Coming October 25: PeerSpot Awards will be announced! Learn more

Check Point Harmony Endpoint OverviewUNIXBusinessApplication

Check Point Harmony Endpoint is #6 ranked solution in EDR tools and #9 ranked solution in endpoint security software. PeerSpot users give Check Point Harmony Endpoint an average rating of 8.8 out of 10. Check Point Harmony Endpoint is most commonly compared to Microsoft Defender for Endpoint: Check Point Harmony Endpoint vs Microsoft Defender for Endpoint. Check Point Harmony Endpoint is popular among the large enterprise segment, accounting for 51% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a comms service provider, accounting for 25% of all views.
Check Point Harmony Endpoint Buyer's Guide

Download the Check Point Harmony Endpoint Buyer's Guide including reviews and more. Updated: October 2022

What is Check Point Harmony Endpoint?

Check Point Harmony Endpoint is a robust security solution that enables users to use a single piece of software to accomplish tasks that often require the use of multiple pieces of software. It prevents impending threats from doing harm while at the same time enabling users to identify and deal with any harm that results from breaches. 

Check Point Harmony Endpoint provides users with an excellent total cost of ownership. It combines six security solutions into a single powerful solution. Instead of being unwieldy, it is, in fact, a highly flexible solution. Users can easily manage and deploy it on site in their offices or via the cloud according to their needs. It upgrades effortlessly without ever causing disruptions to the work users are doing. The end result is a high return on a user’s investment.

Benefits of Check Point Harmony Endpoint

Some of the benefits of using Check Point Harmony Endpoint include: 

  • The ability to completely protect endpoints from all manner of immediate digital threats. Check Point Harmony Endpoint stops both malware and phishing sites from harming your networks. All files you receive or download are either run through Check Point Harmony Endpoint’s Threat Emulation sandbox, which scans it for malware, or sterilized by a Threat Extraction process. These prevent malware from ever entering your system. It also prevents phishing sites from stealing credentials. The software scans the sites and, if they are found to be malicious, they are locked out of the system. All of this occurs in real time. 
  • The ability to quickly recover from any attack which manages to do damage to your system. Check Point Harmony Endpoint’s automation responds to a threat once it is detected. Any device that is infected is automatically quarantined from the rest of the network and disinfected. This prevents further infection and allows administrators to render the machine safe for use. It also automatically creates reports which break down the nature of the attack and all other relevant details. These reports give users the information that they need to conduct triage and repair the damage done by an attack.

Check Point Harmony Endpoint offers users a piece of security software which is completely cutting-edge. It stands out among its competitors for a number of reasons. Two major ones are the raw power of the solution and the usefulness of Check Point Harmony Endpoint’s built-in automation. Check Point Harmony Endpoint has a high ceiling when it comes to dealing with threats. Users are given the ability to decide how aggressively they want to employ it, which creates a great deal of flexibility. Check Point Harmony Endpoint’s automation is constantly running in the background of the program. It creates reports that empower users to take appropriate steps to protect their systems.

Reviews from Real Users

Sumit B., a consultant at Cognizant, notes the usefulness of Check Point Harmony Endpoint’s built-in automation. He writes, “SandBlast Agent is always working in the background collecting sensitive data, forensics, and notifying users whenever there is a chance of a brute-force attack into our systems. Otherwise, it has been protecting our data at various geographies along with the endpoints that we set up on the cloud. They have been able to filter out or thwart any attacks from the very word, "Go," and make our work very safe and smooth.”

A PeerSpot user who serves as a Network Technical Specialist at a manufacturing company adds that “It's pretty complete for preventing threats to endpoints. Its capabilities are great.”

Check Point Harmony Endpoint was previously known as Check Point Endpoint Security, Endpoint Security, Check Point SandBlast Agent.

Check Point Harmony Endpoint Customers

Boston Properties, Independence Care System, Melbourne Convention and Exhibition Centre (MCEC), Courtagen Life Sciences, Carmel Partners

Check Point Harmony Endpoint Video

Check Point Harmony Endpoint Pricing Advice

What users are saying about Check Point Harmony Endpoint pricing:
  • "Licensing comes free in that first year or is included in the base package. From a commercial point of view, it really just is the renewal cost, rather than a one-time fixed cost or buy-in."
  • "There are three different licensing models including basic, advanced, and complete, and it needs to be selected according to the endpoint."
  • "Initial monies replacing all AVs with a single product is about £10k."
  • Check Point Harmony Endpoint Reviews

    Filter by:
    Filter Reviews
    Industry
    Loading...
    Filter Unavailable
    Company Size
    Loading...
    Filter Unavailable
    Job Level
    Loading...
    Filter Unavailable
    Rating
    Loading...
    Filter Unavailable
    Considered
    Loading...
    Filter Unavailable
    Order by:
    Loading...
    • Date
    • Highest Rating
    • Lowest Rating
    • Review Length
    Search:
    Showingreviews based on the current filters. Reset all filters
    Network Security Engineer at a financial services firm with 51-200 employees
    Real User
    Resilient by design, provides redundancy, and offers ongoing constant improvements
    Pros and Cons
    • "We love that we don't have to upgrade it anymore. They take care of that."
    • "It would be ideal if they had a migration tool of some sort."

    What is our primary use case?

    There have been improvements in the way our organization functions, as, from an administrative perspective, and being available and taking upgrades out of our court if our users need it, it's going to be out there hanging off of AWS's internet or environment. There is no downtime.  

    Theirs (AWS) is probably more highly available than ours. Other than that, it's supposed to be the same product that we were using. It's a Check Point Management Station to a Check Point Management Station in the cloud. Basically, it's not that much of a difference. We have upgraded all the clients since, and we're on one of the later versions of the VPN clients that are supported by the new Management Station. The old Management Station wasn't supporting the newer clients anymore.

