Cisco Secure Endpoint Reviews

Cisco Secure Endpoint, often paired with Firepower and Cisco Umbrella, is primarily used for perimeter security and DNS protection.

The tool's most valuable feature is its integration with other Cisco products, such as switches and routers. This integration allows comprehensive coverage of security parameters across the customer's entire network. Customers find it easier to manage because they already know Cisco products. The cloud-based management is another valuable feature, enabling customers to manage their security from anywhere with an internet connection.

Cisco Meraki could benefit from AI assistance or intelligent assistance features. Compared to competitors like Juniper, Cisco Meraki currently lacks a digital network assistant, which is an area Cisco is reportedly working on.

I have been working with the product for three years. 

The solution is very stable. I don't hear complaints from customers about it not working right.

I rate the solution's scalability a nine out of ten. 

Palo Alto has a portfolio similar to that of Cisco. 

Setting up Cisco Secure Endpoint is complex, primarily because it needs to be tailored to each customer's specific needs and network configuration. Factors like whether the customer has a segmented network or uses VLANs affect how the solution is implemented.

While it's straightforward for a customer with ten branches, it becomes more complicated with 30-50  branches - not due to technical issues, but because of logistical challenges. 

One or two people are enough for deployment for complex cases with 20-30 branches. They're network or security specialists with Cisco certifications like CCNP or CCNA. The number depends on how complex the project is, but most times, it's pretty easy to deploy. We also typically need one or two people for maintenance, depending on how many branches there are and how complex the project is. If there are more than 50 branches, it can be complex to manage. Our solution architects often have CCNP certification, which helps manage the customer's network across branches.

The solution's price is about the same as that of Palo Alto solutions.

I recommend Cisco Secure Endpoint to others. It has been around for a long time and knows its stuff. Their Talos intelligence tool allows customers to see and secure their networks. I rate the product a nine out of ten. 

We use this solution to protect our IT environment. We use it to secure our user endpoints.

It gives awareness of our users' security posture.

The console feature gives a centralized management of what's going on, and if something happens, it gives you an alert. That's the most important feature for me.

Compared to other products, Cisco Secure Endpoint has some limitations and issues, it is still catching up with competition. For example, protection for USB is fairly recent and it is still limited to Windows platforms, and there are significant differences in the product packaging and distribution for Windows and MacOS platforms.

Another area of improvement is stability.

I have been using Cisco Secure Endpoint for two years.

We had a couple of deferred releases this year.

I rate the solution’s stability a seven out of ten.

Our deployment is very small. We only have a few dozen endpoints. So I can't really say if it scales well to a large number of endpoints. However, it seems like it could scale well so, the solution could be easy to scale up as needed.

The customer support team solves the problems, but it takes a while to contact them. 

Neutral

The initial setup is straightforward.

Overall, I rate the solution an eight out of ten.

We secure the laptops down, making sure that where we build the policy, every policy is consistent on every laptop.

It has greatly improved my organization from a security standpoint.

The most valuable feature is being able to push a policy. Whenever we update a corporate policy, we update it in one place, push it down, and it updates the policy on every laptop.

Secure Endpoint is good for creating actionable alerts so we can detect and remediate threats. If somebody does get infected, we don't have to wait for them to say, "Oh, I can't use my email." We immediately know about it. We would absolutely know about the problem before the person did. That was our biggest impact.

Secure Endpoint decreased our time to remediation. Where it used to take us a month to find out that something is infected, we now know that same day, as soon it is infected.

Cisco Secure Endpoint has helped improve our cybersecurity resilience. We only have about two IT guys. So it just makes them better at what they do. It saves them time, so they can focus on other things.

It saves them time so they can focus on other tasks.

It does a great job for what it is. The user interface face could be slicker. It does not have to be flashy, but the user interface is dull.

I have been using Cisco Secure Endpoint for two years.

The solution is rock solid.

The solution is really easy to scale.

I have engaged with tech support and I think they're great at what they do, two thumbs up. I recommend them.

We were using Avast and Norton. We felt it was time to switch to something Cisco branded that we could trust because we are a Cisco shop. All of them are proactive, but identity services was a big reason we switched to Secure Endpoint. You cannot really hook Norton into a Cisco ICE. We chose it for the integration abilities.

I rate the product a ten out of ten.

We saw this product with a partner. We installed it and configured it properly along with our antivirus solution. We monitor it almost every day to see what's going on. Up till now, we are very happy with the performance.

We check every day if there are any indicators of compromise, if there are any workstations that need particular attention, or if there are any peculiar or strange events.

The main benefit is that we have visibility on the network. With the combination of Cisco Secure Endpoint and our antivirus, we feel a little bit more secure. We have better monitoring of and overview of what's going on in the network.

