Trend Vision One Reviews

Name: Trend Vision One
Brand: Trend Micro
Rating: 4 (48 reviews)

Vendor: Trend Micro

4.3 out of 5

48 reviews
95% willing to recommend

209 followers

Post review

What is Trend Vision One?

The Trend Micro Vision One platform is designed to extend threat detection and response across an organization's digital landscape. It is crafted to deliver advanced threat intelligence, using a layered approach to protect against a wide range of cyber threats.

Get the Trend Vision One Buyer's Guide and find out what your peers are saying about Trend Vision One, Microsoft Defender for Endpoint, CrowdStrike Falcon and more!

Trend Vision One is the #3 ranked solution in top Network Detection and Response (NDR) solutions, #3 ranked solution in top Attack Surface Management (ASM) solutions, #4 ranked solution in EDR tools, and #7 ranked solution in XDR Security products. PeerSpot users give Trend Vision One an average rating of 8.6 out of 10. Trend Vision One is most commonly compared to Microsoft Defender for Endpoint: Trend Vision One vs Microsoft Defender for Endpoint. Trend Vision One is popular among the midsize enterprise segment, accounting for 38% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a educational organization, accounting for 29% of all views.

Helped 800,688 peers since 2012

Featured reviews

Matthew Guzzi

Information Systems Administrator at a government with 10,001+ employees

The dashboard provides great visibility into our risk profile. We receive a daily email report that outlines our risk score and identifies the machines with the highest risk. This information is based on usage patterns, vulnerabilities, and non-compliance issues. This helps us prioritize which machines require patching or further investigation. Drilling down further, we can analyze how our users are utilizing their workstations, including the websites they visit. While we don't track specific website URLs, we can categorize website types and identify any potentially risky or inappropriate usage patterns. This allows us to proactively address any potential security concerns. For instance, we identified a user who was using ChatGPT for work-related tasks. This flagged our system, and we were able to discuss the user's usage of ChatGPT to gain a better understanding of how our users are working and identify any areas that require additional attention.

Read full review

Jasneet Singh

Cloud Security Engineer at a healthcare company with 5,001-10,000 employees

For our day-to-day use cases, the correlation and attribution of different alerts are valuable. It is sort of an SIEM, but it is intelligent enough to run the queries and intentionally detect and prioritize attacks for you. At the end of the day, it is different data that you see. It correlates data for you and makes it meaningful. You can see that someone got an email and clicked a link. That link downloaded, for example, malware into the memory of the machine. From there, you can see that they started moving laterally to your environment. I quite like it because it gives visibility, so Workbench is what we use every day. They also have something called virtual patching. If you have end-of-life systems or systems that are out of support, you cannot upgrade the agent, but you can still do the update if you get the signature. This is the feature I like. For example, today, if a new zero-day threat is out with a link vulnerability where attackers send you a link, and that link, even if opened in the preview mode, can basically execute a malicious code, we just cannot patch within four or five hours. We are a midsized organization. We are fairly big, and sometimes, it takes two days or even a week. With virtual patches being there and XDR with all that information connected, we can see that the virtual patch is working. It is there. We have all the mitigation in place, but then it is also detecting the environment for that threat. We can further write the hunting queries and enhance detections. So, Workbench detections and virtual patching are very helpful. It also gives us an executive dashboard where we are monitoring our external sites. We can see what ports are open and what known vulnerabilities are being scanned on them. We get visibility and better mean time to respond and act. The user interface is pretty easy to use. Sometimes, you learn it while you play around with it and you set it up. One thing I do like, which is very good, is that you can pivot from within the console to different sections if you know how to go about it, but if you have not used it, it could take a bit of learning. A good thing that Trend Micro has been doing for the last two years is organizing some sort of CDFs, which are scenarios based on real threat actors. They get you to come to those events. It is gamified so they can attract people. If you want to learn, they would show the event ID that came in and where to go and see that event ID. They show you how to hunt based on that event and how to extract the indicators of compromise from that ID. There is a feature called Suspicious Object. They show you how to block one. If you have a suspicious object linked to a threat intel feed that goes to Palo Alto, you can not only block it in XDR or Vision One, but straightaway, it also gets pushed to your firewall, so your firewall is also blocking it now. There are some cool functionalities, but you need to spend time to understand how you would pivot between different subsections. If someone is new and starting, it is still pretty straightforward. The UI interface is very self-explanatory. There are a lot of details. There is a lot of telemetry added to it for you to see and understand. It is not that complicated. If you have a bit of a cybersecurity background, you should be able to pick it up pretty straight. They are constantly updating it, which is a good as well as not-so-good thing. There is an update every few weeks. They are very good updates. I quite like it that they have such an agile development. They listen to their customer's feedback, and they are constantly investing in the product. They do not give you an off-the-shelf product. The world is changing, and the attacks are changing. It is kept up to date.

