IT Central Station is now PeerSpot: Here's why
Buyer's Guide
Endpoint Protection for Business (EPP)
June 2022
Get our free report covering Microsoft, SentinelOne, Palo Alto Networks, and other competitors of Check Point Harmony Endpoint. Updated: June 2022.
610,190 professionals have used our research since 2012.

Read reviews of Check Point Harmony Endpoint alternatives and competitors

Owner at a security firm with 1-10 employees
Reseller
Top 20
Very customizable but slow in the cloud environment
Pros and Cons
  • "The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers."
  • "Everything with Fortinet having to do with their cloud services. They need to invest more in their internal infrastructure that they are running in the cloud. One of the things I find with their cloud environment compared to others' is that they go cheap on the equipment. So it causes some performance degradation."

What is our primary use case?

Our primary use cases for Fortinet FortiEDR are cash registers and endpoint, and point of sales.

The reason we originally started with FortiClient with one of our clients in the first place was that they were able to have legacy cash registers, a really old technology, which we had to get to run in a small resource space, and FortiClient, which was the predecessor, allowed us to literally pick and choose what features we wanted in the client and reduce its size, which you couldn't do with any other types of clients that were out there. That's how we started with that.

It is mostly on premise and any cloud services that we use are directly from Fortinet themselves. I would call that public cloud. We do run some of the customer's environment in private cloud, basically co-location. This has provided the services back to their dataset. I am talking about Fortinet's cloud for the public. For the private stuff it was basically out at Q9, which is the co-location provider.

How has it helped my organization?

Fortinet FortiEDR has the ability to customize the footprint of the client or the agents on the device and on the endpoint.

What is most valuable?

The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers. The customer has literally about 800 cash registers. That was the use case for Fortinet FortiEDR - to get that down into a tiny space. The only way to do that was to use this product because it had that ability to unbundle services that were a surplus.

What needs improvement?

In terms of what could be improved, I would say everything with Fortinet having to do with their cloud services. They need to invest more in their internal infrastructure that they are running in the cloud. One of the things I find with their cloud environment compared to others' is that they go cheap on the equipment. So it causes some performance degradation.

A classic example of that would be products like FortiMail where you're basically acting as a mail relay. So say you're on a support call and I'm sending you a mail with document that you expect to come to you immediately, or within 30 - 60 seconds, could take up to 45 minutes because of the load on the cloud services. This can result in trouble tickets and other customer side issue.

In the next release I would like to see more investment in their cloud services. Additionally, they definitely need better integration into their FortiSIEM and FortiSOAR solutions.

They should continue to improve that and possibly include a managed threat hunting feature, an MDR solution.

For how long have I used the solution?

I'm a Fortinet Gold Reseller but primarily we're a consulting company, not a product company. We tend to be agnostic with the one caveat being Fortinet, and only because I was the first guy in Canada to get certified in that, and also the first guy to sell it. There is a personal preference there. But I'm looking deeper into more enterprise security solutions that are SASE and endpoints and EDR, XDR, MDR, all that kind of stuff.

We've done work primarily with FortiGate deployments, but we've also done multiple SD-WAN projects and we've worked with FortiEDR, which is similar to their version of EDR. We've worked with FortiClient before that. As far as FortiCloud goes, we've worked with FortiMail in the cloud, we've worked with FortiManager in the cloud, but we haven't gone into CASB stuff yet.

We also do some Fortinet managed services in our customer base. So I have worked with Fortinet since 2004, 2005.

Fortinet FortiEDR has only been out for a couple of years. We've been working with it for a couple of months, primarily migrating a customer from FortiClient to FortiEDR.

We haven't done full scale deployments of FortiEDR yet, it's still fairly new.

What do I think about the stability of the solution?

In terms of stability, EDR is a pretty decent solution, but it's not best of breed. One of the challenges with Fortinet, and all of these vendors, is that they are doing acquisitions and doing things to retrofit into their environment, but there's a dependency on legacy or other features that Fortinet has, and Prisma from Palo Alto has. They have their own products, which are how their system is designed. It's really a suite of products. Fortinet is now FortiFabric, with Palo Alto it's Prisma, Prisma Cloud and XSOAR and all that stuff.

All these types of companies are not as flexible. I think in the future, people are not going to be interested in having these huge complex suites of products in order to take advantage of integration.

If you look at a true SASE solution, for example Zscaler, it's a product on its own. And it typically integrates with industry best of breed products first. So Zscaler would work with CrowdStrike or Microsoft Defender before it's going to work with an integrated solution like Palo Alto or Fortinet.

I'm finding more and more that these companies, Palo Alto, Fortinet, Check Point, Juniper, are all doing well right now. But I think in the next year to two, you're going to see a transition away from that type of technology.

