Check Point Cloud Firewall (formerly CloudGuard Network Security) Reviews

I am quite satisfied with it, as it secures our virtual environment in both CloudGuard and on-premises. The business case was that we have several customers transitioning from on-premises to cloud solutions, and we wanted to have the same visibility and security in CloudGuard as we had on-premises.

We wouldn't have the same visibility or granularity if we didn't have Check Point. 

We have very good visibility or granularity regarding security. 

Since we are using the same management both on-premises and in the cloud, we did not need to create other security measures or learn new technology. This allows me to achieve the same results with our existing resources.

It's quite interesting to see all the new features being added to the solution. I plan to do more integration with the CloudGuard-specific elements within the new policy framework. Although I do not remember the specific name, there is a feature that involves a revision of the policies. That will be our next addition.

We have visibility both on the cloud and on-prem, and we are very satisfied with that. 

It's helped us with our security posture. We have the visibility. We have the possibility to deploy new stuff. We also used the data center dynamic objects. So when we tag solutions, they get the policies they should have from the setup.

It's easy to use and deploy. 

I'm quite satisfied with the solution. I don't have any notes for improvements. 

I have used the solution for five or six years, maybe.

I haven't had any issues regarding our cloud environment. It is completely stable with no downtime. 

It's not a scale set. It's a single node. We'd need to look at the scale set to see if there was a way to get better performance. 

I have been a Check Point customer for quite some time. We do not use other solutions. 

The initial setup did not take too long. I am unsure of the exact duration, however, I was up and running in about an hour. It was very straightforward and almost plug-and-play.

Everything could be cheaper, of course. 

There are cloud-native options. During setup, we had quite a few people telling us we should just use cloud-native solutions. However, we wanted the same security measures on-cloud and on-prem. It would have been cheaper to stay with cloud-native; however, to have visibility in the same place is important. 

People might just use a cloud-native solution since they are already there and cost less. However, my priority was to maintain visibility and consistent security measures in the cloud as on-premises rather than focusing on cost. The unified management from one platform and centralized visibility are invaluable to me.

I am quite satisfied with the solution, and I do not have significant suggestions for its improvement at this point. The product team appreciates feedback, and fortunately, I have comprehensive playbooks for deploying new solutions. The process is straightforward, especially with the dynamic data center objects. When solutions are tagged, they automatically receive the appropriate policies. 

Overall, it is an excellent solution, and I would rate it a ten out of ten.

My main use case for Check Point CloudGuard Network Security is that we're using it to filter inbound and outbound Azure traffic from on-premises to Azure and from Azure to the internet.

I use it for filtering traffic between on-premises and Azure to secure an SAP application accessed from on-premises while the SAP is in Azure.

The best features Check Point CloudGuard Network Security offers are security features, VPN capabilities, filtering, and IPS.

I rely on IPS and access control the most because it controls access to on-premises and from Azure.

Check Point CloudGuard Network Security has positively impacted my organization by making the network more secure and controlling the access to the applications.

I think Check Point CloudGuard Network Security is an ideal product, so I see no improvements needed.

If I had to think of one area where it could be improved or made easier, I would say that support isn't very good and documentation sometimes is lacking.

I have been using Check Point CloudGuard Network Security for four years.

Check Point CloudGuard Network Security is stable in my experience.

Check Point CloudGuard Network Security's scalability is good because we can put the firewalls in VM scale sets and scale.

The customer support is not good.

Neutral

I did not previously use a different solution before Check Point CloudGuard Network Security.

My experience with pricing, setup cost, and licensing for Check Point CloudGuard Network Security is that pricing was good, the initial setup is easy, and licensing is a bring your own license, so it's good to bring licenses already from on-premises.

Before choosing Check Point CloudGuard Network Security, I evaluated other options, including Fortinet.

My advice to others looking into using Check Point CloudGuard Network Security is to deploy with scale set.

I would rate Check Point CloudGuard Network Security an eight out of ten because it's mostly complete and the support is a minor downside.

I use the solution for some cloud applications, which are cloud-native.

The solution helps increase security posture and provides a greater scope for protection. 

I value the comfort and the ability to receive proper insights almost hands-off. It sends us the information of interest. It offers very good security posture management capabilities. We're receiving the information of interest, like security posture, details, settings, and so on. And the solution is spot-on. There are capabilities to check actions to mitigate and measures and controls that come with these features are valuable.