It's reliable. It's doing most of the jobs for us, so we don't have to worry. We check it for just 15 minutes per day to be sure that everything is fine.

It doesn't save time, but we feel more confident that everything is okay on the network. It improves our security posture.

It's quite simple, and the advantage I see is that I get the trajectory of what happened inside the network, how a file has been transmitted to the workstation, and which files have got corrupted.

It's able to detect and help remediate threats. So far, my experience is very good. I trust this product. It's quite simple, fast, and reliable. The dashboard and reporting are also quite good.

In terms of features, I don't have any areas for improvement. It has a good interface. Its reporting is also good, and the updates are very frequent. Its price is okay for us, but it can always be better. There's always room for improvement when it comes to pricing.

We have been using this solution for more than a year and a half.

It's reliable. We haven't had any problems so far.

It's easy to scale.

It has been excellent so far. We don't have any problems. I'd rate them a nine out of ten.

Positive

It's the first time we are using this kind of product. We didn't use any other product previously. 

It was quite easy for us. It probably took us three days.

We have a lot of partners, but Netbull is our partner in Greece for Cisco Secure Endpoint.

Its price is fair for us.

We didn't evaluate other products. We had seen this product before. We discussed it with our partners, and we just went for it. Our main thought was to go with a product and brand that we can trust. All our core network is Cisco, so this was the product that came straight into our head.

I'd rate Cisco Secure Endpoint a nine out of ten. It's excellent.

It is used especially to connect with MDM, covering security and monitoring services.

It protects user devices, especially for field services.

Customers need some infrastructure on the cloud, e.g., Amazon and Google. We also need some testing and stage environments to perform tests.

We need to follow many countries' laws about data privacy. This is a requirement that is key for users. Cybersecurity resiliency has been important for us because we need to protect against loss.

The most valuable feature is its threat protection and data privacy, including its cyber attack and data protection, as we need to cover and protect data on user devices.

It could be improved in connection with artificial intelligence and IoT.

I have been using this solution for three years.

The stability is good.

It doesn't require much maintenance, just in a few cases.

It is good.

The technical support is fair. I would rate them as nine out of 10.

Positive

We previously used IBM. We switched because customers made decisions to work natively with the Cisco features, especially on infrastructure and security environments.

In many cases, we can deploy it in a week. In other cases, we have to connect and test with more complex architectures. However, this is not related to the security endpoint services. The testing around another product is important, so it can take two to four months.

We use the agile method for our implementation strategy.

We worked with IBM, Amazon, Google, Microsoft, and a few partners.

It takes three to 10 people to do the deployment, including pre-sales and technical guys, testing guys, and some software architecture.

We get more value out of our portfolio. We have pretty much seen ROI. When the endpoint service is well connected devices, it covers many important key features,

The price is very fair to the customer.

We need to be open as an integrator to figure out other situations and features, especially from Microsoft and IBM. Everything is related to the customer's architecture, which is why we have to be open-minded. 

I really recommend to test and connect it with different devices, especially mobile, tablets, notebooks, and servers. Then, the potential customer can understand the value of naturally integrating all these devices together.

When it comes to data security, it is important to protect the data.

I would rate the solution as nine out of 10.

Cisco AMP is an anti-malware and antivirus product. It provides endpoint protection. We use it as our antivirus and anti-malware tool. We put it on all our computers. Our employees have it on their laptops because they leave the network and we can't protect them everywhere. Microsoft Windows comes with a built-in tool but it's not quite as powerful. So we use Cisco AMP and Microsoft System Center Endpoint.

Cisco AMP is our primary solution, but we don't uninstall the free ones that come with Windows.

It runs a little agent on the computer and then you manage it from a website platform. There is an application installed on the computers and they all connect up to the management console, which is hosted in Cisco's cloud.

You can use it for single endpoints. We have 3,000 that we use and then there's the free version of it you can use for home.

The actionable alerts in the security console are very good and very useful. They alert us immediately when something happens so that we can take action faster, instead of having to wait until a user report's something or until we view the logs. It sends you alerts so that you can know about them as soon as they happen and remediate the problem. It's a very nice feature.

The solution also makes it possible to see a threat once and block it everywhere, across all endpoints and your entire security platform. You can identify a threat and then mark it as, "If you ever see this file, delete it." It uses something like crowdsourcing, where, if someone works for another company and has AMP and it detects a malicious file on that person's computer, it then updates so that my AMP knows about the virus at that person's company, and protects my company from their virus.