Read full review

Frank Bunton

Chief Information Security Officer at a healthcare company with 5,001-10,000 employees

Their toolset integrates well with our existing infrastructure. It integrates well with our AT&T AlienVault SIEM. Another piece that makes Trend Micro kind of unique—and I could see where they might have had a problem kicking the whole thing off—is that they were one of the companies, early on, that spent a lot of time integrating their toolsets, and I was really impressed with that. That meant the endpoint management system could reach out to the Deep Discovery system on the network and pick up something that it perceived as a suspicious object. It could then sandbox it and monitor it. If that suspicious entity reached out for command and control or did something nefarious, the endpoints would be alerted and would start getting rid of the problem. The issue this addresses—and it's one of the most important issues—is that you really have to consider automation and be conscious of it. Because when the stuff hits the fan, you're not necessarily fast enough, as a human being, to get everything done the way it needs to get done—and document the process. You might not think about that last piece so much when you start doing security engineering. But when you get into a big healthcare company like ours, there are audits going on all the time. The auditors will want to pick out two or three events that you've dealt with and say, "We want to see the audit trail," et cetera. As a result, there are advantages to the integration of Trend Micro's disparate toolsets. Trend Micro has worked very hard on making their toolsets, like IPS, Deep Discovery, Deep Security, et cetera, talk to each other and work together. And they're still doing it today. They have made their IPS an application rather than an appliance. You install it on the endpoint, which is a server in your data center, and it will actually configure it to a minimal standard. That means the applications and the version of the operating system you're running, right down to the colonel version, get only the tools installed that are needed for that particular instance. They minimize the installation because they don't want you looking for bugs and indicators of compromise that you're not in a position to experience because you're using an operating system that isn't vulnerable to them. That gets rid of a lot of overhead when it comes to server management. They keep in mind that these are servers that have a job to do. They're not just desktops, and if they're eating up a lot of the CPU, that's bad for us because we're out to do business and make money. We've never had a problem with them. It's really reliable, once you get it set up.

Read full review

Valuable Features

Trend Vision One's valuable aspects include comprehensive endpoint protection, effective email capabilities, detailed attack tracking, high detection rates, easy installation and management, seamless network integration, centralized visibility, and management across protection layers. Users appreciate its automation, scalability, reasonable pricing, robust threat hunting, useful Workbench engine, attack surface management, real-time activity monitoring, and third-party integration. Features like risk index, behavior analytics, and policy implementation are also noteworthy. Telemetry data and Smart Scan enhance user experience while reducing investigation time and improving security posture.

"The most valuable feature is how the stack fully integrates all components of a solution."
"It is so helpful to have something that pulls all the data into one visual representation of the events."
"When we purchased Vision One, what set it apart was that it wasn't a traditional signature-based antivirus. It's a process-aware solution that provides real-time protection. That was a big differentiator three years ago, but now it's a given that every AV provider should be doing that. It combines signature-based telemetry with behavioral awareness and a detection-based solution, making it a good solution for us."

Room for Improvement

Trend Vision One needs improvements in reporting features, better integration with other tools, and a more user-friendly interface. There are concerns about slow support and performance issues. Additionally, more maturity, flexibility, and visibility are needed in various aspects. Documentation and integration with third-party tools also need enhancements. Users reported challenges with automation capabilities, administrative overhead, and customization to fit specific needs. Cost and ease of use are also areas for improvement.

"The SOAR features (Security Playbooks) are quite limited."
"Vision One generates numerous false positives, forcing unnecessary investigations and highlighting a need for improved filtering options."
"They need to stop changing Vision One once a week. They're in a hurry to change things so badly and so fast that I can't find where stuff is half the time, which is a challenge sometimes."

ROI

The integration of platforms and automation were seen as key factors for success with Trend Micro XDR. Reviewers emphasized the importance of automating solutions and integrating elements to effectively handle security issues. They highlighted the significance of automation in managing a large number of blocked packets and the need for alerts to point out problems.

Pricing

Trend Micro Vision One employs a transparent pricing model without setup costs, simplifying the onboarding process for users. Typically, pricing is structured around a subscription basis, offering flexibility tailored to organizational needs. Costs vary depending on the scale of deployment, accommodating both small businesses and larger enterprises.