It is actually one of Fortinet's big selling points that they're not maintenance heavy and they've got their gang leveraging all the other components. It actually updates itself automatically if you choose. And it has the ability, using FortiManager and other products, where you can push out policies very easily across multiple appliances, although that requires proper design and architecture from the beginning to make sure that you've got cookie cutter configurations across your enterprise.

What do I think about the scalability of the solution?

Scalability is Fortinet's sweet spot, even though they're heavily focused trying to sell into enterprise, their sweet spot is still mid-size, SMB, customers.

Those products work well in an environment which is below 3000 users. It also works well in in terms of large enterprises, like a bank.

I don't see EDR really expanding. Fortinet Firewalls is another story. Firewalls can scale up to very large enterprises, including Telcos, but I don't see the EDR product deployed in those environments.

How are customer service and support?

Their support is getting better.

Right now it is not that good. Fortinet was never big on technical support. I think they went by the theory that if it was hard to write, it should be hard to understand. Their technical support is getting better, but if you compare it to Cisco, it's not as good and it never was. It is one of their weak points. Its response time is not bad, but the attitude of the people on the phone is. It's the amount of information they ask for to do an RMA, for example. They can be very challenging to work for. That's an opportunity for managed security providers, because if you confront them, and take it away from the customer, it makes the customer's experience much better. So a bad support center is good for an MSSP.

How was the initial setup?

The initial setup is complex compared to stuff like CrowdStrike or other products where you can just sign up and download and it, and it works.

It's a little bit more complex with FortiEDR because you're dealing with the setup and management of it, whereas in products like CrowdStrike, it's pretty automatic and it's just a question of a radio button to turn on or turn off additional features that you may want.

For example, going EDR to XDR or going EDR to MDR in CrowdStrike, you can do that in Fortinet but you have to implement FortiSOAR and all this other stuff.

Initially the setup took us a while, simply because we had to mess around with the client. We are talking weeks because we had to test and make sure that there were no performance issues and no interruptions in the flow of data, etc...

That took us probably five, six weeks to get up in a POC type environment. Once we got that, it's cookie cutter. You have an image that you deploy that already has that compiled in it, and it works pretty easily.

What's my experience with pricing, setup cost, and licensing?

Fortinet FortiEDR is priced pretty competitively if you compare it to other companies that are in the same boat, like Palo Alto, who have similar product suites. It is reasonable. In the industry, they call Fortinet the Chevy of Perimeter Security and Palo Alto the Cadillac. I think that's undeserved. I think Fortinet is actually, in the long run, a better product, but it has that reputation because of their pricing. Palo Alto, right off the bat, charged a much higher premium, which created the illusion that you're getting a better product. Palo Alto products are brutally expensive.

But that's the way Palo Alto works and it works for them. Although, I've heard rumors that they're changing their channel model where they're going after enterprise customers directly, rather than forcing it through the channel. Fortinet is a 100% channel, Palo Alto is not. And that's affecting them. If you look at stock prices and earnings, Fortinet is actually doing better.

What other advice do I have?

With any of these products, you need to step back and look at where the wave of technology is going in the security posture. I think that you need to step back and say, "Here's my current situation, what's the best solution two to three years from now?" If you look at that, I don't see Fortinet or Palo Alto or any of those traditional product vendors being the future state.

These companies are like system integrators. A lot of system integrators went out of business mostly because they couldn't make the paradigm shift from a product led business to a service led business. I see the same type of thing happening in the traditional Perimeter Security companies, that are not designed from the ground up. They make an acquisition of a product and they try to integrate it into their business model, and to leverage all their other products in a suite. That's not the way the industry is going.

On a scale of one to ten, I would rate Fortinet FortiEDR somewhere around a six.

It goes back to what I said that I don't think it's got a huge future. If you compare it to CrowdStrike or those type of products, it is very similar to Palo Alto's Cortex, they didn't even come out with an an EDR solution, they went directly to an XDR solution. What is XDR penetration? About 2% of the market right now. It's just not a fit to the future. That's why I give it a six.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer:
Flag as inappropriate
IT Manager at a construction company with 201-500 employees
Real User
Top 20
Excellent at capturing malicious threats together with an aggressive next generation firewall
Pros and Cons
  • "Anti-virus captures malicious threats and an aggressive next generation firewall."
  • "Deployment on cloud needs to be carried out manually."

What is our primary use case?

The main use cases of this solution are for protection from ransomware and malware. Although we don't have EDR because of its high cost, we do have the capability to filter the website. Our use case is more about capturing crypto and the like that can encrypt files. I'm a system administrator and we are customers of Sophos. 

What is most valuable?