Cisco AMP simplifies endpoint protection detection and response workflows. I'm the only one who manages it now, so it frees up time for a lot of other people. Once it is deployed and set up, one person can manage and maintain it. That reduces the number of people you have to pay for those responsibilities. The console will show if an AMP agent has checked in and I can use all the search features it has. And it deletes all the viruses so I don't really have to do too much, once it has been installed.

It has also minimized security risks to our business that we were previously unaware of. It points out vulnerabilities in software that is already installed, such as in Microsoft Office. If you don't have the latest version of Office, AMP proactively lets you know that you could potentially be infected. We didn't have that before. It has a more comprehensive database that's made up of all the information it has collected from my company and all the other companies that use it. It takes all that information and protects your environment from anything it's ever seen.

When it comes to time to detection, Cisco AMP has taken it from one day to one hour. And our time to remediate has gone from hours to minutes. It does it itself, so we don't have to do anything. 

I can't think of a case where a computer was infected and AMP did not let us know or missed it. It has never happened to us that the product didn't detect something while another product did detect that problem. So far it has been 100 percent successful.

I like the central management console where I can see everything that's going on, on all the computers. 

Another of my favorite features is called the Device Trajectory, where it shows everything that's going on, on a computer. It shows the point in time when a virus is downloaded, so you can see if the user was surfing the internet or had a program open. It shows every running process and file access on the computer and saves it like a snapshot when it detects something malicious. It also has a File Trajectory, so you can even see if that file has been found on any of your other computers that have AMP.

One of the things that is most impressive is its ability to give so much insight. That's another of its best features. With the File Trajectory, it shows everything the computer's doing and it can help determine how the virus got onto the computer.

You set it and forget it. Once you install it and configure it, it runs the reports, putting everything on the central web console.

You're able to subscribe to alerts, so I get an email every time it deletes a virus off of someone's computer. I also get an email if it has a problem, such as if it was unable to delete the entire virus. It will say "Quarantine unsuccessful."

It allows as many people as you want to go in and view it. And you set people as administrators or as people that can just view the information.

AMP also has several tools you use to link to websites that contain more information about things. They're useful as well. They give you the ability to look at different companies' information; for example, a virus total. You can also connect it to other modules and tools that you have, and it can do things such as quarantine where it will take a computer off the network for you automatically. Those tools are helpful. It provides a concept they call "distance and depth," where you get more than one company's opinion on things.

We just started using its Orbital Advanced Search feature. It's relatively new, so we haven't used it a whole lot, but for the little bit that we have used it, it has been a really neat tool. I've only run it on a couple of endpoints so far, but it works pretty well. It just gives you that extra insight to help better understand how the rest of your environment could be affected. Obviously, you're dealing with a computer that has a virus already and this gives you an ability to assess what else could have happened with that virus. It helps provide more information. 

The Orbital Advanced Search feature also helps to reduce the attack surface and to investigate real-time data on our endpoints. Some of the queries will show you which software packages you have that are vulnerable, like a version of an Office program or an Adobe Reader that has a vulnerability in it. Once you know that information, you can proactively patch the computer or apply updates to it so that it does not become infected. It alerts you to an infection, and then you can say, "Oh, these other computers could be infected by that too." Orbital detects those computers. It reduces the amount of time we spend on that kind of situation by about 20 percent.

In terms of the comprehensiveness of the solution, it does Windows great. It works on Macintosh very well. It also does iPhone and Android. It's pretty comprehensive since it covers the majority of operating systems.

It also integrates very well with other Cisco products. It has an API interface so you can integrate it with just about any Cisco product. It does have some out-of-the-box stuff and definitely integrates great with all the other Cisco tools. But we use something called Rapid7, it's a vulnerability scanner, and it's able to integrate with it very well to help report data. It works well with some third-party products, but I'm not sure how many.

The endpoint agent on a machine doesn't provide much data. 

And the thing I hate the most, which they have not fixed, is when it creates duplicate entries within a console. If you have a computer and you upgrade from Windows 7 to Windows 10, or you upgrade your agent from version 6 to 7, it creates a new instance in there instead of updating the information. Instead of paying a license for one computer, I have to license two computers until I manually go in, search for all the duplicate entries, and clean them out myself. There are features that are supposed to work that don't that reduce the duplicates.

I've been using Cisco AMP for Endpoints for five years. I started with the company as they were in the process of determining if they wanted to use it and they decided they wanted it. I have been managing it ever since. We're upgrading everybody to 7.1.5. They were on version 6.2 for a year. Before that, it was 5.1.

It's stable. We only had one or two instances, over five years and 3,000 computers, where the agent has stopped working and we had to reinstall it. That's a pretty high percentage of availability, like 99.9 percent of the time there have been no problems.

Their technical support is the best. I've never had technical support better than Cisco's in my 15 years working with different companies. Nothing is better than Cisco TAC. The response time is always within an hour or less.

