

The single console provides comprehensive visibility across the entire IT security environment, including endpoints, cloud activity, workflow protection, email protection, and mobile device management, all within a single, unified platform.

Trend Vision One integrates with a range of security products, including various SIEM solutions, vulnerability management tools, and select firewalls. A comprehensive list of compatible products is available on Trend Micro's website.

Trend Vision One is relatively easy to learn for those with some security background. While first-time users may find it initially confusing, abundant learning resources such as YouTube videos and comprehensive documentation are available to help users quickly familiarize themselves with the platform.

Some of my customers maintain hybrid environments, and Trend Vision One enhances visibility by consolidating all systems into a single platform.

Trend Vision One has malware scanning capabilities, allowing it to detect, quarantine, and block malware effectively.

Trend's Managed Detection and Response service provides continuous 24/7 monitoring, effectively reducing staff workloads by eliminating the need for in-house security monitoring.

Trend Vision One improves my organization's visibility by consolidating security functions into a single console. These capabilities enhance our security operations, making it easier to manage threats.

We use Trend Vision One for the XDR and we absolutely love it, especially the full visibility into protected assets. It's incredibly easy to identify weaknesses across systems and manage any outdated software or areas needing attention directly within the user interface. Previously, we juggled multiple dashboards, but the new version has streamlined everything into a single, unified dashboard. This has significantly simplified our workflow and improved manageability. In essence, we can now manage multiple products seamlessly within the same Vision dashboard, which is a considerable improvement over the previous system. This year has brought significant and positive changes to our workflow.

We use XDR across Office 365 in the cloud and on-premises environments to safeguard our assets. This includes protecting our server environment, workstations, and Virtual Desktop Infrastructure, ensuring comprehensive endpoint security.

Our deployment utilizes a hybrid model, making agent deployment incredibly simple. We employ several different deployment methods: on-premise deployment through Active Directory and utilizing various tools. In case a system leaves the network for any reason, we have third-party solutions in place. We have multiple RMM solutions that can be rapidly deployed in these packages. For example, I've recently observed systems being spun up and sent home before antivirus protection was activated. We still have the opportunity to deploy these solutions in the cloud automatically. So, we have a few ways to work around this and deploy those agents, making it easy to deploy either on-premise or in the cloud. We can address several scenarios and push out to those endpoints.

Coverage is extremely important. We want to ensure visibility into all assets across the network, whether it's a workstation within the office or someone working remotely. This visibility is crucial even when they're outside the network or using cloud-based software, especially since we have no on-premise infrastructure. With the rise of remote work, having this extra visibility into devices, whether at home or abroad, is invaluable. We appreciate the ability to see what's happening on any asset, regardless of its location. This allows us to monitor running processes, identify vulnerabilities, and push necessary updates, ensuring we maintain connectivity and security no matter where devices are operating.

Trend Vision One offers us comprehensive visibility within a single dashboard, which is crucial since we manage numerous other products and security solutions with various dashboards. The simplicity and centralized visibility provided by Trend Vision One significantly streamline our operations. Managing a multitude of security products across our environment necessitates consolidated visibility to minimize back-and-forth navigation. Having all the necessary information in one place is essential for us.

We use executive dashboards to generate weekly or monthly reports that provide a risk score index. This index helps us identify areas needing attention and understand the teams' focus. We then share this information with IT senior management. In addition to our reporting, we receive a monthly report that allows us to compare our current status to the previous month's and highlight new challenges, team weaknesses, and ongoing efforts. This comprehensive view enables the executive team to monitor the team's continuous progress.

We utilize the risk index feature to monitor and mitigate potential environmental risks. One example of this is how we proactively worked to reduce the risk index score of a recently acquired company. Their antivirus product was expiring, so we opted to purchase additional licenses for our existing Trend Apex One product suite instead of renewing it. However, this integration significantly increased the risk index score due to numerous previously unmanaged devices on their network. To address this, we systematically worked through the risk index list, identifying outdated software and determining if it was still in use or could be safely removed. By leveraging the risk index in this way, we successfully lowered the score and ensured the secure integration of the newly acquired company into our environment.

It took some time to fine-tune Trend Vision One before realizing its benefits. A significant concern was integrating it into our virtual environment, a complex process. However, we gained significant visibility once set up in our VDI, leading to further adjustments. We fine-tuned the environment, removing unnecessary elements, which is especially crucial for our non-persistent VDI, where VMs reset if anything goes down. Through these tweaks, performance improved, and the extra visibility provided by Vision One highlighted areas needing attention, allowing us to optimize the environment gradually.

We use Trend Vision One within Azure, expanding its monitoring capabilities to both on-premises and cloud assets, including Active Directory, which is synchronized from our on-premises environment. This hybrid setup covers assets locally and in the cloud, including Office 365, and Trend Vision One effectively manages security across this environment. It has simplified the process, particularly for virtual environments, providing enhanced visibility and flexibility compared to previous products. The additional visibility has been invaluable, enabling us to address previously undetected vulnerabilities and mitigate risks.

During XDR and managed services pen testing exercises, we identified some weaknesses. They were able to automatically crack some accounts. As soon as one system was breached, the managed services team contacted us, escalating until they got a response. We could see their process in action - their steps and what they did in the backend. We provided them with details about the events and the ongoing pen test. It was an excellent test to see that the managed services worked as intended. There was a breach; they asked if we were aware and stated they would isolate the device if we weren't. We acknowledged we knew about the ongoing pen test. Throughout these exercises, they reached out immediately, demonstrating their focus on alerts, their process for triaging them, and their communication with clients.

The attack surface is directly related to exposure and risk. Any identified vulnerabilities, such as outdated software like older versions of Office or Google Chrome products, are flagged immediately. We use third-party solutions to address these issues across all workstations. Whenever we detect internal or internet-facing exposure, we prioritize remediation based on criticality. External-facing vulnerabilities are patched first, as they pose a greater risk than those affecting only internal assets. We rely heavily on exposure risk and risk index to determine priority and ensure the most critical vulnerabilities are addressed first. This helps us identify blind spots in our environment. Take the new acquisition as an example; many devices were unprotected and lacked crucial Windows updates. Numerous products and workstations required immediate attention. Security wasn't the initial priority, so we addressed that and ensured it became one. We implemented numerous changes with acquisitions to align them with our security standards.

Trend Vision One has significantly reduced our mean time to detect and respond to threats by 60 percent. It centralizes all information, enabling us to identify and address vulnerabilities quickly. For example, if we discover multiple devices running an outdated version of Office 2013 missing patches, we can easily compile a list of those devices and share it with the responsible team for remediation. This visibility allows us to proactively address weaknesses across the network, such as deploying updates or the latest release of third-party software to mitigate risks. Trend Vision One has been instrumental in enhancing our overall security posture.

The managed services significantly reduced the time we spent investigating false positive alerts. In uncertain scenarios, we consult the managed services team. If unsure about anything, we use the AI companion for questions. If we encounter an unfamiliar flag or event, we research it independently and involve the managed services team's professionals for deeper investigation.

We have implemented some automation but haven't fully explored its capabilities. We have a few playbooks for tasks like blocking user access based on IP addresses or email content. Since we use Office 365 in the cloud, there's also a lot of automation for handling incoming emails, such as blocking and sending alerts. While we've used playbooks to a limited extent, there's potential for further automation, and we plan to explore this further.