Cisco Secure Endpoint OverviewUNIXBusinessApplication

Cisco Secure Endpoint is the #4 ranked solution in EDR tools and #5 ranked solution in endpoint security software. PeerSpot users give Cisco Secure Endpoint an average rating of 8.6 out of 10. Cisco Secure Endpoint is most commonly compared to Microsoft Defender for Endpoint: Cisco Secure Endpoint vs Microsoft Defender for Endpoint. Cisco Secure Endpoint is popular among the large enterprise segment, accounting for 56% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 19% of all views.
Cisco Secure Endpoint Buyer's Guide

Download the Cisco Secure Endpoint Buyer's Guide including reviews and more. Updated: December 2022

What is Cisco Secure Endpoint?

Cisco Secure Endpoint is a cloud-managed endpoint security solution that provides advanced protection against viruses, malware, and other cyber threats by detecting, preventing, and responding to threats. Cisco Secure Endpoint is managed online via a web-based management console and can be deployed on a variety of platforms. It protects endpoints, networks, emails, and web traffic.

In a world of evolving threats, it’s necessary to put security above everything. Cisco Secure Endpoint provides you with the scope, scale, and capabilities to attain effective security with its integrated portfolio and industry-leading threat intelligence. Cisco Secure Endpoint continuously tracks and analyzes files and file activities across your systems - both remote and on premises - and compares these events to other events that occurred before or during past attacks. If a file exhibits malicious behavior, the tool sends an alert which enables you to stop a potential threat from succeeding.

Key Capabilities of Cisco Secure Endpoint

  • Multi-layered protection: Cisco Secure Endpoint combines behavioral analytics, machine learning, and signature-based techniques to prevent threats from compromising your endpoints.

  • Powerful EDR capabilities: Reduce attack surface using advanced endpoint and extended detection and response, threat hunting, and endpoint isolation.

  • Dynamic malware analysis: Identify and block attacks in real time.

  • Simplified investigations: Advanced search capabilities help you get the information you need about your endpoints fast.

Reviews from Real Users

Cisco Secure Endpoint stands out among its competitors for a number of reasons. Two major ones are its ability to enable developers to easily secure their endpoints with one single operation using its management console and its advanced alerting techniques.

Tim C., an IT manager at Van Der Meer Consulting, writes, "The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."

Wouter H., a technical team lead network & security at Missing Piece BV, notes, "Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."

Cisco Secure Endpoint was previously known as Cisco AMP for Endpoints.

Cisco Secure Endpoint Customers

Heritage Bank, Mobile County Schools, NHL University, Thunder Bay Regional, Yokogawa Electric, Sam Houston State University, First Financial Bank

Cisco Secure Endpoint Video

Archived Cisco Secure Endpoint Reviews (more than two years old)

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
MD.SIHAB TALUKDAR - PeerSpot reviewer
System Engineer at asa
Real User
Top 5Leaderboard
A stable component of our network infrastructure security
Pros and Cons
  • "The entirety of our network infrastructure is Cisco and the most valuable feature is the integration."
  • "I would like to see integration with Cisco Analytics."

What is our primary use case?

We are system integrators and we use this product for DNS security, which is integrated with the DNS service.

How has it helped my organization?

Cisco AMP is the broadest, most integrated security platform that connects the breadth of Cisco's integrated security portfolio and the customer's infrastructure for a consistent experience. It unifies visibility, enables automation, and strengthens your security across network, endpoints, cloud, and applications--all without replacing your current security infrastructure or layering on new technology.

What is most valuable?

The entirety of our network infrastructure is Cisco and the most valuable feature is the integration.

What needs improvement?

I would like to see integration with Cisco Analytics.

Buyer's Guide
Cisco Secure Endpoint
December 2022
Learn what your peers think about Cisco Secure Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: December 2022.
657,397 professionals have used our research since 2012.

For how long have I used the solution?

We have been using the total Cisco solutions including AMP for Endpoints, Umbrella, and Firepower for three years.

What do I think about the stability of the solution?

This is a stable product.

What do I think about the scalability of the solution?

This solution is scalable.