If you don't get a response in that time, you can have the case put back in the queue. You can easily escalate it. When you open a case, it tells you the engineer who is assigned to it and then gives you a manager's contact information so you don't have to say, "Let me speak to your manager." You already have that information.

There are tons of support people working 24 hours a day, seven days a week. 

Also, there are so many users — Cisco customers — that even searching the information online through their support Knowledge Base is good and easy to do, if you don't feel like talking to somebody. You can find a lot of information online whereas one of Cisco's competitors, Palo Alto, has a tool called Traps. It would be a lot harder to find information about that.

We replaced a Norton product with AMP. Now, we run the default Windows tools that come with it, along with Cisco AMP. The Windows solutions are free but we wanted to buy a more robust one with better ability to search and do forensics. There are similar solutions to Cisco, but it has definitely been an improvement over previous stuff that we've used.

We have a lot of other Cisco products that it integrates with, and that was one of the reasons we chose Cisco AMP. We did a demo and it was good and it answered the questions we had. We wanted to be secure, so we needed to find an antivirus tool that works. It makes it easier for us to monitor all of the computers for viruses.

I helped set up and deploy it. It was pretty straightforward. You go to the web console, tell it to create a package, download it and then install it, and you're done.

With 3,000 computers, we rolled it out at about 1,000 at a time and it took about three months. We could have done it in a week. We just did it very slowly because any changes you make, you're supposed to do a test community of computers. We did the IT people first because they're smart at troubleshooting things. 

There's another tool from Microsoft called SCCM, a deployment tool, and as we upgrade the client it takes two days to push it out to the thousands of computers because some people don't turn on their computers for a day or two. Everybody is going to do their deployment differently.

We have seen return on our investment with this tool. The amount of stuff that it detects and blocks has been very valuable.

The pricing is very good and the licensing is somewhat of an honor system. We have a license for 3,000 users and if we get up to 3,100 users, it doesn't stop working, but on the next renewal date you're supposed to go in there and add that extra 100 licenses. It's really good that they let you grow and expand and then pay for it. Sometimes, with other products, you overuse a license and they just don't work.

Once you pay a license for a client, that's it. Everything else we talked about, the integrations and those kinds of things, is free. There's only one level of licensing too. Some products are set up so that if you pay this much you get these features and if you pay that much you get those features. Here, everything comes with one price.

The main competitor was Palo Alto with Network Traps. The difference was that Traps would detect viruses but it would not delete them or clean them, whereas AMP did, right out-of-the-box. AMP also worked with multiple operating systems, as I mentioned and the Traps solution did not offer that at the time I looked at it.

They keep adding more features to it and there are features you can enable and turn off. One of the best, newer features addresses the fact that it did not work unless you had an internet connection. They put an antivirus engine on there that works when it does not have an internet connection. That was a big deal. It has a lot of capabilities. They keep developing more for it, which makes it a better product.

Be sure to password-protect it so that users can't disable it. It has a feature to add a password to it which prevents the user from uninstalling or even stopping it. Also, enable that offline antivirus engine called Tetra. You want to be sure to enable that so that it works when it doesn't have an internet connection.

Using the product, what I've learned is that you need to keep the client up to date. One of the hardest things is that people have computers that come and go. Someone might have a laptop that breaks and the company will give them a new one. You've got to manually find that broken laptop and delete it. You want to make sure you go in there frequently to ensure that the information is accurate or up to date. If you wait too long and there are hundreds and hundreds of computers you have to search and work. That's way too much.

We did Threat Response and we did a demo of Threat Grid and did not move forward with it. We had it integrated with ISE and Umbrella. Threat Response provides a little bit more information but, honestly, it wasn't that useful. It seemed like it was a repeat of what we could already find through the other tools we had. Threat Response isn't the best add-on to it, but it's free. It provides more information but the response wasn't that good, those times that I used it. Threat Response didn't impress me. It does do more, but it's not that useful.

We rely on it for antivirus. There are probably three levels, and we have the bottom tier, the most basic one.

It is on Cisco's cloud. We have the client installed on all workstations, but we don't have a server.

It just gives me more insights into what threats are out there on the machines, so I can be more proactive.

Actionable alerts in the security console are helpful. With the security console, I immediately get to know about an issue. So, it has sped things up. It also gives you a way to research and see if an issue is spreading, so it has assisted quite a bit.

It definitely gives a starting point for investigating and mitigating threats. It has research tools, and we can run queries. I have used its Orbital Advanced Search feature. I have run quite a few queries to determine what is out on the network or on the devices that could be a threat. It could be something that is misconfigured or something that we don't want to have running. It is able to quickly run these queries.