It's providing compliance rule sets and security best practices.

One of the main reasons we use the solution is that it is great at identifying risks that are critical to our business. It saves us time at identifying risks. I might save one FTE continuously checking in. 

We use the CDR (the intelligence capabilities). It's helpful and does the job.

The solution detects anomalous behavior. We don't have any issues. 

I would appreciate a way to receive periodic updates, like through email. I am the kind of person who likes to receive data passively. It would be nice to have periodic updates on what people should do, maybe with some analysis or something.

I have used the solution for about four months.

The stability is good. It does its job.

It was good in terms of scalability.

I found the customer service to be very professional, great, and very spot-on.

Positive

We did not previously use a different solution. 

The initial setup was very easy.

I completed the implementation together with a colleague from Check Point. The experience was very professional.

We had the 60-day evaluation already. It's now something we have to pay.

I did not consider alternate solutions.

I would rate the solution ten out of ten although I have no other comparison.

Scaling the solution is very easy.

The best features are: 

• database inspection
• threat prevention
• enhanced security.

The solution provides me with unified security management across all environments. It has a single interface that can help us get integrated with the normalized management server. It also gives us security and integrity.

It does what it’s supposed to do. I would say that it created a reduction of 25% in organizational risk.

We haven’t seen any kind of problems so far.

We generally used everything on-premise, but now it's all in the cloud through CloudGuard. The transition was a bit challenging. Maybe they could improve their services by including more tutorials and labs on migration.

I have been using the solution for one year. We have just recently implemented the solution, and so fa,r everything is good.

We haven't experienced a lack of stability.

The solution is scalable, and it can handle the traffic whatever the requirement might be. It is capable of meeting the necessary demands effectively.

The technical support and customer service are very good, they’re very nice.

Positive

The deployment was not easy. We did not use any help from outside. The deployment was made in-house and if we ever had a question, we contacted the Check Point team.

From a technical perspective, the return on investment is in its helpfulness and how it’s shaping our future.

I would rate it a seven out of ten. We had some issues we encountered at the beginning. It is a work in progress.

We are using CloudGuard Network Security for comprehensive security. We have hardware appliances from Check Point, and we also have their firewall installed.

CloudGuard Network Security provides unified security management across hybrid-clouds as well as on-prem. It has improved our security posture. 

CloudGuard Network Security helped reduce our organizational risk. It has not yet helped us save time and costs because we are understaffed. However, it has helped to see what is happening and what we should mitigate or allow to happen.

It gives us all-encompassing security and overview. Previously, we did not have any kind of overview of what was happening with the network.

The interface is unifying all the data in one place. I can see the network side and the policy attached to using USB devices. Everything is stored and related.

A Check Point problem was that there were different solutions, and each had its own interface, section, and logs. Things are going great with the new feature that consolidates all the data from those systems in one place. Right now, I am not sure what improvements are needed. We are having occasional issues related to gateways, but we are still analyzing it.

I have been using CloudGuard Network Security for the past six months since I joined the company.

Until now, it has been stable, but we have had occasional issues with two gateways that used to break or are broken. We are not sure yet. We are still analyzing it. We might be sending it to the warranty team.

We implemented it keeping in mind all the requirements in terms of licenses, hardware, and other things. Everything is pretty much as we needed. We have no plans to upscale it. However, I am waiting for the OS version R82 to see how we can add more data on the fly.

So far, customer service has been almost great. We have had some issues, such as needing to escalate every time because one gateway was not working at some point. We had an endless loop of emails trying to fix this, and the suggestion was to reinstall the gateway and do it from scratch, which was not an option at that point because it would leave that specific location without access, and business hours did not permit it. Other than that, things went smoothly most of the time.

Positive

Previously, we only had security with a basic VPN and firewall in place.

I would rate CloudGuard Network Security a nine out of ten.

The solution is for used for protection of workloads.

It offers good detection. This capability allows us to effectively manage compliance. 

It helps us find misconfiguration. We use it to try to find possible storage accounts that may be misused or other misconfigurations.

The effectiveness of its cloud security posture management is good. It's really helpful for us and allows us to comply with various standards.

It helps our company identify risks that are most critical to our business. It not only saves us time, it provides us with the visibility we need to manage the cloud.