I've found that the most valuable feature is the anti-virus that captures malicious threats and the next generation firewall which is more aggressive in terms of not only looking for viruses, but also for SaaS and the movement of equipment. If something strange comes up we're automatically notified and it's either blocked or quarantined. It enables you to prevent future viruses and enables us to inform the user of malicious websites they have visited.

To date, we haven't had any incidents related to viruses or any types of attacks and we barely get any false positives. It's good to know that any malicious anti-virus detected is automatically blocked, although it makes things more difficult for our IT department.

What needs improvement?

There is an issue when deploying on cloud because it needs to be done manually. For an enterprise company that can have 10,000 or even 50,000 end users, it's a lot to deploy manually. An additional feature they might include would be the ability to control the lockdown on hardware; to control all the entry points such as a USB, a camera or any external storage. 

For how long have I used the solution?

I've been using this solution for three years. 

What do I think about the stability of the solution?

I think this solution is stable. It doesn't allow you to do anything that may cause a problem. If you try to download something that is prone to hacking, the solution won't allow it. It's important to use the admin lock to prevent malicious programs being downloaded. It's good at preventing remote users from downloading malware. 

What do I think about the scalability of the solution?

The solution is very scalable because they don't generally deal with small size office deployments of 10 or 15 users. The solution can scale to 100,000 or even up to 200,000 users.  

How are customer service and technical support?

Initially we didn't have phone support, but now it's part of the enterprise portfolio which we have. We only use the support if we have an issue with the server. It's the benefit of the cloud, there are no concerns about the server whereas on-premise you need to synchronize your server or upgrade the new version to get those features.

Which solution did I use previously and why did I switch?

We migrated from Symantec enterprise to Sophos and SentinelOne. The approach is the same for all of them. 

How was the initial setup?

Initial setup for the cloud is very straightforward because it's managed by the company. It's just a matter of downloading the agent and installing to your end point. The on-premise implementation is more difficult, particularly if you're not familiar with it but the support is very helpful. I believe there's a way to roll out without the need to visit individual users. I believe they integrate with an active directory, and then post from there. Deployment time depends on availability of the user's desktop or and/or laptop. If it's on premise, you can push that one, it would take less than 15 minutes. To deploy in a company would take less than a month. 

What's my experience with pricing, setup cost, and licensing?

If you start with the standard solution, move to Intercept X, and then go to the EDR version, it's almost double the price in comparison to other vendors. It's a choice for any company. Check Point's SandBlast, for example, has two payables but the additional payable includes encrypting your hard drive - not everyone needs that feature. 

What other advice do I have?

This is a good product but it comes at a high price. As a result, I would rate this solution an eight out of 10.

Which deployment model are you using for this solution?

Hybrid Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
IT Security Administrator at a tech services company with 1-10 employees
Real User
Provides more visibility than expected and lets us know if anything unusual happens on our network
Pros and Cons
  • "Their XDR agent and their behavioral indicators of compromise (BIOC) are pretty nice. Their managed threat hunting is also pretty nice. They also have WildFire, which is a service for actively looking for malware. It's quite useful."
  • "They've been having some issues with updating their endpoint agents, and it has been quite frustrating."

What is our primary use case?

We have Cortex XDR on our endpoints, and we have managed threat hunting. We are using it for everything related to security. If we have a device we believe is compromised, we can do a scan of the device to check for malware. We look for indicators of compromise in our network. We also look for behavioral things, such as if people are, for some reason, sending a bunch of information out. We also monitor USB file copies to make sure sensitive data isn't leaving our systems. It is also for any kind of denial of service attack.

We are using its latest version. It is deployed on-prem. We have agent software on all our endpoints, and then we have on-prem devices managed through Panorama.

How has it helped my organization?

It has quite a bit of functionality. So, if anything weird happens on our network, Cortex normally lets us know.

What is most valuable?

Their XDR agent and their behavioral indicators of compromise (BIOC) are pretty nice. Their managed threat hunting is also pretty nice. They also have WildFire, which is a service for actively looking for malware. It's quite useful.

What needs improvement?

They've been having some issues with updating their endpoint agents, and it has been quite frustrating.

For how long have I used the solution?

I have been using this solution for about a year.

What do I think about the stability of the solution?

It's incredibly stable. It's Palo Alto; it's top of the line.

What do I think about the scalability of the solution?

It's enterprise-grade. They cover everybody from the federal government to large corporations. We're probably a pretty small network for them. We have about 2,000 endpoints.

How are customer service and support?

I have used their support. I would rate them a four out of five.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We used to have Check Point. We switched because there were a lot of added features with Palo Alto that Check Point didn't have. It was an upgrade for us.

How was the initial setup?

It is incredibly complex. It has a lot of parts. Its implementation took six months.

What about the implementation team?

We worked with Palo Alto directly to look at our old firewalls and translate their configuration to Palo Alto.