I usually use the Orbital Advanced Search feature for groups. I use it to look for commonality for a threat thread, and it provides good visibility. I've never used it for just one endpoint.

Orbital Advanced Search helps in reducing the attack surface and investigating real-time data on endpoints. I've only used it a handful of times, and I was mostly looking for whether or not an update has been applied.

Orbital Advanced Search definitely saves time. I assume money goes right along with time. I don't have to go from desktop to desktop. I have 50 desktops, and if I'm looking for something in particular, it would take at least 15 to 20 minutes per desktop.

We use Cisco Umbrella. The integration when you use the SecureX console is really good to go from one to the other. I have pulled the endpoint and Cisco Umbrella into SecureX, so I just have one console. It was easy to integrate. They provided really good instructions. This integration just made things more convenient.

It simplifies endpoint protection, detection, and response workflows, especially for threat hunting. The way it is set up, with the console, I would get to know quickly that we have an issue. It increases operational efficiency because I don't have to go from desktop to desktop. I'm also proactive instead of reactive.

It has minimized security risks to our business. I've had several desktops where they have triggered an alert, and all I had to do was to go and clean that machine out before the problem spread. 

It allows us to focus on the incident instead of investigating the group, so we are more efficient. It has decreased our time to remediate because we're focusing on the machines we need to.

It has decreased our time to detect. I can't quantify the time, but in some of the older antiviruses, the user would say, "Okay, I've got a pop-up, and it has flagged this or that," and then you'd have to go look for it. With this, I know ahead of time, or I know when it happens. 

We use it as an antivirus. The audit logs are valuable. 

It is extensive in terms of providing visibility and insights into threats. It allows for research into a threat, and you can chart your progress on how you're resolving it.

It is quite comprehensive in terms of endpoint protection. I haven't found anything where it was lacking in terms of the protection of our Windows machines.

While I've attended a lot of their training webinars, they were mostly high-level. They just say that these are the feature, and this is how you access them, but I would like to see more scenario-based information. They should provide us examples of how to resolve something when we see something happening. They should give us an example of the flow on how to resolve it.

In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through.

I have been using this solution for about a year. My company had it for about a year and a half before I joined.

II haven't had any issues with it except for a connector issue. They quickly put out a new one and got rid of the problem. So, it seems to be really stable, and they seem to be reactive when there is a problem.

It is good in terms of keeping the machines updated. It is easy to get it installed on the desktop and keep it updated. We have a little over 100 users. They are administrators, project managers, field supervisors, engineers, and sales and support staff, so we have quite a mix.

We have deployed it on all desktops and laptops currently. I am going to start looking at adding it to mobile devices. Currently, we only have Windows machines covered. We are working on getting it set up on the Mac mobile devices. So, eventually, we will have a lot more depth than we have now.

I never had to reach out to them. So far, I have been able to find the documentation that I needed.

I've only been with the company for a year. They had it when I got there, and we haven't changed anything since then.

I've used McAfee and Norton, and it does much better than them.

I wasn't involved in the initial setup. They did that before I joined the company.

Its maintenance is done by me. I'm the only IT person. It is not a large company, so it isn't a bad thing.

It is kind of hard to say what would have happened if you didn't have it. We've got a very stable environment, and it seems to be doing its job. So, I assume we're getting a return on investment.

The pricing was negotiated before I started, so I don't really know.

I would advise others to take a real hard look at it because it is a good solution for companies of our size. I like the fact that it is managed in the cloud. I don't have to maintain a server presence. It is easy to use. It was a bit of a learning curve to start with because I was completely unfamiliar with it. I just dug in there and figured it out. Its documentation is fairly good.

If you go through SecureX, everything is right there in terms of user access and device protection. This integration is nice, but so far, it hasn't really saved me any time. It may in the future.

I believe it makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform, but I never had to do that.

I would rate Cisco Secure Endpoint an eight out of 10.

We have it installed on all our workstations and servers. Primarily, we started with it after we were hit with a ransomware attack about five years ago. We looked for something that would give us a bit more visibility as to what was going on the network, where the weak points were, etc. We had an antivirus solution (FireANT) back then, which obviously wasn't good enough on its own. So, we went looking for something that was going to be a little more granular in how it gave us visibility on the network.

We have the Cisco AMP for Endpoints Connector on our workstations, which is all done in the cloud. We have Windows Server, Windows 10 workstation environment, and on-premise servers at the moment with some cloud. I guess we would call ourselves a partly hybrid business, with some stuff in the cloud, and all our access points have Cisco AMP on them. This currently includes work-from-home devices, because we have a lot of people still working from home with the coronavirus thing going on, even home users have Cisco AMP as well.