    The new clients seem to be faster and more stable. Those are improvements that everyone in the company can appreciate. They can VPN and connect faster. They're more resilient. I've noticed that they try to reconnect. If our internet goes out for 20 minutes and you VPN'd in, it will actually reconnect on its own at the same token, which is amazing. Before, if only the slightest instability of the internet connection disconnected you from VPN, you were then required to put in your RSA token and password, and username. That is annoying for people as a lot of people's WiFi's aren't that great and/or they're in some airport or something and might momentarily disconnect.

    What is most valuable?

    We love that we don't have to upgrade it anymore. They take care of that.

    The upgrade process was nice with the new Management Station compared to the old one. I like how they have the clients already available. I didn't have to download them and upload them as I did with the old Management Station.

    We're happy with the solution overall as it takes away the administrative overhead of operating it and patching it and being able to also sign in through the web browser anywhere as opposed to just having to VPN back to our work and connect to the Management Station in order to use it. We can just use the Check Point portal and just use any browser anywhere. That gives us more options, which we like. 

    I've noticed they're constantly updating the interface and making it easier to use, which I appreciate. When we first started using it, it was really laggy and it was really slow and it was hard to sort some of the computers and users, however, they make updates almost every time that I log in. It gets better and better every day. It has gotten better and it's not as slow as it was.

    There seem to be constant improvements happening, which you can't say for everything. We don't have to upgrade to get the benefits of the improvements, either. That takes a lot off of our plate and allows us to focus on other things. We're taking the good with the bad and the bad seem to be one-offs and we're looking forward to the future.

    Therefore, the most valuable feature is its ability to take the management and the administration of the product off of our plate and onto their plate. We don't have to worry about upgrading it, creating downtime, working off-hours, doing all the research and stress of seeing if it's compatible, if there are problems, letting them test it. That's nice. Previously, we would upgrade our products or patch them maybe two to four times a year, depending on if there's a security vulnerability. Each time we do something like that, it was about three to four hours of downtime. Now, that process doesn't exist. 

    Before, with on-premise, we had two Management Stations. One was primary, one was secondary and there were two different data centers in case one data center was down. The other one would come up and be the Management Station for all of the clients. Now, in this case, we only have one. It's in their cloud. Their cloud is in AWS. It's a great thing. It's resilient by design and it provides redundancy in a single source of administration for us. We like that too

    What needs improvement?

    It would be ideal if they had a migration tool of some sort.

    There were some caveats that we encountered on the new Management Station. For example, they had some features that were not supported by older clients. There are the clients that are running on the laptops, and there are the Management Stations, and then we had one on-premise, which was older in terms of the clients that we were running. Then we had the new Management Station in the Cloud that Check Point is administering as it is a SaaS, which is a benefit.

    The newer Management Station has features that it enforced on the clients that the clients weren't able to support. For example, Windows Service or Windows Subsystem Linux. Everyone in my company that uses Windows Subsystem Linux, which is about 15 or 20 people, that need it on a daily basis, were running the older clients of course, as they were migrated over the new Management Station and they weren't allowed to use that. It was being blocked automatically due to the fact that that was the new policy being enforced that was literally a tick box in the new Management Station that I didn't set. Even if I enabled WSL, it didn't matter. The older clients couldn't take advantage of the new newer Management Station telling them to use it. That was annoying trying to troubleshoot that and figure it out. tNo one at Check Point really knew that was the problem. It took a while to resolve. We finally figured out upgrading may solve the problem. When we did that, we upgraded those users, however, that created a little bit of an issue in the company, as we upgraded those users. We like to test them with a small group and make sure they're stable and make sure nothing weird happens. We were forced to upgrade them without testing first. 

    One thing they still haven't improved on from the old Management Station to the new Management Station, which should totally be an improvement, is when you create a Site List for the VPN clients and you deploy it from the Management Station, you are not able to get that Site List. You have to play around with something called the Track File, which is a miserable process. You have to download the client, decrypt the Track File, edit it, then upload it again to the Management Station and download the client a second time and then test it and make sure the Track File's in the right order of sites as well, due to the fact that it's kind of random how it decides to order the Site List. The Site List is what the clients use to connect to the VPN Gateway, and if you have more than one gateway, for example, for disaster recovery, which we do, then they'll need that list.

    It's something they've never improved on, which I was hoping by going to the cloud and having this whole thing recreated. Since it's more advanced I thought they'd have that ability to edit the Site List with the initial download. You should be able to just add the sites and then that's it. That kind of sucks that you can't. 

    Other than that, the only other thing I could complain about was that they did this process where they did some type of certificate update on the backend of all of their staff solutions. That created downtime for our VPN clients and they didn't notify us of the certificate update. We're using the product in their cloud as opposed to their product on-premise, which seemed to be more stable in that regard. They didn't communicate that out. However, when we spoke to support after about a week, they told us there was this thing they did the past week, and that's the reason why we had that problem. Everyone that had that product had that problem. That really wasn't ideal.

    For how long have I used the solution?

    I've been using the solution for about a year. Maybe a little bit more. 

    We've been a Check Point shop for approximately 15 years. We're very well versed in Check Point.

    Buyer's Guide
    Check Point Harmony Endpoint
    October 2022
    Learn what your peers think about Check Point Harmony Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: October 2022.
    635,162 professionals have used our research since 2012.

    What do I think about the scalability of the solution?

    Seeing that it's in the Cloud, I think it's very scalable and I am impressed with that aspect of it.

    For this solution, in particular, we are using 100% of the Cloud VPN Management Station and all users are phoning home up into the cloud. We're going to stick with it unless they have some severe outages or certificate updates without telling us like they did last time. Right now, there's no reason for us to change and I'm very pleased with the product.

    How are customer service and support?

    To set it up, we relied heavily on technical support as it was new. That said, it's really the same ball of wax, so we're good now. It was just the initial setup we needed help with as it was new to us. We hadn't done much. We had to learn how to connect our software clients to the cloud. We had to use special cloud keys that were proprietary to Check Point. It's like learning a new suite from Check Point. 