I don't have any notes for improvements. I'd need some more time to work with it.

I have used the solution for one year.

The stability is good.

We haven't had issues with scalability.

We have not had any issues with customer service so far.

Positive

This was the first solution I tested. I have not used a different solution. 

The initial setup was straightforward.

The pricing is decent.

We only really tested the capabilities of native tools before we implemented this solution.

My overall product rating is ten out of ten.

The solution is primarily used for security.  We had 48 to 50 firewalls for data center segmentation. All data centers were fitted into multiple zones. Each zone had a different data classification. We had the firewalls deployed on several overseas remote sites.

For nearly three and a half years, the solution was doing pretty good security. It provides scalability in terms of the multiple firewalls that can be connected with the cluster as well. It offers us easy signature updates and rule changes. We just prepare one rule and then select how many firewalls you want to push. It is easy in terms of the management. 

The GUI is getting better. It's more neat and clean now.

Its security and the definition of signatures are pretty good. Especially when you use those firewalls for a website, they pick up the signature very quickly. 

Security is based on two kinds of things. One is based on the IP addresses and port numbers. Another is based on the application. 

CloudGuard Network Security provides you with unified security management across hybrid clouds and on-prem. I used it only for the cloud. If you're using VMware, you can use that on-prem as well. 

The GUI hadn't been that good. However, they fixed that and the GUI is pretty good now.

There may be some latency. In the beginning, you won't really notice - when you have 10 to 15 sessions. However, if you have 40,000 sessions and you are running the dev check in the background, then you will start to notice some issues. It's probably under milliseconds.

It's not as organized as a Palo Alto solution.

We wanted to go with the Azure Network solutions, and CloudGuard was a big expansion compared to Azure Dev, which is a built-in dev solution. I hear Azure is integrating Palo Alto as a back-end solution.

I had a high level of confidence in CloudGuard Network Security. We used it for nearly six months and were comparing different products. I'd rate it at an eight or nine out of ten.

I've used the solution for four to four and a half years. 

The solution is very stable. I'd rate the stability eight or nine out of ten. 

We didn't really check for scalability. We were more focused on features. I'm not sure how well it would scale.

We had the solution in multiple locations. When we tested it, we did so across around 100 customers. 

The product was really good, so we didn't really deal with technical support. 

Our company migrated from Check Point to Palo Alto. I've noticed there are big changes in the Palo Alto GUI. It's neat and clean in comparison. The site was easier to navigate. Check Point has the same features; however, it's not as clear. If you are searching for something, you need to click around. It's not really well organized.

We've also used Azure and decided to go in that direction. 

The deployment wasn't really complex. It depends on if you are familiar with the solution and if you follow the best practices. It's not hard to do a POC design. Within four weeks, you'd have the solution up and running. 

Our infrastructure was 100% Azure, so it was much easier for us to deploy the POC. 

It was pretty easy to configure. 

You can save maybe 30% on costs by deploying this solution.

CloudGuard is pretty expensive. Azure ends up being cheaper. 

They are fairly priced. It's not cheap. However, you definitely need to spend some dollars on security. 

While it's rather fair pricing, it was more about us having the right solution for the user base. 

For a few reasons, we decided not to go with it compared to the cloud vendor's firewall. One was the technology and integration itself. You can integrate CloudGuard into many third-party tools. However, it adds extra cost. Also, if we could find something in the Azure ecosystem, we don't need to go for a third party. That's why we decided to go with Azure. 

I have not yet used its AI capabilities. That said, my understanding is that they have very good tools and built-in initial learning capabilities that can help you begin to understand the traffic.

I would recommend the solution to others, and I have never had issues with the product itself. However, we were looking for Azure-native tools, which is why using this long-term didn't work out. 

I'd rate the solution eight out of ten. I'd rate it a nine if I was 100% sure you could control ransomware attacks. I'm not sure if you can do that fully with CloudGuard. 

CloudGuard is a posture management and workload protection platform. We're also using it for data and risk management.

Our environment includes a hybrid cloud and three public cloud providers: GCP, AWS, and Azure. CloudGuard enables us to manage all the cloud providers from one dashboard. It enables a team approach, so we're more flexible and operationally efficient. The solution provides a holistic view from a single dashboard, making posture management and threat prevention more effective. Detection is not a significant challenge. When I block a particular incident, CloudGuard will implement some kind of prevention activity so that those types of activities are prevented automatically in the future. Prevention is more beneficial for us.  

