Trend Micro Deep Security Reviews

We have many use cases. We deployed it, and we replaced Semantic with Trend Micro Deep Security for one of our customers in the Telecom sector. Some of our customers are actually looking for Microsoft solutions because most of the endpoints and the infrastructure are Microsoft-based, so they want the platform to be the same.

We are satisfied because we have experience deploying it in a big Telecom sector that has 7,000 NPCs, and they are running different services, Microsoft, Linux-based, and some other operating systems with many applications. They remain satisfied.

At different time spans, we often required technical support. Their portal is available, or we engage with this for any technical issue or if there is any breach, so they often get help from them, and their technical team works with our teams to find out different issues.

Trend Micro Deep Security has very good features such as virtual patching and almost all other features are the same as all the Endpoint detection and response systems are capable of doing the security features such as deep scanning, secret scanning, and the advantage of Microsoft is that it protects the cloud services as it protects the on-prem.

For threat detection, they use heuristic behavior detection, and sometimes, if they think there is a sort of attack which is new, they alert you, and they detect and show where the attack is coming from. They even suggest patching or any solution to stop that attack.

Trend Micro Deep Security is not a very cheap solution, but customers are satisfied. It's working, so every year, once they purchase it, and after a year, they renew it, or whenever the subscription expires, they renew it, unless there is any security breach.

My company suggests Trend Micro Deep Security to our clients for server maintenance, and the customers can move a lot of servers in their environment with lesser hiccups. Our client uses around 10,000 servers, so we suggested they use Trend Micro Deep Security, a server support-based tool. Apex One and Apex Central are designed for laptops and desktops.

The most valuable features of the solution we have enabled in our organization are its anti-malware capabilities, applications, web reputation, and integrity monitoring.

Our company uses Trend Micro Deep Security as a conventional IPS and for malware detection. The solution is also used for real-time monitoring and to evaluate the monitoring impact on the system. The solution's impact or consumption of memory can also be checked. Trend Micro Deep Security is compatible with various platforms, such as Windows and UNIX. 

In an older version of Trend Micro Deep Security, our company faced issues syncing the active directory accounts. Anytime we revert to the support team of the solution, they always propose to update the Deep Security Manager to resolve every issue, which is an ineffective approach. I believe the support team should be more proactive in providing effective options or guidance to resolve issues around the product. 

Although in our company, we try to add exclusions and troubleshoot for real-time monitoring and upgrade the version, there are clients who consume a lot of memory; on average, 30% of memory remains occupied. The solution's memory consumption impacts certain aspects of the client's infrastructure. 

Even after whitelisting one of our company's port scanning servers or tools, the IPS activity continuously monitors and sends false positive alerts, we haven't found a solution to this over the past four months. Trend Micro Deep Security should have a lab-type environment where the solutions for every issue can be found through simulation. 

Trend Micro Deep Security is looked upon as a new-generation antivirus that is used on the server end. In future versions of the solution, I would prefer the upgrade process to be simpler than on Linux; the upgrade is a lengthy but easy process. Our company expects the tool's upgrade process to be lighter over the Linux platform, similar to its offering for the Windows platform.

The virtual patching features of Trend Micro Deep Security are very good. If you're running an unpatched server and you need to do n-1 patching, you need to wait for a month for the patch to be rolled out. That one month is a long time for an attacker to do an attack. Virtual patching is a wonderful feature where we do a recommendation scan and an internal assessment on the server, and it updates the IPS signatures to block any attack. I have seen instances where it has prevented attacks on the end-of-support servers such as 2018 R2, and many years ago, even 2007 servers that were end-of-support. It certainly helped there.

Another big advantage of Trend Micro at the time was that it supported Linux. Nowadays, most of the vendors seem to be supporting the Linux operating system, but Trend Micro was the initial organization that started supporting Linux and anti-malware solutions. It only had the anti-malware solution. It didn't do file integrity monitoring or other things.

Trend Micro Deep Security is easy to use and deploy.

I've not worked with CrowdStrike Falcon, but one of our customers also had CrowdStrike Falcon on some of the devices. I was only supporting Trend Micro. They had a ransomware attack, but Trend Micro didn't detect that particular ransomware attack, whereas CrowdStrike did. I was not a big fan of CrowdStrike till then, but when I saw that Trend Micro couldn't detect that particular attack but CrowdStrike could, my opinion changed. All the servers with Trend Micro were impacted, but all the devices on which CrowdStrike agents were running weren't impacted. CrowdStrike detected and blocked the attack immediately. From that perspective, I have high regard for CrowdStrike because the role of an EDR is to detect and respond immediately and block an attack. Containment is the first priority. Trend Micro can give numerous ifs and buts about why it couldn't detect that attack, and even though I'm a fan of Trend Micro and have extensive experience with Trend Micro Deep Security and Trend Micro Apex One, in that particular instance, CrowdStrike literally beat Trend Micro.

A disadvantage of Trend Micro as compared to CrowdStrike is that it doesn't work well with other solutions. If you have McAfee for anti-malware and IPS and the firewall of Trend Micro, they don't go very well. I had challenges deploying it with Carbon Black as well as McAfee and Symantec. It's because of the way Trend Micro works. It integrates with the NIC driver, so if two agents are running, it doesn't work well because they both want to integrate with the NIC driver.

For the servers, they have Deep Security. Plus, they have introduced a new feature, which is threat assessment for networking. And that is the one product that we are actually promoting right now more than anything else in their portfolio.

Normally, customers use it to secure their servers. Especially when it comes to updates for our enterprise clients and any client who has more than 10 or 20 servers, it's very hard for them to have downtime to install all the patches, check them, test them, and then run them. 

Trend Micro Deep Security is a very good solution for them because it stops all the vulnerabilities and exploits in the server. It downloads all the upcoming updates and gives you a time of your choice when you want to have downtime, maybe over the weekend. Then you can download all the updates, which have been tested on the Trend Micro site, and freely install them on your servers. Then you can bring the servers back up for working. 

So in that sense, they save a lot of time in downloading and installing updates, while at the same time protecting the servers from all the vulnerabilities and exploits.

Trend Micro use IPS for remote vulnerabilities. If someone is using a remote desktop to exploit the network, that's where users use the IPS. And IPS in our region or in our country, where we have deployed it, it's only in enterprise companies, not as SMBs or the private sector. Mostly, it has been deployed in the banking sector.  

We were using Trend Micro Deep Security for the sole purpose of virtual cloud management. It was the best VPM solution in the market, and other sites recognize the quality, such as the Gartner website.

The VPM is the most prized characteristic of Trend Micro Deep Security, which in addition addresses all zero-day vulnerabilities. This allows us to confidently transfer our system physically, as it presents to the external world, whether it be an intruder or a hacker, that our system is completely secure without any weak spots. Even if the latest security patches have not been installed or updated, the software virtually covers them for you.