Our operating systems, whether they be Linux, Windows, Mac, or Google Android, are well-protected.

We now have gained more visibility into what's going on. We had an incident four or five years ago where a member of our staff had a Tor Browser installed on his workstation in the office. I discovered it by chance while doing some work on his workstation. At that time, we had no way of knowing what was going on. Now, between our two Cisco products, we have the capability to see and block that sort of thing going on from the network side. From that point of view, it's straightaway. It has given us the security aspect of not having to deal with people putting Tor Browsers on their workstations to access stuff on the dark web. We have been able to lock that down straightaway, which is good, because that's obviously a big threat to any business. If you don't understand what's going on in and out of your office, whether physically or virtually, then you have no idea what's going on and where your risks are going to be. 

It gives us visibility with minimal intrusion. We don't have an on-premise sort of interaction with it, though. It's just a connector that sits on the workstations and servers, then interacts with the workstations or servers through to the cloud. It has very minimal impact on us in terms of performance. They have recently improved the updating of the program. It no longer requires a reboot after a connector update, which is always a handy thing. From that point of view, the impact is better on the business. I can roll out an update to all devices and not have to worry about having reboots, particularly for servers. Thus, the impact has gotten better on the business over time.

The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems.

The solution simplifies endpoint protection, detection, and response workflows, such as security investigation, threat hunting, and incident response. We have policies and procedures in place now at the HR user level and also at the machine level to make sure that certain procedures are followed and those procedures are put in place. From that point of view, the Cisco gives us confidence. We don't have to worry too much about threats. This means we can focus a lot more on doing the work we are being paid to do rather than spending time trying to protect the business too much. The fact that we are very quickly able to see what's going on is good in terms of how much time it takes to work through any issues. 

We now have a standard rollout of devices with procedures in place. The shared nature where Cisco AMP gets installed on all our devices means we are benchmarking our risk at a level that we're comfortable with. We don't have to deal with managing that risk day-to-day, as the risk level is fairly low in terms of what we're expecting from day-to-day operations. From that point of view, this means we can focus more on the business at hand rather than worrying incessantly about threats to the business.

You can see what's going on. It detects a lot of stuff, which is benign, but still detects it as a potential threat or IoC. It has a lot more visibility than traditional antivirus, anti-malware programs. From that point, I feel comfortable that we are seeing everything that is going on. There is a lot of stuff that you don't need to do too much with as it may be a case of some poorly written software executing a potential flag as something of concern. However, at the end of the day, it's nothing to worry about. Therefore, I feel fairly comfortable that we're getting full visibility as best we can on what's going on, and it is better to know what's going on (than not).

Our webpage/portal records all instances of programs accessed on the computer, everything accessed on the internet, all the system processes, and any programs that are running. It then scans them for potential issues. If we installed some software that has a potential issue, we will flag that and have a look to decide whether we want to allow that through or whether to block it.

It shows a lot of stuff going on in the workstations, and to a lesser extent, the servers. Cisco AMP allows us to see within a process what the potential threat may be, for example, on a workstation. That threat may be benign or may be more serious. But, it gives us the opportunity to see those threats, evaluate them, and rate them how we see fit, then do something with them, if necessary. It is now less of an inconvenience on the business from a rebooting aspect.

The console is there running in the background all the time. I can just tap on the console at any point to see what's going on. I usually do this a couple times a day. It allows visibility at any point in time because it's doing this in real-time. There is very little lag. If there are any issues, I get a notification. Then, we can then jump in straightaway, have a look, and assess it. 

The tools provided by the solution to investigate and mitigate threats are very comprehensive. Sometimes, they're almost too comprehensive. You can get caught up delving very deep into things that you potentially don't need to. The integrations set it above your traditional antivirus, console-type applications in relation to visibility. It's very high-level in terms of how it works and what it can do.

Cisco AMP offers user access and device protection in a single endpoint security solution. In combination with Cisco Umbrella, it is looking at attacks from a different point or source. It's good enough with these two products to do the job. We don't see a need another particular third-party security software. 

The biggest area where I liked seeing improvement is in the interface and its interaction with the customer and portal. Since these things are quite technical, it's important that you can find your way around the console quickly without having to remember where things are. I think the interface has improved quite a lot in the last couple of years, which is good, but also the integrations are starting to be incorporated a lot more too. We can see more value in the product as time goes on. It's a different product to what it was when we first got it in terms of visibility and also its user interface.