    We literally got on this as it was cutting edge. We're like one of their first customers using their SaaS. We were using their VPN and Smart-1 Cloud before most people. When we were setting it up, we're setting it up with their actual product engineers or whatever. It was interesting.

    They changed it a lot since we started setting it up. 

    I'd call them to their support and they didn't even know about anything due to the fact that the support wasn't even trained on the cloud yet. They weren't even trained on their Smart-1. They would just say "we don't know about that yet and/or we can't help you." It was kind of funny. I told our sales team that and they got pissed.

    They called them and they're like, no one should ever tell the customer that you don't know about this yet and it became a big deal in Check Point. 

    That said, I'd rate their service as pretty high. I respect those in the endpoint or firewall department as they largely understand what's going on. At the same time, they do need to get people more people trained up. They don't seem to have trouble keeping people around for a few years so that they learn.

    How was the initial setup?

    After signing up with Check Point, the migration of users took about a month and a half. 

    We had to build out the Management Station in Check Point too and that took from probably January to almost July as we had to build it from scratch. They didn't have a migration tool for our current policy, as it enforces firewall policy on the endpoints locally on the local firewall and that wasn't ideal. We had to build that whole Management Station from scratch.

    I had to go back and forth between the on-premise Management Station and the Cloud Management Station and literally look at every single feature, every single function, every single rule. I had to recreate every single object. I had to recreate every single everything. That took a very long time.

    It was very manual. It's literally two screens and comparing items. That took a couple of months while doing other things, of course. However, that was my priority for about a month and a half. I worked on that a lot. I wish they had a migration tool, like a migrate export for the policy and the features. Once that was created, however, everything pretty much worked. That said, there were a couple of caveats. 

    What other advice do I have?

    We're customers of Check Point.

    I've been working on setting it up and migrating users from the on-premise platform since January of this year. This is their Cloud Endpoint, VPN Management Station versus their on-premise VPN Management Station for Endpoint. We had to migrate the users from the on-premise version using a special tool that you have to ask them to make, which is kind of weird, however, their product is so new that that's the way that they do it. I had to deploy that tool to all the users in our company and that switched them over to their Cloud Management Station.

    I'd rate the solution at an eight out of ten. There's room for improvement, however, I respect it and it works well.

    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    Flag as inappropriate
    PeerSpot user

    Harmony Endpoint is an endpoint security solution built to protect the remote workforce from today's complex threat landscape. It prevents potential threats to the endpoint, such as ransomware, phishing, or malware redirection, while quickly minimizing breach impact with its autonomous detection and response capability. This way, your organization gets all the endpoint protection it needs in a quality, efficient and cost-effective solution it deserves.

    See all 2 comments
    Network Technical Specialist at a manufacturing company with 10,001+ employees
    Real User
    Top 20
    Enables us to integrate endpoints into our IPS and we are seeing things which, without this tool, we would be exposed to
    Pros and Cons
    • "It's pretty complete for preventing threats to endpoints. Its capabilities are great."
    • "We use a couple of Check Point products, like SmartEvent, and SandBlast Agent is not really integrated into that. We haven't gotten the reports working yet. We are working with the account team and trying. As I said, it's still relatively new in terms of what we're trying to achieve."

    What is our primary use case?

    With every new firewall that we're purchasing, we're deploying the SandBlast Agent. At the moment we're only running it on about 20 firewalls, just because the licensing isn't retroactive. What we need to do is produce a proof of concept to say, "This is the stuff we're getting." We're looking at it in a learning mode and then we can consider getting into a more aggressive mode of stopping everything. At the moment, we're trying to use it to give us information rather than to fully stop everything.

    It's deployed on our physical firewalls, on-prem.

    How has it helped my organization?

    We have seen some attempted ransomware in our network. With the firewall we've already got IPS, but we wanted to integrate the endpoints into that as well. That's something we are seeing. Our IT risk team are getting those reports and seeing them and seeing fewer potential attacks.

    It reduces potential downtime through ransomware by reducing risk. I don't think I would go to the CEO and say, "Hey, we've completely eradicated this and that," but it certainly complements other Check Point products that we have. It gives us some more information about what is happening and where it's happening on the network, on-prem, on the applicable firewalls. It's hard to say exactly what it has improved because it just works very well with what we've got. Certainly, with our Windows environment and our VPN, we do see a lot more. But I don't know if there's just more of a focus on the reporting, as a whole, that we're getting.

    We have had previous ransomware attacks, and while we can't necessarily quantify any downtime or loss, there certainly was risk around that. This has reduced our risk in that environment. That's one of the big focal points. From a network operational point of view, could you ask, "Well, has it reduced things?" and the answer is "no," but from an IT-risk point of view, our IT risk team have certainly seen less impact from attacks. We're more proactive than reactive, compared to how we were doing things before.

    We don't see it leading to a reduced number of security engineers. What we do envisage is information and empowerment. Rather than manually having to check this, that, and the other, we're looking at having these tools available and for them to produce actual results. We definitely see this tool helping us do that.

    What is most valuable?

    It's pretty complete for preventing threats to endpoints. Its capabilities are great.

    The solution's automated detection and response capabilities are pretty good. It really depends on how aggressive we want to be with it. We've not deployed it in the most aggressive way you can, such as shutting down everything, because we've not deployed it in a greenfield site. It has not been deployed with that in mind. It has been deployed as an add-on service. As such, we don't want to be as aggressive as some top security firms would recommend we should be.

    What needs improvement?

    We do like the product, although there are quite a few things that we're asking our Check Point account team to enhance, where we think we probably could get more features from it.

    We use a couple of Check Point products, like SmartEvent, and SandBlast Agent is not really integrated into that. We haven't gotten the reports working yet. We are working with the account team and trying. As I said, it's still relatively new in terms of what we're trying to achieve. We probably should have had more Professional Services come and help us. But, from our company's point of view, especially at this time in the market, the finances are just not there. But from what I've seen so far, I don't think there's enough integration into SmartEvent. That's something that I've asked our account team to try to focus on in the next versions or as an enhancement request.