When managing our service partner, CloudGuard enables easier enrollment and allows us to consolidate all those rules and privileges. It will give them complete visibility of the identities that I am using for all the services, whether it's privileged user access or a normal user. It's based on user suggestions. CloudGuard helps me handle my user identities.  

Another benefit is posture management. We are governed by four regulatory entities in India. We need to stay in 100 percent compliance by avoiding any misconfigurations on our platforms, and this tool helps us.  It also helps with virtual protection of our code by adding another layer of security and an extra step. It can detect abnormalities in the image and register, enabling us to identify and fix compromised packages before any major release. 

As a regulated entity, we receive a monthly external audit from the agency, and we always pass them using CloudGuard because we have a  single dashboard for multiple services for user activity reviews and policies that we have set for the user levels. It's easy to demonstrate our compliance posture using this portal and any incidents with compromised credentials or NetFlow security. 

CloudGuard allows us to do more work with fewer people. A team of six people can manage our entire enrollment. CloudGuard covers a huge footprint. It saves a lot of resources, but I cannot measure that in time saved. Onboarding and learning the product took six months, and it took us another year to address all of the solution's findings. The third year should be focused on monitoring. I can't quantify how much time is consumed in days or weeks, but if I had to rate it on a scale of one to 10, I would say nine. 

A reduction in human error is part of posture management. When we first onboarded to the posture management platform, we had to customize and build some rules for enrollment. We fixed the issues we found, and we don't need to run the posture management tool again. Instead, we run the GSL builder and cross-check the findings. Before addressing the finding, we must create a default rule set in the GSL  Builder. We copy what's in the builder and execute it on a particular enrollment, and we'll say it is good to go. We can save time building custom rulesets with GSL builder, but it's hard to say how much. 

We like the GSL Builder feature. When you're running a security operations center, you spend a lot of time monitoring endpoint activity to ensure there is no malicious traffic or anonymous access in the environment. The GSL Builder is helpful for deep investigations of a particular reason for an incident. You can use it to get more information.

We have more than 30 AWS accounts and use more than 16 versions with some different tenants. I don't want to turn on each enrollment and app one at a time in the application. With GSL Builder, I can select multiple accounts from one place and execute the commands. I can see the results of which entities passed and failed.

It's easy to write custom rules and policies. I have limited coding knowledge, but I can make policies from inside the UI. It will show what services are available in the cloud provider, and I can go through and check the ones I need. It requires no scripting knowledge. If you have experience in the industry, you can immediately learn GSL Builder and adapt it. 

Auto-remediation is a module you can enable at the enrollment level. It detects and fixes human errors or misconfigurations.  For example, we can't create a bucket that is exposed to the internet for compliance reasons. CloudGuard can prevent that bucket from being created, ensuring compliance. 

With effective risk management, we can identify every asset and assign a score to each network violation or process. We will flag the most critical assets and bring them to private subnets. There's also a graph, which is useful if we need to explain things to developers and administrators.

The user interface could be improved. Sometimes, the visibility is not immediately available for the environment. We have the native servers that come with the solutions, but we cannot see them in the Check Point log. Another issue is with the integrated file monitoring. It would make sense to have stuff like file integrity monitoring and malware scanning available within this module because we don't want to integrate another product. 

For example, let's say it's showing a process violation. It should be able to do some additional malware scanning in that particular bucket to get some additional information. I don't want to integrate with another third-party tool or go to the native server to check something. It would be helpful to have integrated monitoring and malware scanning for the file types. 

There are a few flaws with the security management portal where I have limited visibility into the workload protection features. There is no error visibility where I can see the communication and workflow between services. Some of the dashboards need to be fine-tuned if they are not customized. For example, I cannot customize anything on the effective risk management dashboard. Some of the information is not correct for my tenant. With respect to passwords and user management, there are no policies I can measure at the user level. If the user was created more than six months ago, you don't need to worry about that password or do anything like two-factor authentication associated with that user. They can still log in after six months or one year. 