How are customer service and support?

I have contacted them in the past to raise a case and they were able to resolve it.

Which solution did I use previously and why did I switch?

We use the traditional antivirus, its don't able to protects real time protection don't have firewall integration.

How was the initial setup?

The initial setup involves integration with other products such as Talos. The deployment took us about one day.

Which other solutions did I evaluate?

Cisco Talos Intelligence Group is one of the largest commercial threat intelligence teams in the world.These teams are supported by unrivaled telemetry and sophisticated systems to create accurate, rapid and actionable threat intelligence for Cisco customers, products and services.

What other advice do I have?

I began with implementing Cisco AMP for Endpoints and then integrated Umbrella and the other products after that.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Tim Crosweller - PeerSpot reviewer
IT Manager at van der Meer Consulting
Real User
We have gained more visibility into what's going on because it detects a lot of threats
Pros and Cons
  • "The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."
  • "The connector updates are very easily done now, and that's improving. Previously, the connector had an issue, where almost every time it needed to be updated, it required a machine reboot. This was always a bit of an inconvenience and a bug. Because with a lot of software now, you don't need to do that and shouldn't need to be rebooting all the time."

What is our primary use case?

We have it installed on all our workstations and servers. Primarily, we started with it after we were hit with a ransomware attack about five years ago. We looked for something that would give us a bit more visibility as to what was going on the network, where the weak points were, etc. We had an antivirus solution (FireANT) back then, which obviously wasn't good enough on its own. So, we went looking for something that was going to be a little more granular in how it gave us visibility on the network.

We have the Cisco AMP for Endpoints Connector on our workstations, which is all done in the cloud. We have Windows Server, Windows 10 workstation environment, and on-premise servers at the moment with some cloud. I guess we would call ourselves a partly hybrid business, with some stuff in the cloud, and all our access points have Cisco AMP on them. This currently includes work-from-home devices, because we have a lot of people still working from home with the coronavirus thing going on, even home users have Cisco AMP as well.

Our operating systems, whether they be Linux, Windows, Mac, or Google Android, are well-protected.

How has it helped my organization?

We now have gained more visibility into what's going on. We had an incident four or five years ago where a member of our staff had a Tor Browser installed on his workstation in the office. I discovered it by chance while doing some work on his workstation. At that time, we had no way of knowing what was going on. Now, between our two Cisco products, we have the capability to see and block that sort of thing going on from the network side. From that point of view, it's straightaway. It has given us the security aspect of not having to deal with people putting Tor Browsers on their workstations to access stuff on the dark web. We have been able to lock that down straightaway, which is good, because that's obviously a big threat to any business. If you don't understand what's going on in and out of your office, whether physically or virtually, then you have no idea what's going on and where your risks are going to be. 

It gives us visibility with minimal intrusion. We don't have an on-premise sort of interaction with it, though. It's just a connector that sits on the workstations and servers, then interacts with the workstations or servers through to the cloud. It has very minimal impact on us in terms of performance. They have recently improved the updating of the program. It no longer requires a reboot after a connector update, which is always a handy thing. From that point of view, the impact is better on the business. I can roll out an update to all devices and not have to worry about having reboots, particularly for servers. Thus, the impact has gotten better on the business over time.

The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems.

The solution simplifies endpoint protection, detection, and response workflows, such as security investigation, threat hunting, and incident response. We have policies and procedures in place now at the HR user level and also at the machine level to make sure that certain procedures are followed and those procedures are put in place. From that point of view, the Cisco gives us confidence. We don't have to worry too much about threats. This means we can focus a lot more on doing the work we are being paid to do rather than spending time trying to protect the business too much. The fact that we are very quickly able to see what's going on is good in terms of how much time it takes to work through any issues. 

We now have a standard rollout of devices with procedures in place. The shared nature where Cisco AMP gets installed on all our devices means we are benchmarking our risk at a level that we're comfortable with. We don't have to deal with managing that risk day-to-day, as the risk level is fairly low in terms of what we're expecting from day-to-day operations. From that point of view, this means we can focus more on the business at hand rather than worrying incessantly about threats to the business.

