USM Anywhere centralizes security monitoring of networks and devices in the cloud, on premises, and in remote locations, helping you to detect threats virtually anywhere.
| Type | Title | Date | |
|---|---|---|---|
| Category | Security Information and Event Management (SIEM) | Aug 5, 2025 | Download |
| Product | Reviews, tips, and advice from real users | Aug 5, 2025 | Download |
| Comparison | USM Anywhere vs Splunk Enterprise Security | Aug 5, 2025 | Download |
| Comparison | USM Anywhere vs Wazuh | Aug 5, 2025 | Download |
| Comparison | USM Anywhere vs Microsoft Sentinel | Aug 5, 2025 | Download |
| Title | Rating | Mindshare | Recommending | |
|---|---|---|---|---|
| CrowdStrike Falcon | 4.3 | 4.7% | 96% | 132 interviewsAdd to research |
| Wazuh | 3.7 | 11.8% | 80% | 48 interviewsAdd to research |
Discover
Analyze
Detect
Respond
Assess
Report
USM Anywhere was previously known as AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity.
Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Our customers have three use cases, Log aggregation, correlation, and the SIEM functionalities.
Our customers are mostly in the finance and banking sectors.
Log aggregation and alarms are the most useful for security for our customers. It collects logs from various log sources in the corporate network and then gives you actionable intel on the collected logs.
The second feature is SIEM capabilities. It's an umbrella set for what SIEM does.
The asset discovery and inventory capabilities in USM Anywhere is quite good because it helps to discover all assets and IP addresses on the corporate network.
USM Anywhere uses artificial intelligence to enhance threat detection.
The only issue that you need to bypass is the issue with integration with some other log sources, some other application security applications.
The issue is still present. The process of collecting logs from applications that do not have an alien app or alien routes can be made a little bit better. Once there is no alien app, it's always very difficult to collect logs from third-party applications.
So, the process of collecting logs from third-party applications is something that needs to be improved.
Also, when it comes to parsing of some logs, I've worked with another solution that has a custom parsing feature that can assist you in creating the custom parsing rule by yourself. But for any of those, USM needs to reach out to the engineering team, which takes months to come up with.
There is room for improvement in Log parsing. So when there are logs that are being parsed, we need to create a custom parsing rule to correctly parse some event logs. I've worked with a solution that has a feature that helps you to create custom parsing rules. But for enablement, we need to escalate to their engineering team, which takes months before they can respond and give you that parsing rule.
I have been using it for three years.
Many times I've noticed issues with stability. Mostly, it's quite stable, though. It's stable. But when you overload it a little, or access it, depending on the storage capacity.
I would rate the stability an eight out of ten.
I would rate the scalability an eight out of ten. We have small, we have medium, and we have enterprise banks as our customers.
The customer service and support respond fast and we jump on sessions fast, unlike some other vendors that can be slow to join a session.
Positive
I would rate my experience with the initial setup an eight out of ten, with ten being easy. It can be public cloud, private cloud, or on-premises. It depends on the customer.
For most customers, I deploy more on-prem than on cloud.
The deployment time really depends on the customer and how responsive they are. But with everything, it could take up to two weeks, working every day, to fully deploy the solution and update it all.
To fully integrate, it depends on the organization. It depends on the log sources that should be integrated. But mostly, if you dedicate every day to deployment, it shouldn't last more than a week.
It's saved security costs. It's saved costs in terms that when the solution is not in place and the customer gets hacked, they lose finances. So the solution has helped the customers not to get hacked. So, it has saved costs.
The price is really variable depending on what tier the customer is subscribing to. I think USM Anywhere recently started a 125, a 250, and then 500 and 1000 tier. So it depends on the organization, but it's affordable for most customers.
Overall, I would rate it an eight out of ten. I would recommend it because it is a good solution. It's easy to navigate. It's flexible.