It's also a challenge to use CloudGuard's agentless workload posture with AWS. An Azure storage is summed up with a CNAPP encryption by default. We tried onboarding this data, but the problem is the attachment is not done. After a few days, we identified that it was impossible to do the encryption detection. But CloudGuard's default rules say that this has to be encrypted. 

The AWS module says that we cannot access this volume with this encryption, so we cannot use an agentless workload posture with AWS because of this. It is a best practice to ensure that all the volumes are being encrypted. Without the encryption, how can I do this? It is a big challenge for CloudGuard.

I have used CloudGuard for 14 months.

We only see downtime when there is a global outage. It typically only lasts a few minutes. Also, we sometimes see latency issues when accessing this portal. We double-checked that with the team also, and they asked us to check on our network side. We are in the office network, so we could not refer to that. 

Some of CloudGuard's modules are slower. For example, if I go and click on the posture, it loads immediately within 30 or 50 seconds, but workload protection might take more than a minute. There are some differences in the latency between the services within the cloud version.

We don't have any issues with CloudGuard's performance or scalability. 

I rate Check Point support 10 out of 10. Their customer service is fantastic. We have premium support, so I don't know what their standard support is like. When we open a ticket, they immediately call us back regardless of the severity. 

Positive

We have Prisma Cloud, which is not fully implemented, so we need to use Check Point simultaneously. Prisma Cloud excels in terms of UA, visibility, and user-level policies and management. CloudGuard is more cost-efficient but not as user-friendly as Palo Alto. At the same time, having the GSL Builder makes it more efficient to make CNAPP rules without much background knowledge.

Generally, the deployment is pretty easy. We have a template, so it's automatic. However, we run into problems when we're supporting multiple CSPs. AWS supports CloudGuard 100 percent, whereas for Azure, it's 75 or 80 percent. Some Azure services, like user identity, are not supported, which is a challenge. It should be available in Q1. 

Deploying the threat intelligence for AWS was fine, but we had problems with Azure. I'm part of the security group, which is onboarded into the AWS. The next time I create a new security group, it automatically discovers the asset and will put it in the log. For Azure, a new network security group must be added manually. If I'm doing that manually, I want to completely remove the onboarded threat intelligence, which means I want to completely remove what we added from the portal. That is one problem we face doing the onboarding of Azure.

I don't know the initial proposed amount, but the procurement team looked at the market and compared Prisma and CloudGuard, then settled on one solution.

I rate Check Point CloudGuard CNAPP nine out of 10. Any advice I could give to potential users would be completely based on their use cases. You must look at various criteria, like your environment and enrollment level, but my general advice for implementing a CNAPP solution is to get a cloud dev. 

If you are using AWS with multiple CNAPPs and you don't have a control tower or any other landings in the budget, you want to do policies at each enrollment level. But we're using this out that what we do is, like, we build guardrails where we can apply it at the enterprise level itself. 

For example, we'd want to allow any data to be researched outside the area. I'll create one policy and apply it at the organizational level. I set a policy so that any user in my enrollment could not create an SD bucket or any volumes outside using their agent. If you have multiple CSPs, AWS accounts, or Azure subscriptions, this is one solution where you can cover your entire organization's accounts.

CloudGuard CNAPP has many use cases depending on your business requirements. If your organization's infrastructure is spread across various cloud vendors, such as AWS, GCP, and Azure, you can implement CNAPP. 

Our use case entails gaining visibility into cloud components. We have an infrastructure platform where our resources are deployed. We are now focusing on having a clear visibility of all the cloud platforms, whether it is AWS, Azure, or GCP.

CloudGuard expands your visibility. If your infrastructure is segregated across AWS, Azure, and GCP, it can track all the resources deployed on these cloud vendors. It covers any cloud devices like S3 buckets, containers, etc. You get clear visibility of all those resources, and it helps to check for misconfigurations. 

For example, if you have an S3 bucket exposed publicly, that is a security concern. You need to do things to ensure that your S3 bucket is kept private when configuring it. It will evaluate your security configuration with respect to the deployed resources and give you the scores. CloudGuard will tell you where your resources stand regarding configuration, security scores, compliance checks, etc. It gives you all the visibility within the single platform. 

It also protects your workload. The features of the traditional CSPM can be varied. If you have deployed an application running on a Kubernetes cluster, it will give you visibility into all clusters and the workloads deployed and running in the background if you want to scale the workloads.