You need a certain level of technical experience because the console is not the easiest thing to look at. It's very in-depth and there's a lot going on. It does a lot of stuff. I often compare that to our antivirus console, which is pretty self-explanatory, but it is not really doing a lot in terms of its visibility. It will do similar remediation work, but AMP has the visibility. You can see where it's going and what processes are running. Everything that it's tracking can be overwhelming to some people so you need a level of IT and technical experience to understand what it's doing and your way around the console. It's a very high-level product in that respect. Therefore, it might scare a few people off if they're not up to that level. However, if you have someone who can handle it, then it's fine.

There are some features with the integrations that I'm not using because I haven't gotten my head around how they integrate and how best to integrate them into what we're doing. It is just a matter of giving me some time to sit down with a Cisco rep and working through it to understand exactly what these things are doing, then implementing them. I am not one to pay for something that we're not going to use. However, from what I can see, everything that comes with the product is worth doing. Obviously, the threats out there now in the internet world are only getting more complex. Therefore, it makes sense that we keep up with all the technology and software that comes with it.

About four years.

I have had a couple of instances in the time that we have had the solution: 

• It got too smart for itself and detected an Adobe Reader update as malicious, blocking all PDFs. They remediated that fairly quickly. 
• There was an issue with a connector merging at the start of the coronavirus when we were going into lockdown and sending people to work from home. This caused some issues, but they found that very quickly and were able to remediate it. We were able to roll the connector back. 

These issues do pop up from time to time. With any software, there can be upgrades and issues that cause problems. 

Overall, the stability of the program and software have been very good.

The product has improved considerably over the last 12 to 18 months. They have done a lot of updates to the console and connector. The connector interaction with the workstation has been minimized. The visibility inside the console has improved. 

Typically, we have about 120 devices, but we have an extra 60 work-from-home devices at the moment. The scalability is good because we were able to go from 120 devices to 180 very quickly. Therefore, we are able to push devices out very quickly, as needed. There are no issues from my point of view.

We have used the solution as much as we can because we have it on every device that we are using. From that point of view, we have maxed out our utilization because we are using it on every device. On every new device that gets bought in, the first thing that gets put on it is the Cisco products before they touch the Internet and the network, just as a precaution.

Our rep in Sydney is a certified Cisco supplier and provider. The company is Outcomex. The rep was involved in the setup of the whole thing. We are still using the company for our Cisco products, which is good. 

Outcomex is very good. They have looked after any issues we've had with AMP and Umbrella along the way. There might have been some configuration issues that we've had. We have had a few instances where we have needed a bit of external support, and they have been able to give me support very quickly with a fast turnaround.

There have been a few changes to the software, such as the threat intelligence, Threat Grid and a couple of other packages/integrations. I must admit that I haven't had a lot of time in the last couple of months to really delve into them. It's something I was going to go and talk to my Cisco rep over in Sydney to get more of an idea of how they work and how we can integrate them. I see a lot of tools coming out now, along with a lot of integration tools working with the products, which look very good. I just haven't quite got my head around the implementation and how to get the best outcome out of those tools.

There was a case when our provider said, "You best talk to Cisco directly on that." I think that was only once, but the support was very good. That support request was attended to very quickly.

Fortunately, our ransomware attack was way back in the very early days when no one really knew anything about it. However, I had done a bit of reading on it and knew the first thing to do when you see one of those things is to disconnect the machine from the network that is causing the issue. I knew which one it was straightaway, so I managed to disconnect it from the network. Then, the proliferation stopped straightaway. We were able to get stuff from the backup fairly quickly because we have good backup regimes in place, but it was purely by chance that I came across the ransomware as a threat. Although I didn't understand to what extent it went, we were able to mitigate it.

The ransomware attack took probably a good two days of my time fixing and getting things back to normal. It impacted some people in the business world because of where the ransomware got into the network. That was the wake up call, to say, "Hang on. We need something that's going to flag these issues and give us visibility." Our antivirus software was completely benign to it at that time. It had no idea and didn't pick anything up. That's what made us go looking for something. We came up with FireAMP (Cisco AMP). We decided to trial it for a few months and got an idea of exactly what was going on in the network. We did an audit on the network (to start with) and realized that we had some issues. While all stuff was mostly benign and just sitting around the place, it gave us the ability to quickly see what was going on. That was when we decided to go down the path of getting something that would give us that visibility.

The firewalls did their job to some extent. Since then, we have changed our Internet providers and now have a managed firewall. This takes a bit of pressure off me, but we've left AMP in place since we assume that the firewall will let through various things. So, we take the position that we use both Cisco products to protect us from anything that gets through. It is not a matter of just relaxing a bit because we have a managed firewall in place with a lot more security than we probably had five years ago. We still take the view that we need to protect inside the network, assuming something gets through the door, because there are always ways around these things. That's how these things start: They get ahead of a security software before the security software can catch up.

The initial setup was pretty straightforward. 