    Integration and deployment are probably the weakest points, and maybe service as well, although they are still at the high end. Would we go out to market and buy this on its own? Probably not, is the honest answer. But because it is a Check Point product and the licensing comes as part of it, it gives us this time to go and prove that, when it's together with all the other products that we have from Check Point, it certainly integrates very well. Would I go and buy this just as a standalone service if we didn't have Check Point firewalls? Probably not.

    For how long have I used the solution?

    We're relatively new to Check Point SandBlast Agent, once they put it onto their firewall platform with the new environment. It comes built-in for the first year, including the cost. We've sampled it, starting about four months ago.

    We had seen it work before. We had demos with it, but it was always something that seemed would be a nice feature to use, but not something the business wanted to buy into, per se. Now that it comes as part of the package for the first year, we thought we'd give it a go and see how it gets on.

    What do I think about the stability of the solution?

    I've had no problems from a stability point of view. It just seems to work.

    What do I think about the scalability of the solution?

    It's definitely scalable. It's whether there is a business appetite. When we get a new firewall, we'll enable it and run it through the service. It's scalable to retrofit. We could do that and we could run that very easily, but that would involve a commercial spend, which at the moment, no one wants to do. We understand that, but the solution is certainly something that is of interest to various people.

    If we get approval then it will move from a PoC to across-the-board. At that point, there would be between 100 and 200 people using it and thousands of agents. It could be scaled out to our whole organization. Again, it's funding-dependent.

    How are customer service and technical support?

    We have Diamond Support, so it's very good, but we pay for the privilege. We have one engineer and a separate TAC team.

    Which solution did I use previously and why did I switch?

    We had a solution but it wasn't really a similar solution. This is the first of its kind for us, for what it does. We do have antiviruses, so that the machines aren't just dead, and we do have our own hybrid package of something that, if you add four of them together, maybe adds up to half of this, but no similar package.

    How was the initial setup?

    It's relatively easy to set up. There's plenty of documentation out there for how you do it. The way we've done it is probably the easiest way of doing it. We're not going all-out. We've gone with a small approach, mainly due to commercial reasons.

    Our implementation strategy is just to switch it on in our new firewalls and see what happens, honestly. That's not always the best approach, but we switch it on in learning mode to give us information on what's out there and to see what we didn't know.

    It took us about three weeks with the first two firewalls, and that doesn't include the firewall build time. That's just setting up everything else and the integration piece. There were two of us involved, me and a colleague. There were "dotted lines" into others, such as our IT risk team where we were asking, "Hey, is this what you want to see?" We're not really offering it as a full service, it's a PoC. If it goes live with a view to deploy it to all of our firewalls and all of our endpoints, I wouldn't say we would need any more people. It would be part of our operational team. The same is true for the risk team. I don't think we would need to get more people, although we see the IT risk team having more of an input.

    What about the implementation team?

    We did it ourselves.  Potentially, if I had an open wallet and a blank cheque book, would we use a third-party? Yes, of course we would, but at the moment that option is just not there.

    What was our ROI?

    Return on investment would be not being attacked. Have we seen any? No. Has it identified certain things? Yes. The way we've got to look at return on investment is, all of a sudden we're less vulnerable to attacks. That's a hard measurement to define. Ultimately, not being attacked, and our reputation, is worth a lot more than just a dollar figure.

    The cost-effectiveness of SandBlast is knowledge and understanding what is happening on our network. Do we have some infections? Are we seeing certain things which, without this tool, we would be exposed to? Yes, we are seeing that.

    What's my experience with pricing, setup cost, and licensing?

    Licensing comes free in that first year or is included in the base package. From a commercial point of view, it really just is the renewal cost, rather than a one-time fixed cost or buy-in. That's for new firewalls. For existing firewalls, we haven't even gotten to that point yet. They don't even want us to look at the pricing. First, we need to think about what the product does. Does it do what it says on the tin? And if it does, then it's a commercial thing. We have quite a good commercial model with Check Point, so we don't really need to worry about that too much. The pricing should be good.

    The licensing, the way they've changed it, is a positive and a negative. Ultimately, Check Point has changed how it operates and now we have to go back and retrofit.

    Which other solutions did I evaluate?

    If this does everything it says it does, I don't see any reason that we would use a different product, because this integrates so well with existing Check Point products.

    What other advice do I have?

    What we've gained is more of an understanding of what's on our network. If I were to go and do this again from scratch, I probably would have looked to integrate more with our Check Point sales team and would have gotten more help from them.

    My advice would be to involve your SE. He can help you through a lot more of the options when you deploy.

    We don't use the solution’s Management Platform for the creation of virtual endpoint management services in the cloud. We haven't got to that cloud point yet. It's something we could do, potentially. We're going to work with our account team about that. But that's the one of the lessons learned: We did it by just playing around with it rather than doing a full deployment.

    I would rate it at nine out of 10. What comes to mind is its effectiveness. Normally, I don't get involved in the costing too much. Is it doing everything that it said it was going to do? Yes it is, at the moment. Could it be enhanced more? Sure. But we have a relationship with Check Point and they do deliver on the RFEs for us. If we say we want it to do this, they'll get their engineering team looking at that.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
    PeerSpot user
    Buyer's Guide
    Check Point Harmony Endpoint
    October 2022
    Learn what your peers think about Check Point Harmony Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: October 2022.
    635,162 professionals have used our research since 2012.
    Basil Dange - PeerSpot reviewer
    Senior Manager at a financial services firm with 10,001+ employees
    Real User
    Top 5Leaderboard
    Good logging facilitates forensics, but policy configuration and deployment are complex
    Pros and Cons
    • "Harmony Endpoint is able to detect, monitor, block, and mitigate attacks on the endpoint and it builds and maintains relevant logs for later inspection."
    • "The application control and URL filtering features are not very strong."