What is most valuable?

You can see what's going on. It detects a lot of stuff, which is benign, but still detects it as a potential threat or IoC. It has a lot more visibility than traditional antivirus, anti-malware programs. From that point, I feel comfortable that we are seeing everything that is going on. There is a lot of stuff that you don't need to do too much with as it may be a case of some poorly written software executing a potential flag as something of concern. However, at the end of the day, it's nothing to worry about. Therefore, I feel fairly comfortable that we're getting full visibility as best we can on what's going on, and it is better to know what's going on (than not).

Our webpage/portal records all instances of programs accessed on the computer, everything accessed on the internet, all the system processes, and any programs that are running. It then scans them for potential issues. If we installed some software that has a potential issue, we will flag that and have a look to decide whether we want to allow that through or whether to block it.

It shows a lot of stuff going on in the workstations, and to a lesser extent, the servers. Cisco AMP allows us to see within a process what the potential threat may be, for example, on a workstation. That threat may be benign or may be more serious. But, it gives us the opportunity to see those threats, evaluate them, and rate them how we see fit, then do something with them, if necessary. It is now less of an inconvenience on the business from a rebooting aspect.

The console is there running in the background all the time. I can just tap on the console at any point to see what's going on. I usually do this a couple times a day. It allows visibility at any point in time because it's doing this in real-time. There is very little lag. If there are any issues, I get a notification. Then, we can then jump in straightaway, have a look, and assess it. 

The tools provided by the solution to investigate and mitigate threats are very comprehensive. Sometimes, they're almost too comprehensive. You can get caught up delving very deep into things that you potentially don't need to. The integrations set it above your traditional antivirus, console-type applications in relation to visibility. It's very high-level in terms of how it works and what it can do.

Cisco AMP offers user access and device protection in a single endpoint security solution. In combination with Cisco Umbrella, it is looking at attacks from a different point or source. It's good enough with these two products to do the job. We don't see a need another particular third-party security software. 

What needs improvement?

The biggest area where I liked seeing improvement is in the interface and its interaction with the customer and portal. Since these things are quite technical, it's important that you can find your way around the console quickly without having to remember where things are. I think the interface has improved quite a lot in the last couple of years, which is good, but also the integrations are starting to be incorporated a lot more too. We can see more value in the product as time goes on. It's a different product to what it was when we first got it in terms of visibility and also its user interface.

You need a certain level of technical experience because the console is not the easiest thing to look at. It's very in-depth and there's a lot going on. It does a lot of stuff. I often compare that to our antivirus console, which is pretty self-explanatory, but it is not really doing a lot in terms of its visibility. It will do similar remediation work, but AMP has the visibility. You can see where it's going and what processes are running. Everything that it's tracking can be overwhelming to some people so you need a level of IT and technical experience to understand what it's doing and your way around the console. It's a very high-level product in that respect. Therefore, it might scare a few people off if they're not up to that level. However, if you have someone who can handle it, then it's fine.

There are some features with the integrations that I'm not using because I haven't gotten my head around how they integrate and how best to integrate them into what we're doing. It is just a matter of giving me some time to sit down with a Cisco rep and working through it to understand exactly what these things are doing, then implementing them. I am not one to pay for something that we're not going to use. However, from what I can see, everything that comes with the product is worth doing. Obviously, the threats out there now in the internet world are only getting more complex. Therefore, it makes sense that we keep up with all the technology and software that comes with it.

For how long have I used the solution?

About four years.

What do I think about the stability of the solution?

I have had a couple of instances in the time that we have had the solution: 

  • It got too smart for itself and detected an Adobe Reader update as malicious, blocking all PDFs. They remediated that fairly quickly. 
  • There was an issue with a connector merging at the start of the coronavirus when we were going into lockdown and sending people to work from home. This caused some issues, but they found that very quickly and were able to remediate it. We were able to roll the connector back. 

These issues do pop up from time to time. With any software, there can be upgrades and issues that cause problems. 

Overall, the stability of the program and software have been very good.