When you perform all the activities on the back end, there are a lot of chances that you misconfigure. Any misconfigurations within the namespace of the Kubernetes cluster can lead to a security vulnerability. When it's exposed publicly, it can add some more risk. All of those things can be easily tracked in some of the recent cloud vendors. 

Wiz is one of the industry contenders within the CNAPP solution. In addition, there are a couple of other vendors like Orca. All of these vendors provide workload protection in addition to the typical CSPM.

If most of your resources are deployed in CloudGuard, one of the bigger concerns
is the failure to monitor your devices. You can only protect the things you can see. You cannot take action if you don't have visibility into how your resources are deployed or distributed. 

Regardless of scale, it gives any cloud-dependent organization an edge over the other technologies so that they can track their infrastructure. You can see where your resources are deployed and how they perform regarding health checkups, security misconfigurations, compliance checks, etc. So it gives you better visibility. 

Most of the features are pretty valuable, whether that's a description of the attacks or the attack graph showing the vulnerabilities. If a single tool does all this work, the value is centralizing all these functions on a single tool. These are the cloud-native applications we talk about — containers, Kubernetes, and cloud infrastructure — and all those things are the primary focus of the CNAPP solution. 

I think EDR, MDR, and any of those systems do a great job at the endpoint level, but you need CDR if you want to use those features on a cloud level. For example, if a VM is deployed, it can also detect all misconfiguration there. In addition, if any of these are critical, it will show you the attack graph. 

It shows you all the pictures from the attacker's perspective, such as if there is some loophole at your gateway level and if the traffic is coming from the Internet. If you have misconfigurations at the gateway level, it will give you the attack path the attacker can use to enter your organization. If you enter, it shows how you can move laterally if some additional new points can be exploited within your infrastructure. It gives you a list of any misconfigurations in terms of user access.

Regarding the response part, the onus is on the department or the team implementing those technologies because you need to have strong processes, policies, and procedures. For example, if you can address some of the detections or vulnerabilities at the application or cloud level, you should have a policy to prioritize those things in your organization. Once you have those policies, you can lead in those scenarios and maybe collaborate with different teams responsible for addressing those new issues. 

It involves some coordination and collaboration as well. At the end of the day, you want to make things easier, so you can provision access for the various teams within that platform if they want to consume these things directly rather than getting the information via a report or any other mechanism. Let's say there's a problem with your S3 bucket, and you need to fix issues inside that rather than fixing them in the CNAPP solution. CNAPP is something that gives you an overview, but you need a process for the remediation.

CloudGuard's reporting could be better. It's good now, but there is room for improvement. If you're looking for a centralized platform, there are a lot of features that can be appreciated. However, you want complete security integration with SaaS, DAST, secret scanning, etc., and a single platform for all these features. 

Check Point is known for its firewall. Six or seven years ago, it used to be a good thing because most businesses were on on-prem. If your business is on the cloud, you do not need a firewall because most of the cloud vendors already have that built into their cloud premises, and you can configure the rules there. You can do everything as a network security engineer. 

It depends on your business model. Some companies are segregated and most of their things are on-prem. They have physical outlets in multiple countries. Managing everything in these business environments and deploying the Check Point firewall would be a good investment. However, it doesn't make sense if your business is totally in the cloud. 

It depends on how Check Point sees things in the market. If they want to compete with all these vendors in terms of CNAPP, they need to first understand their audience. Once they have some visibility into who their audience is, they need to maintain their business. 

I am evaluating CNAPP vendors for my organization, and Check Point Cloudguard is one of them. I have evaluated all the other vendors, so I have the experience.

One vendor I worked with in the CNAPP market was Rapid7. They have a CSPM tool called InsightCloudSec that offers similar visibility of all cloud resources. The various cloud vendors are populated over the platform, and you can see the same things. However, some features are available in other vendors, like Wiz or Orca that are missing in Rapid7. They are trying to incorporate some of the features they lack, but there's still a long way to go. 

It's more about how you leverage the APIs of the cloud provider so that you can get the data and make things as easy as possible for the end user. You do not want to overwhelm them with so much data. You want the information that's necessary for your organization to take action. Wiz and Orca are the industry standard for CNAPP solutions. I would rate Wiz nine out of 10 and Orca eight out of 10, but Rapid7 ICS would receive five out of 10. In terms of CNAPP features, I don't think Check Point is a competitor here. Check Point generally focuses on things related to the firewall, such as VPN, etc. 