There are three of us for deployment and maintenance.

What's my experience with pricing, setup cost, and licensing?

It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff.

What other advice do I have?

You get out what you put in. So, the more you work with it, customize it, monitor it, and manage it, the more you'll get out of it.

I would rate it an eight out of ten. There are some bug updates that they were having issues with. Everything else has been pretty great. There is a lot more visibility than I expected.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
LeonWessels - PeerSpot reviewer
IT Security Manager at Telecommunications Services of Trinidad & Tobago Limited (TSTT)
Real User
Top 5Leaderboard
It gives us visibility of remote workers and allows us to automate a number of events
Pros and Cons
  • "We are hoping to automate detection and response and take advantage of user behavior analytics, given that we are working from home. About half of our workers are still remote, so Active Response gives us that visibility and lets us automate a number of those events."
  • "I also expected Active Response 's user interface to be much more analytical."

What is our primary use case?

Active Response provides endpoint protection for remote workers. It covers primarily laptops and desktops, not servers. Active Response  is replacing our existing on-prem McAfee solution, and it will protect about 1,300 endpoints when fully deployed. We haven't brought in everybody. Right now, we have a parallel implementation of the old system.

How has it helped my organization?

We are hoping to automate detection and response and take advantage of user behavior analytics, given that we are working from home. About half of our workers are still remote, so Active Response  gives us that visibility and lets us automate a number of those events.

What needs improvement?

I expected Active Response's user interface to be much more analytical.
I still haven't evaluated the ransomware features because everybody implements anti-ransomware differently. You need to see these features in action because everyone seems to have their way of doing it. That's something I still would like to evaluate.

For how long have I used the solution?

It's only been about a week since we rolled out Active Response . 

How are customer service and support?

I rate McAfee support seven out of 10. We haven't opened a ticket with McAfee for the new product, but I would say there's room for improvement based on our experience with the old one. 

How would you rate customer service and support?

Neutral

Which solution did I use previously and why did I switch?

We're comparing this to Check Point Harmony Mobile, but we're still going through it. It's hard to say at this point if I see a lot of improvement.

How was the initial setup?

Setting up Active Response is straightforward. We deployed it with Microsoft SCCM. Our team has one engineer and two specialists, and there's a fourth person who can work in either of those roles. 

What's my experience with pricing, setup cost, and licensing?

I expected the price to be better.

What other advice do I have?

We're still in the early stages of evaluating the solution because I haven't yet fully deployed all my endpoints. At this point, I would rate Active Response  six out of 10.  

My advice to those considering Active Response  is to do proper data testing. You should run scenarios and use cases to determine whether this solution fits your organization's needs. Make sure you do those things first because you could do a POC, but it looks different in production.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Director at esupport Solutions Pvt ltd
Real User
Top 10
Provides optimal spyware protection; easy to deploy, easy to use with a good detection rate
Pros and Cons
  • "Easy to deploy, easy to use, and has a good detection rate."
  • "They're restricted to endpoint protection for now, I'd like to see some additional products."

What is our primary use case?

Our primary use case is protection against spyware. We are partners with Kaspersky. 

What is most valuable?

The solution is easy to deploy, easy to use, and has a good detection rate. For the SMB segment, it's an optimal solution that is pocket-friendly, and easy to manage. They have a new training portal which is good. 

What needs improvement?

There were some issues with reporting which seem to have been resolved. I'd like to see them go to the next level by adding more products because they're restricted to endpoint protection for now.  

For how long have I used the solution?

I've been using this solution for one year. I'm a company director. 

What do I think about the stability of the solution?

This solution is stable. 

What do I think about the scalability of the solution?

To date, we've deployed to around 2,000 users without any issues - I can't comment on numbers above that.

How are customer service and support?

I haven't needed to contact technical support. 

What's my experience with pricing, setup cost, and licensing?

Kaspersky pricing is reasonable. If you compare it to other top brands such as Symantec and McAfee, Kaspersky costs 30-40% less.

Which other solutions did I evaluate?

I have also worked with Checkpoint Harmony which is good if you're in the enterprise segment. It gives a complete overview of what is happening in your organization, providing detailed information.

What other advice do I have?

I recommend this solution and think that Kaspersky Antivirus is the best antivirus for SMBs. No doubt about it. That said, I do think the quality of service and ease of use is relatively comparable with any of the other top brands. 

I rate this product 10 out of 10. 

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: partner
Flag as inappropriate
Buyer's Guide
Endpoint Protection for Business (EPP)
June 2022
Get our free report covering Microsoft, SentinelOne, Palo Alto Networks, and other competitors of Check Point Harmony Endpoint. Updated: June 2022.
610,190 professionals have used our research since 2012.