    What is our primary use case?

    The solution should be able to provide next-generation security for endpoints and should be able to monitor, detect, mitigate, and block attacks, as well as provide complete visibility in terms of the chain of events so that forensics can be performed accordingly.

    All of the security features should be provided on a single agent and it should be lightweight and should not have a performance impact on the endpoint.

    Provide required/relevant logs on the console and also should be able to forward to the SIEM solution. So accordingly, a use case can be created. 

    The agent should be tamperproof and the admin should not be able to shut down or stop services without the security team concerned, or by using a password.

    We should be able to integrate and share IOC with other security devices.

    How has it helped my organization?

    The Check Point SandBlast solution, also known as Harmony Endpoint, is able to detect, block, monitor, and respond to any malicious activity that happens on the endpoint. With a single agent deployed on the endpoint, it's able to provide complete EDPR functionality, with help of multiple security features and modules.

    This agent can be pushed either from the Check Point management console or by using other patch management solutions such as SCCM.

    It is able to provide a consolidated security posture for all Windows endpoints on a single dashboard and also provide threat hunter visibility for any security threat on the endpoint, and able to mitigate the same. 

    Provide capability of reproducing any security threat and also provide RCA/attack tree. 

    File/hash can be swiped across the network using the security console, which provides visibility on the endpoint according to its priority.  

    What is most valuable?

    Harmony Endpoint provides complete EDPR functionality using multiple modules and features that are available with the solution. These include Compliance, Anti-Malware, Media Encryption, Port Protection, Firewall, Application Control, Full Disk Encryption, Remote access VPN, Capsule DOC, URL Filtering, Anti-Bot, Anti-Ransomware, Behaviour Guard, Forensics, Threat Emulation, and Anit-Exploit. This group of features is able to protect the endpoint from any next-generation attack. Any of the modules can be enabled or disabled based on the organization's requirements.

    Harmony Endpoint is able to detect, monitor, block, and mitigate attacks on the endpoint and it builds and maintains relevant logs for later inspection. The agent sends telemetry/metadata to the centralized console for forensic purposes.

    Policies for endpoints can be created based on the username or endpoint.

    Integration with the Threat intel platform is helpful for blocking any attack at an early stage.

    The complete solution can be hosted on-premises or SaaS on the cloud.

    Remote access VPN is provided as default in the base license.

    A different Policy Server can be configured and hosted at each location so that the agent does not have to reach a central location to receive policy updates. Policy servers are created using an OVF file, which can be installed on any Virtual Platform such as VMware.

    It has secure communication between the Policy Server and the Management Console using Certificate/SIC communication.

    The agent footprint is small on the endpoint.

    It supports integration with other security solutions for sharing threat intel within an organization or over the cloud.

    The anti-ransomware module is very strong; it's able to detect any ransomware attack at a very early stage.

    Host-based firewall policy configuration is simple, which helps to access an endpoint if the machine is not in the organization's network.

    What needs improvement?

    The Threat Hunting module is not available for on-premises deployment.

    The user has to connect using the VPN to take Policy Server updates when the solution is hosted on-premises. This adds overhead, as the user has to connect to the corporate network to get the policy.

    In the case of a hybrid setup where the Policy and Management Server is on the cloud, the Sandbox appliance has to be on-premises.

    Policy configuration and deployment are complex.

    The application control and URL filtering features are not very strong.

    Application Control databases are generated locally and it does not provide any visibility to the admin on which applications are installed on the endpoint.

    The solution is supported only on Windows and MAC and not any other platform.

    What do I think about the stability of the solution?

    So far, the solution is stable.

    What do I think about the scalability of the solution?

    The solution is scalable we can add multiple policy servers based on requirement and it will be integrated with the central management server (Primary/Secondary). 

    In the case of the SaaS offering, it is managed by Check Point. 

    How are customer service and technical support?

    Technical support is excellent.

    Which solution did I use previously and why did I switch?

    We used McAfee AV but it was not able to provide the next-generation capability that we were looking for.

    How was the initial setup?

    The solution required the Management Console and Policy server for initial setup and it can be increased based on the requirements.

    What about the implementation team?

    We had assistance from the vendor during deployment and the service is excellent.

    What's my experience with pricing, setup cost, and licensing?

    There are three different licensing models including basic, advanced, and complete, and it needs to be selected according to the endpoint. For example, it matters whether it is only required for a Windows endpoint as opposed to providing support for BYOD/Mobile devices.

    Which other solutions did I evaluate?

    We evaluated Windows ATP and CrowdStrike.

    What other advice do I have?

    In case you want to set up the solution on-premises and you want to deploy multiple policy servers, it is complicated. You will need an OVF to be deployed at each location and sometimes, organizations don't have the compute or supporting platform for deployment.

    Also, for connecting remote users there is a dependency on the VPN, hence it's again a challenge for users to connect to the policy server for updates.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    PeerSpot user
    reviewer1521789 - PeerSpot reviewer
    Information Security Analyst at The VPS Group
    Real User
    Top 20
    Good reporting, straightforward to set up, and the features give our users more autonomy
    Pros and Cons
    • "The most useful feature so far has been having a functioning and up-to-date anti-malware scanner."
    • "Sometimes, the Cloud Management Portal can become unresponsive or take a long time to process a query. This in turn will cause the browser to freeze, which will require closing and reopening of your browser."

    What is our primary use case?

    Currently, our servers are not protected by a working anti-virus solution that receives updates. These servers & particularly the business are at extreme risk of not only suffering a breach and losing data, but also have a high risk of infecting the rest of the subsidiaries owned by Tyrion.

    The solution hinges on the following requirements:

    • The ability to be completely managed from a Cloud environment, including the ability to download new signatures whilst not on the corporate network;
    • The ability to generate reports based on set criteria (which can help justify the cost);
    • Ability to generate alerts or notifications to an administrator in the event an infection is detected so that Security Incident Response can be initiated;
    • Where possible, the tool should have the ability to complement existing tools sets, replace already existing toolsets, or bring something beneficial to the table to help strengthen the security posture;

    How has it helped my organization?