Deploying CloudGuard is pretty straightforward. You don't need to invest much time because the deployment model isn't rigorous. You establish the connection with your CloudGuard vendor, and it takes a few hours. There are additional steps if you want to configure more in-depth to get more visibility into your Kubernetes cluster. It doesn't require any agent to be installed on your resources, which is a good thing.  

If you're running a serverless architecture like AWS Lambda and you want better visibility in those complex scenarios, there are some additional configurations that require you to check some documentation that you need to go through. However, it takes only a few hours to achieve visibility into the typical cloud resources, such as EC2 instances, S3 buckets, containers, and user accounts. 

All these technologies are expensive. Wiz is the most expensive. You might have seen that Google is making overtures toward acquiring Wiz. It's valued at $12 billion, but it may go as high as $24 billion, which would make it the most expensive acquisition in Google's history. The bottom line is that you need to spend a good amount of money to implement these things and it depends on your organization's priorities. 

I rate Check Point CloudGuard CNAPP six out of 10. 

We are using Check Point CloudGuard as a firewall. Along with the firewall, we have incorporated multiple blades. Initially, the firewall used to be a single security device, and along with that, we required antibot, antivirus, IPS, and IDS devices. Check Point CloudGuard is a combination of all the devices and functionalities in a single device. It is a next-generation firewall. The main use case of this firewall is to protect our entire cloud and provide perimeter cloud security at L3 and L4 levels.

It is a next-generation firewall. Threat prevention and threat detection blades are available with the firewall. As soon as you enable the blades and you have the license for it, you are good in terms of threat prevention. You do not need to do any specific settings. You just need to enable the blade, and the firewall will take care of the rest of the things. That is how it works.

We are using the Check Point CloudGuard firewall with autoscaling in the AWS and Azure cloud. We have a minimum capacity of two firewalls and a maximum capacity of ten firewalls. If the CPU utilization increases or the memory utilization increases, the capacity will be increased to three from two. Till the service comes down to the threshold level, it will keep on adding more firewalls, so we have ease of operations. We do need not to worry about what we will do if a firewall fails.

When I joined my organization, we were using this CloudGuard firewall in the active/standby firewall cluster. In such a setup, the firewall that is active processes your traffic. The other firewall is in the standby mode. It is not processing the traffic, but it is still costing you. Even though it is not being used, it is still cost-consuming at the cloud level. We changed the setting to autoscaling. After adopting the autoscaling mode for this firewall, we need a lower number of CPU and memory. All the firewalls are active, so we need not worry about the standby firewalls and all those things. So, we have transitioned from these conventional active/standby firewalls to autoscaling firewalls. With this, we are able to save costs and improve performance. All the firewalls are active/active but with fewer CPU cores. When we have fewer CPU cores, we need less number of licenses, so we were able to save the cost. The performance has also been great.

The most important feature is that we are able to use Check Point CloudGuard Firewall for our cloud security. We can make the deployment automated. We do not require manual intervention. With the help of automation, we are able to deploy it within minutes, and we are able to discard it within minutes. We can do hardening and create policies. All those things are very advanced.

Secondly, Check Point is one of the big OEMs available in the world from the firewall perspective. It is better than Palo Alto and Juniper firewalls. It is one of the best firewalls available in the industry.

We have done a lot of automation with the firewall, but sometimes, there are some failures because of some bugs. The fixes for them are still not available. We have daily or weekly communication with the Check Point people giving support in the India region, but we have not seen much improvement or response to our requests for some additional features. We are moving to infra as a code, so we are expecting more advancements in this product. Just installing the patches is not going to help us. They need to focus on this area.

I expect Check Point CloudGuard to come up with some AI/ML integration. A firewall is the first L3 security device available to you. It is the single point that manages or processes the traffic for an organization. There is a possibility that the device goes down or gets rebooted for any reason. The integration of artificial intelligence with the devices can help us to know in advance that there might be a surge in traffic. There might be a spike in the traffic, so we can have some additional firewalls integrated. This predictive analysis has to be there. This way, if required, a second, third, or fourth firewall can come into the picture. All the firewalls will process the traffic simultaneously. I am expecting such capability. This sort of feature is available with AWS. We are deploying all the firewalls on AWS, but it would be easy if, in the future, such a feature is available from the OEM or Check Point itself. It will be very helpful for the organization.