"Vision One's pricing is extremely competitive. They're probably the lowest-cost provider that has this feature set."
"Trend Micro recently switched from a license-based pricing model to a credit system, which caused some initial frustration during my renewal."
"I do not have much visibility to it. It is definitely not a cheap product, but to my knowledge, it is out there with the big wigs in the industry, such as CrowdStrike, SentinelOne, and other EDR/XDR vendors. I had heard, and found out eventually, that their sales teams are very flexible, as more sales teams are."

Popular Use Cases

Trend Vision One is used for endpoint detection, response, and protection, primarily for enhancing security frameworks, monitoring infrastructure, and tracking attacks. It is deployed on-premises and in the cloud, providing centralized control through its cloud interface. It integrates with various systems including Office 365, Azure, and email platforms, and offers features like telemetry reports, behavior monitoring, threat visualization, incident response, and automated playbooks.

Service and Support

The customer service and support of Trend Micro XDR is mixed. Some users have had positive experiences, stating that the support team is prompt, responsive, and helpful. They appreciate that the company listens to feedback and incorporates it into updates and improvements. Regular meetings and communication with customers are also valued. However, there are also users who have expressed dissatisfaction with technical support. They have found the support team to be unresponsive or lacking in technical competency, particularly in complex environments.

Deployment

The initial setup for Trend Micro XDR is generally straightforward and simple. Many users have found it easy to deploy and maintain the solution. The GUI is user-friendly and the deployment process is well-guided. Some users have mentioned the option to deploy on-premises or in the cloud, with the cloud deployment being faster.

Scalability

Trend Micro XDR is highly scalable. Users have mentioned that even with increasing numbers of users in their companies, the solution continues to work effectively. Some users emphasize the need for thoughtful scaling, ensuring that only necessary components are scaled or reconfigured. The solution is capable of handling a large number of users. The scalability is facilitated by being cloud-based and many clients start with basic functionality and gradually expand to access more options and services.

Stability

Trend Micro XDR is highly stable and reliable. Users have mentioned that there are no bugs or glitches, and it doesn't crash or freeze. The stability of the solution comes from being on the cloud, which ensures uptime and accessibility. Despite some features being under development, the overall stability of the product is considered good.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Trend Vision One Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Educational Organization

29%

Computer Software Company

18%

Healthcare Company

Financial Services Firm

Manufacturing Company

Government

Comms Service Provider

Construction Company

Real Estate/Law Firm

Retailer

Insurance Company

University

Hospitality Company

Media Company

Energy/Utilities Company

Wholesaler/Distributor

Non Profit

Legal Firm

Engineering Company

Transportation Company

Outsourcing Company

Performing Arts

Pharma/Biotech Company

Recreational Facilities/Services Company

Compare Trend Vision One with alternative products

Learn more about Trend Vision One

Trend Micro Vision One excels in integrating multiple security layers into a unified platform. It provides real-time visibility into an organization’s security posture, facilitating rapid detection, investigation, and response to threats. The platform includes features like endpoint security, email security, and network security, all managed through a centralized console. It leverages advanced analytics to help security teams prioritize and respond to the most critical threats more efficiently.

What are the key features of Trend Micro Vision One?

Threat Detection and Response: Automatically detects and responds to threats using integrated security layers.
Risk Visibility: Offers clear insights into the security posture and risk levels with detailed dashboards.
Security Posture Management: Helps manage and adjust the security stance with strategic guidance and compliance tracking.

Benefits to Look For:

Efficiency in Threat Management: Streamlines operations by reducing the number of security alerts and the time required to resolve them.
Enhanced Detection Capabilities: Uses advanced analytics to uncover hidden and sophisticated threats.
Proactive Threat Hunting: Provides tools for security teams to proactively search for potential threats before they manifest into breaches.

Trend Micro Vision One is flexible in deployment options, supporting environments like AWS, where it can be integrated to protect cloud workloads, manage compliance, and secure data transfers. This adaptability makes it suitable for a variety of use cases, including protecting against data breaches in multi-cloud environments, securing remote workforces, and maintaining compliance in highly regulated industries such as finance and healthcare.

Trend Micro Vision One is extensively implemented across sectors where data security is paramount, such as financial services, healthcare, and government. Organizations in these industries benefit from its comprehensive threat analysis, minimizing the risk of data breaches and enabling a robust defense against advanced persistent threats and ransomware.

In essence, Trend Micro Vision One is a sophisticated, AI-driven security solution that offers comprehensive protection and enhanced threat intelligence capabilities, making it ideal for enterprises looking to bolster their cybersecurity defenses.

Trend Vision One was previously known as Trend Micro XDR, Trend Micro XDR for Users, Trend Vision One - XDR for Networks.