We pushed the deployment out in a day. Once we had the connector configured and policies configured to how we saw best at the time, it was a fairly straightforward rollout. Because it was pushed out through the portal in the cloud, all the devices were rolled out pretty quickly.

The connector updates are very easily done now, and that's improving. Previously, the connector had an issue, where almost every time it needed to be updated, it required a machine reboot. This was always a bit of an inconvenience and a bug. Because with a lot of software now, you don't need to do that and shouldn't need to be rebooting all the time.

The connector updates happen every six to eight weeks. Now, it's just a matter of me saying, "Push out the update," and off it goes. There is minimal time involved, as it's just a matter of me pushing it out. However, I don't push them out automatically. I always hold back a little bit on updates, like Windows updates, because quite often updates come with more problems than they solve. I usually wait a week or so before implementing them.

We did a two-week audit of it to assess what threats we had. That was done with our Cisco rep. He put a device in that sniffed out all the traffic on the network and produced a report to show where our weaknesses were and what we had on the network sitting there benignly. That gave us a benchmark to configure the product in its initial stage before implementing. The rollout was quite easy.

The deployment was done with a Cisco rep and me.

Because I was able to get on top of our ransomware attack fairly quickly, I was able to restore stuff from backups. Disruption is time, and we are a time-based business. We have done the numbers. If we had 100 technical people at X amount of dollars per hour charge-out rate, then that gives us an hourly cost as a very rudimentary way of working out hourly cost. Therefore, if we're down for half a day, or even a day, then we can very quickly work out how many dollars we will lose every time we get taken down by an this type of attack.

We haven't paid any ransoms because we didn't need to and we wouldn't do that. However, the other side of that is the downtime, assessing the damage, fixing it up, and then all the subsequent tidying up that goes on afterward, which can go on for a while. It would probably be a couple of days of lost productivity, which is not a huge amount in terms of time, but dollar-wise for a small to medium-businesses, it can be quite substantial in a month.

We haven't had to spend time dealing with too many threats. That time is minimized in terms of how much we need to spend.

The solution has decreased our time to remediate. We do a lot of stuff automatically, but we can manually go in and apply remediation straightaway on devices at a device and policy level. We can apply this throughout the business, which is what we want. If we see a threat at some particular level, we can make a decision to go in straightaway and tackle that threat through manual intervention because you can't blindly put your faith into something and expect it to do everything for you. You have to manage it and be proactive at all times. However, the amount of time spent doing the manual intervention is minimized.

The pricing and licensing are reasonable. The cost of AMP for Endpoints is inline with all the other software that has a monthly endpoint cost. It might be a little bit higher than other antivirus type products, but we're only talking about a dollar a month per user. I don't see that cost as being an issue if it's going to give us the confidence and security that we're looking for. We have had a lot of success and happiness with what we're using, so there's no point in changing.

There is also the Cisco annual subscription plus my management time in terms of what I do with the Cisco product. I spend a minimal amount of time on it though, just rolling out updates as they need them and monitoring the console a couple of times a day to ensure nothing is out of control. Cost-wise, we are quite happy with it.

We did look at another solution. At the time, there wasn't a lot of software for small to medium-businesses.

I was looking for something with a business name reputation behind it that would give us a good level of security. That's why we went with the Cisco solution. We initially went with Cisco based on its name in the industry, and we have been very happy with it.

Cisco AMP comes with an in-built antivirus, but we have another antivirus that we use. Though AMP works whether you use their antivirus or not, it doesn't matter, we thought, "If we use a separate branded antivirus, they may have some extra sort of pickups that the AMP antivirus may not," to spread the risk a little. We have some other systems in place internally in terms of how we protect file installations and macros running on the network. Therefore, we do add extra layers of security that we feel that we need. However, we are confident that this will pick up most of this stuff along the way.

At the start, we realized how much we didn't know what was going on in the network and where all the endpoint weaknesses were. That opened eyes up straight away to the risk that was involved. Then, we did the numbers, and said, "For us, risk is downtime, and time is dollars." We just did the sums very quickly and worked out what it would cost us if we didn't have any idea what was going on in the network and got hit by something that we should have been aware of. Because if the software is out there and gives you this type of visibility, you should be using it. 

We do use it with another Cisco product, Cisco Umbrella, which is a DNS-level content-filtering, web-filtering software. That has had an impact on the business world in terms of restricting a lot of stuff which may have come in for some web pages or websites that may not have been secured. We have seen a reduced impact on the business because we're using the two Cisco products together.

I would give Cisco AMP a nine (out of 10). It is as good as anything out there. I can't see any reason why we would look elsewhere for a product. It does the job it's meant to do and is improving all the time. We have been very happy with it.