    Implementing a fully functioning anti-virus solution gave the company the ability to defend against almost all threats that occur either on or off the network. It has further given the security team the ability to respond to incidents quicker and perform root cause analysis easier, thus reducing the number of man-hours needed to fix a potential outbreak.

    Additionally, it will also give the security team greater reporting capabilities to show the business the types of attacks it faces on a monthly basis. This is through a monthly report & it will help the business tailor security training to its end-users so that they can better defend themselves against these attacks.

    What is most valuable?

    The most useful feature so far has been having a functioning and up-to-date anti-malware scanner. This has found multiple dormant threats that have existed within the business that other anti-virus products could not detect.

    In addition to this, threat extraction & threat emulation have been a big benefit to give the users more autonomy. For example, allowing them to release their own spam emails that were captured by our spam filter, knowing that the files that are released will be scanned and checked for known viruses.

    What needs improvement?

    The only two bug bearers of Check Point SandBlast that I have come across are as follows:

    Sometimes, the Cloud Management Portal can become unresponsive or take a long time to process a query. This in turn will cause the browser to freeze, which will require closing and reopening of your browser.

    The second is that getting useful "administrator" information requires digging into the policy rules via a second management agent installed on your computer. However, once installed, it is easy to navigate and use so is more of a slight inconvenience than a major issue.

    For how long have I used the solution?

    So far, the Check Point SandBlast Agent is in the deployment stage, as we have only had the product for one month.

    What do I think about the stability of the solution?

    Stability-wise, we are 90% happy. If the web console could be made more stable, this would go to 100%.

    What do I think about the scalability of the solution?

    In my opinion, this product is extremely scalable.

    Which solution did I use previously and why did I switch?

    We have used multiple different anti-virus products including those by McAfee, AVG, and Kaspersky. This project was to centralize the AV to one single platform.

    How was the initial setup?

    The initial setup is extremely straightforward. After engaging with Professional services and implementing best practices, we have had only one or two teething issues with the product, which can be easily resolved with a rule change.

    What about the implementation team?

    Our in-house team implemented the tool with vendor support. Vendor support was extremely knowledgeable of the product and its capabilities

    What was our ROI?

    The number of man-hours saved administering multiple AV systems has been the biggest ROI.

    What's my experience with pricing, setup cost, and licensing?

    Initial monies replacing all AVs with a single product is about £10k.

    Which other solutions did I evaluate?

    We looked at Kaspersky, CloudStrike, and VMware Carbon Black.

    What other advice do I have?

    If you have never used a Check Point product before, I would highly recommend engaging with a Professional Services provider to help with the deployment of the tool & ensuring you implement the tool based on best practices.

    Additionally completing the training for the Checkpoint Sandblast tool will equally achieve the same goals.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    PeerSpot user
    Adhi Wahyu - PeerSpot reviewer
    Network Engineer at RSUP Dr. Sardjito
    Real User
    Top 10
    Great real-time scans, east central management, and helpful support
    Pros and Cons
    • "The reporting feature where we can see and monitor what happened on our client computers is useful."
    • "They need to make the user interface on the server more intuitive and user-friendly."

    What is our primary use case?

    We use Check Point on our 500 computers to protect them from viruses and malware. The network is a protected local area network with limited connectivity to the internet. Not all computers are connected to the internet; only users with the necessity to connect can access it. We also increase the protection from viruses/malware by disabling USB ports for mobile storage. With all the protection steps taken, we still see that antivirus is a must to have as standard computer protection.

    How has it helped my organization?

    With all security steps taken to protect the network, viruses and malware still appeared in the network. Check Point Harmony Endpoint (endpoint antivirus) has helped our organization by preventing further damage to the computers and the network by detecting and taking appropriate action (quarantine, clean, delete) to viruses and malware. 

    By doing this, our organization's business can maintain its operational state without any significant disturbance, and that is the most important thing to achieve.

    What is most valuable?

    Some of the most valuable features from Check Point include:

    1. Its ability to run real-time scans in the background and detect all the malware and viruses while taking action to clean the system from the threat.

    2. On-premise centralized management, so the client can do signature updates locally and save the internet bandwidth.

    3. The reporting feature where we can see and monitor what happened on our client computers. For example, which client has out-of-date signatures, which client is infected by what virus, et cetera. 

    What needs improvement?

    Some areas of improvement could be :

    1. Making the user interface on the server more intuitive and user-friendly. 

    2. Making it easier for the user to do tuning and configuration to the server or the client application. For example, to turn off notifications, the user should be able to do that with some clicks on the user interface instead of searching and reading about how to do it in the knowledge base first and then trying to do it.

    3. Our application version is quite old, and Check Point already released a newer version for endpoint protection, which includes a cloud version. After doing some trials, we see that Check Point already made many improvements to the features and user interface.   

    For how long have I used the solution?

    I've been using the solution for five years.

    What do I think about the stability of the solution?

    Tthis solution runs with good stability.

    What do I think about the scalability of the solution?

    If we deploy it on-premise, we should see the server hardware requirement first and match it with the number of clients we want to handle.

    How are customer service and support?

    Customer service gave good support when we needed it. For example, when we need support on renewing the license or when we need to upgrade the client version, they have a quick response time to deal with the problem.

    How would you rate customer service and support?

    Positive

    Which solution did I use previously and why did I switch?

    We did use a different solution previously. We switched as we want to use the same brand for our NGFW and our endpoint protection.

    How was the initial setup?

    The setup was quite straightforward. We installed the server first and then made the client installer. If you have an active directory on the network, you can install it with push installation. That said, we don't have it, so we needed to install the client by accessing the client directly.

    What about the implementation team?

    We implemented the product together with the vendor and an in-house team. The vendor team has good knowledge when it comes to implementing the product.