We have had a couple of outages because of some misconfiguration. They were human errors but there were no prior indications that if we were making these sorts of changes, this would happen. People making the changes on the firewall were not aware of this, and that is the reason why the outage happened. In a financial organization, an outage of even five minutes can cost a lot.

In our organization, we have been using it for more than four or five years, but I have hands-on experience with it for the last three years. 

I would rate it an eight out of ten for stability.

It is scalable. I would rate it a ten out of ten for scalability.

I would rate their support a five out of ten because I never got good support. Whenever I have raised a TAC case, their support has not been great. It is not as good as others.

They need to improve from a knowledge perspective. I had a couple of issues, and they could not understand those issues easily. They should not just take the logs and analyze the logs. They should be providing a solution. Being a financial organization, we cannot afford a long downtime. We expect a faster resolution. If a support engineer is not capable of handling a case, he or she should escalate it to a higher level, but they are not doing that on a regular basis. They make you lose days by dragging the case.

Neutral

In my organization, we have two different Infra teams. We have the Network Security Infrastructure team that manages the on-premises setup, and then we have the Cloud Network Security team that manages the cloud. I am a part of the Cloud Network Security team, and we are using the Check Point firewall. The on-premises team was using Juniper and Palo Alto firewalls, and they are now using the Check Point firewall. It is one of the most effective products we have ever used, and that is the reason why that team has moved from other OEMs to Check Point CloudGuard.

We have deployed it on the cloud. We have AWS, Azure, and GCP clouds.

The deployment was done with the help of AWS CloudFormation templates which are very generalized. I just downloaded the templates and customized them as per our requirements. I faced a few challenges because I was not completely knowledgeable about CloudFormation, etc. It was not very challenging from the Check Point side. It was an easy deployment.

I faced a couple of challenges while integrating it with our existing ecosystem. Even though Check Point is the OEM, we have third-party vendor support here in India. The challenges that I was facing at the time were also new for them, so I sorted out those issues myself by referencing some online articles on Check Point. I was able to overcome those challenges at the time. It was not a big deal. There was no huge challenge.

Initially, we involved people from Check Point and the third-party vendor of Check Point, but at later stages, we were capable enough to develop things in-house, so we did it ourselves.

The Cloud Network Security team has ten people. I am handling the AWS cloud deployment along with a colleague. Other colleagues are involved in Azure and GCP deployment. Overall, there are ten people for deployment and management, but mainly, two or three people are involved in the deployment at a time.

We have deployed it in two regions. It is deployed in the Mumbai and Hyderabad regions of AWS in India.

We have seen 70% to 80% ROI. 

I do not know the exact price, but it is fairly priced. It is neither cheap nor costly.

As compared to other OEM vendors in the market, it is cost-effective for us. There are multiple things we need to consider while selecting a certain product. We have AWS, Azure, and GCP clouds, and we have multiple firewalls. All of our firewalls are Check Point CloudGuard firewalls. The cost can vary based on the licenses that you are using. For IPS, IDS, antivirus, antibot, and other capabilities, additional licensing costs might be there. When it comes to security, it gives us great security. Considering that factor, it is cost-effective for us.

I have not evaluated other solutions. Based on the input from my seniors, this is the best solution available in the market. I have heard that Palo Alto also has a cloud-based product called Prisma Cloud, which has some advanced features integrated by using AI/ML technologies. I would love to evaluate Prisma Cloud.

I feel confident using this product. In fact, I have completed a few certifications related to Check Point CloudGuard. I am a Check Point certified administrator, and I am also a Check Point Certified Cloud Specialist. I have also been working with automation-related things, and sometimes, we do some bash scripting and shell scripting to make things easier for us. Traditionally, you can only access the firewall via a CLI. That is the basic level, and at the next level, you should be able to do a few daily things in an automated way. I am very good at that.

I would recommend this solution, but it also depends on the requirements. It is a cost-effective solution. If you are a small organization or a startup, you do not need to have this solution. If you are a big organization with 5,000 to 10,000 users, you can go ahead with it. The ROI for our organization was up to 80%, but it necessarily would not be the same for other organizations.

Overall, I would rate it a nine out of ten.