    What's my experience with pricing, setup cost, and licensing?

    At the time we purchased it, the licensing was separated into some modules. There were antivirus modules, data protection modules, and full modules if I'm not mistaken. You should make sure that the module you choose fits your requirement. 

    Which other solutions did I evaluate?

    We evaluated the ESET antivirus.

    What other advice do I have?

    Check Point has released their new product on endpoint protection, which includes a cloud version. You could try it for free to see if this product matches your needs before purchasing it.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    Flag as inappropriate
    PeerSpot user
    Mantu Shaw - PeerSpot reviewer
    Sr. Technology Architect at Incedo Inc.
    Real User
    Top 5
    Endpoint security Solution
    Pros and Cons
    • "Forensic Analysis provides a complete analysis of threats via detailed reports."
    • "Endpoint vulnerability management is one of the modules I believe is missing and it is something that is required."

    What is our primary use case?

    It's a very good solution and it is a complete endpoint security solution. We get almost all the features we need, including features like Threat Emulation/Threat Extraction, Antibot, Anti- Exploit, Anti Ransomware protection, UBA, Zero-day Phishing protection, Behavioral Guard,  Encryption, VPN, compliance, and many more. It's well integrated with Check Point Threat Cloud, as well as other Check Point solutions. The product provides complete visibility of threats with forensics analysis. There is direct Integration with all well-known SIEM solutions as well as the support of standard SIEM integration features.  

    How has it helped my organization?

    It improves our organization's security posture as well as endpoint performance. The single-agent has multiple features and we have no need to use multiple solutions for endpoint security. The required features are supported by Harmony Endpoint. During the pandemic, one of the major requirements is to connect corporate resources in a secure manner. It helps us with secure connectivity.

    During the pandemic, the threat landscape has increased as every endpoint is an entry point for any threat and it is critical to secure. Every endpoint with advanced/latest technologies and Harmony Endpoints provides the same level of safety.

    A single dashboard provides complete visibility over endpoint security.

    What is most valuable?

    The features available are all good. One of the best features is the Ransomware Protection Feature. It is great and is a way to protect endpoints. It protects as well as it saves original file copies to prevent data loss.

    Zero-Day Anti-phishing detects phishing sites in real-time and prevents users from any data and other losses.

    Forensic Analysis provides a complete analysis of threats via detailed reports. Threat prevention with an included detailed threat landscape is very good.

    The VPN connectivity and compliance check are also very good features. 

    What needs improvement?

    Endpoint vulnerability management is one of the modules I believe is missing and it is something that is required. I recommend adding this feature in an upcoming release as it will provide complete visibility of endpoint vulnerabilities. 

    Endpoint Patching is another good feature that could be added and is required to mitigate vulnerabilities. 

    Currently, the DLP Module is not available and it is one of the requirements from an endpoint perspective. It would be good to add in an upcoming release.

    There needs to be improved integration with the on-premises/Azure AD.  

    Software deployment needs to be added.

    For how long have I used the solution?

    I've used this product for the last one and a half years.

    What do I think about the stability of the solution?

    It's a very stable product. It's easy to deploy and manage.

    What do I think about the scalability of the solution?

    It's very scalable.

    How are customer service and technical support?

    It's a good and technical team. They are very supportive and any help required by the development team receives some form of resolution.

    Which solution did I use previously and why did I switch?

    Yes, we used different products earlier, however, due to the fact that the feature available is more advanced here than in others and there are lots of add-on features, we prefer this.

    How was the initial setup?

    It's straightforward and not complex.

    What about the implementation team?

    We implemented the product with the help of OEM and our in-house team. There were no major challenges during implementation or even in day-to-day operations.

    What was our ROI?

    A single Administrator can manage the complete solution. It's easy to deploy and does not require any additional effort. We're able to have multiple solutions within a single solution.

    What's my experience with pricing, setup cost, and licensing?

    I strongly advise others use Harmony Endpoint as the deployment, integration, and setup cost less than others.

    Which other solutions did I evaluate?

    Yes, we evaluated other products as well but with respect to feature price and integration availability, we selected this product.

    What other advice do I have?

    It's a very good product. Over the past year, the team has been improving it day by day and we're now more focused on endpoint security with the latest features on offer.

    Which deployment model are you using for this solution?

    Public Cloud
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    PeerSpot user
    LuisRodriguez1 - PeerSpot reviewer
    Support Manager at Sefisa
    MSP
    Top 5Leaderboard
    Stable with great centralization and continuous innovation
    Pros and Cons
    • "They have a great knowledge base that you can leverage as a user."
    • "The only thing that our customers want, is lower prices."

    What is our primary use case?

    We use the solution for many things. We don't only use it as an Endpoint client for antivirus. It is used for our next-generation antivirus. We are also using Harmony on other things, for example, our email. There's a Harmony email and office solution, which we also are using in order to protect our email.

    What is most valuable?

    The fact that everything is centralized is great. For example, the management is centralized on one portal in the cloud. 

    We like the fact that we have a lot of visibility with this solution and the protection is very good. I have seen cases where customers, get attacked by ransomware and it is very easy for Check Point to restore a file that has been compromised with ransomware. It's 100% effective. 

    They are developing new technologies. For example, they added SASE to their portfolio with Harmony. They also have Infinity SOC. If one of the Harmony Endpoints gets compromised, Check Point Infinity SOC is going to see it, and it's going to highlight that.

    They're on the very edge of technology and are very fast with implementing new technologies. 

    The solution is very stable.

    They have a great knowledge base that you can leverage as a user.

    The product scales well. 

    Technical support is knowledgeable and responsive.

    Every now and then, every vendor does have a vulnerability that is discovered. For example, when many vendors were using open SSL, they had to do some fixes on their software in order to fix that particular vulnerability. Check Point was the first one to fix that. It's clear that, unlike the competition, it is always keeping up with the patching of its own software.

    What needs improvement?

    We'd like it if the solution continued to add new features. For example, what would be specifically useful to us is a feature that allows threat hunting. They may be already working on that or have something available, however, we need something robust and effective.

    I'm not sure if they need to improve anything right now. They are already developing new aspects that are quite innovative. 

    The only thing that our customers want, is lower prices. 

    For how long have I used the solution?

    I've been using Check Point for 18 years.

    What do I think about the stability of the solution?

    The product is very stable. There are no bugs or glitches. It doesn't crash or freeze. It's reliable. 

    What do I think about the scalability of the solution?

    We have found the solution to be very easy to scale. If you need to expand it you can do so.

    How are customer service and support?

    They have good technical support. They have very knowledgeable people, depending on the solution. Some specialize in Harmony Endpoint. It's very good.

    How was the initial setup?

    The initial setup is very easy. The management is on the cloud, and therefore, you practically don't have to do any installation. You only log in and then you begin to use it and you begin to deploy on your network, the endpoints. The time it takes to deploy depends on the size of endpoints you have. With a small network, such as 100 endpoints, you can do it in one day or a couple of hours. 

    What's my experience with pricing, setup cost, and licensing?

    But they are a leader in detecting threat, therefore, it's reasonable that they are a little more expensive than some other competitors. However, customers always want to pay a bit less.

    What other advice do I have?

    We are a reseller.

    My advice to new users would be to reconsider installing administration servers on-premise. The cloud solution can do it. It's going to lower the maintenance costs. Also, if you are on-premises, you often need some sort of expert on-side, whether it's a vendor or someone else - especially if you are upgrading. That requires knowledge. In contrast, on the cloud, everything is done for you. They have a high availability network so that when you upgrade the servers can keep up. You can upgrade without downtime if you choose the cloud. 

    I would rate the solution at a ten out of ten.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: My company has a business relationship with this vendor other than being a customer:
    PeerSpot user
    José Javier Dominguez Reina - PeerSpot reviewer
    Project Manager at Junta de Andalucia
    Real User
    Top 5Leaderboard
    Enables us to centralize all the security software used in a console and avoid ransomware
    Pros and Cons
    • "The graphical interface is very easy to use and intuitive, which greatly facilitates the work and greatly facilitates the work and the location of threats on the users' computers."
    • "SandBlast Agent had moments in which it had a high load, we escalated it to the CheckPoint support that helped us to stabilize it. We had a problem with the parameterization of the solution. Once corrected by following the CheckPoint instructions, everything worked normally again."

    What is our primary use case?

    We were looking for a solution as complete as possible to replace the existing antivirus and, if possible, integrate it with other products that we have, such as the CheckPoint firewall.

    We decided to use the Check Point SandBlast agent to prevent ransomware on users' computers.

    We subsequently expanded the scope of the solution to detect malicious activity on our network.

    It is a very complete product but you have to know how to parameterize it well to avoid high CPU consumption.

    It is also missed that it does not have a client for Linux.

    How has it helped my organization?

    Check Point SandBlast Agent allows us to centralize all the security software used in a console and avoid, mainly, ransomware in the company.

    Many of our users have laptops to carry out teleworking, with this tool we can secure their web browsing, and in the event of suffering some type of attack, the computer is notified by SandBlast Agent and provides information about it and the security actions carried out. It even allows you to restore files modified during the attack.

    You also have the option of performing a forensic analysis of the infected computer by providing a lot of information.

    What is most valuable?

    What we liked the most about the product, apart from detecting any attempted attack, is the graphical interface.

    The graphical interface is very easy to use and intuitive, which greatly facilitates the work and greatly facilitates the work and the location of threats on the users' computers.

    We also highly value the anti-ransomware functionality, which creates a copy of the files on the computers and in case of infection by ransomware is able to restore them to a date when the computer was not infected.

    What needs improvement?

    It is a very complete product but you have to know how to parameterize it well to avoid high CPU consumption.

    SandBlast Agent had moments in which it had a high load, we escalated it to the CheckPoint support that helped us to stabilize it. We had a problem with the parameterization of the solution. Once corrected by following the CheckPoint instructions, everything worked normally again.

    It is also missed that it does not have a Linux client since some administrators use this type of operating system.

    For how long have I used the solution?

    I have been using SandBlast for over 1 year now.

    What do I think about the stability of the solution?

    It is a very mature product that provides great stability in service.

    What do I think about the scalability of the solution?

    It is a very mature product with good performance. Currently we have not needed to use its scalability.

    How are customer service and support?

    Our experience with customer service and support is very good, the support is totally professional and responds quickly.

    How would you rate customer service and support?

    Positive

    Which solution did I use previously and why did I switch?

    Previously, we used third-party antivirus software and switched to Check Point SandBlast Agent for its ease of integration with other Check Point products and to improve protection against ransomware.

    How was the initial setup?

    Initial setup is easy, policies and user groups are defined and then applied. Then we adjusted the policies until we got what we needed.

    What about the implementation team?

    We implemented it with an internal team and when we had doubts, we consulted the manufacturer's support with a totally satisfactory result due to their great experience.

    What was our ROI?

    Currently we have not quantified our ROI but we have avoided the loss of information on user computers due to viruses, ransomware, ...

    What's my experience with pricing, setup cost, and licensing?

    The cost of the solution is similar to other products on the market.

    Which other solutions did I evaluate?

    We have been evaluating other products, such as Bitdefender and Broadcom (Symantec Enterprise).

    What other advice do I have?

    It is a very complete product but you have to know how to parameterize it well to avoid high CPU consumption.

    It is also missed that it has no client for linux.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    Flag as inappropriate
    PeerSpot user
    Buyer's Guide
    Download our free Check Point Harmony Endpoint Report and get advice and tips from experienced pros sharing their opinions.
    Updated: October 2022
    Buyer's Guide
    Download our free Check Point Harmony Endpoint Report and get advice and tips from experienced pros sharing their opinions.