The product has improved considerably over the last 12 to 18 months. They have done a lot of updates to the console and connector. The connector interaction with the workstation has been minimized. The visibility inside the console has improved. 

What do I think about the scalability of the solution?

Typically, we have about 120 devices, but we have an extra 60 work-from-home devices at the moment. The scalability is good because we were able to go from 120 devices to 180 very quickly. Therefore, we are able to push devices out very quickly, as needed. There are no issues from my point of view.

We have used the solution as much as we can because we have it on every device that we are using. From that point of view, we have maxed out our utilization because we are using it on every device. On every new device that gets bought in, the first thing that gets put on it is the Cisco products before they touch the Internet and the network, just as a precaution.

How are customer service and technical support?

Our rep in Sydney is a certified Cisco supplier and provider. The company is Outcomex. The rep was involved in the setup of the whole thing. We are still using the company for our Cisco products, which is good. 

Outcomex is very good. They have looked after any issues we've had with AMP and Umbrella along the way. There might have been some configuration issues that we've had. We have had a few instances where we have needed a bit of external support, and they have been able to give me support very quickly with a fast turnaround.

There have been a few changes to the software, such as the threat intelligence, Threat Grid and a couple of other packages/integrations. I must admit that I haven't had a lot of time in the last couple of months to really delve into them. It's something I was going to go and talk to my Cisco rep over in Sydney to get more of an idea of how they work and how we can integrate them. I see a lot of tools coming out now, along with a lot of integration tools working with the products, which look very good. I just haven't quite got my head around the implementation and how to get the best outcome out of those tools.

There was a case when our provider said, "You best talk to Cisco directly on that." I think that was only once, but the support was very good. That support request was attended to very quickly.

Which solution did I use previously and why did I switch?

Fortunately, our ransomware attack was way back in the very early days when no one really knew anything about it. However, I had done a bit of reading on it and knew the first thing to do when you see one of those things is to disconnect the machine from the network that is causing the issue. I knew which one it was straightaway, so I managed to disconnect it from the network. Then, the proliferation stopped straightaway. We were able to get stuff from the backup fairly quickly because we have good backup regimes in place, but it was purely by chance that I came across the ransomware as a threat. Although I didn't understand to what extent it went, we were able to mitigate it.

The ransomware attack took probably a good two days of my time fixing and getting things back to normal. It impacted some people in the business world because of where the ransomware got into the network. That was the wake up call, to say, "Hang on. We need something that's going to flag these issues and give us visibility." Our antivirus software was completely benign to it at that time. It had no idea and didn't pick anything up. That's what made us go looking for something. We came up with FireAMP (Cisco AMP). We decided to trial it for a few months and got an idea of exactly what was going on in the network. We did an audit on the network (to start with) and realized that we had some issues. While all stuff was mostly benign and just sitting around the place, it gave us the ability to quickly see what was going on. That was when we decided to go down the path of getting something that would give us that visibility.

The firewalls did their job to some extent. Since then, we have changed our Internet providers and now have a managed firewall. This takes a bit of pressure off me, but we've left AMP in place since we assume that the firewall will let through various things. So, we take the position that we use both Cisco products to protect us from anything that gets through. It is not a matter of just relaxing a bit because we have a managed firewall in place with a lot more security than we probably had five years ago. We still take the view that we need to protect inside the network, assuming something gets through the door, because there are always ways around these things. That's how these things start: They get ahead of a security software before the security software can catch up.

How was the initial setup?

The initial setup was pretty straightforward. 

We pushed the deployment out in a day. Once we had the connector configured and policies configured to how we saw best at the time, it was a fairly straightforward rollout. Because it was pushed out through the portal in the cloud, all the devices were rolled out pretty quickly.

The connector updates are very easily done now, and that's improving. Previously, the connector had an issue, where almost every time it needed to be updated, it required a machine reboot. This was always a bit of an inconvenience and a bug. Because with a lot of software now, you don't need to do that and shouldn't need to be rebooting all the time.

The connector updates happen every six to eight weeks. Now, it's just a matter of me saying, "Push out the update," and off it goes. There is minimal time involved, as it's just a matter of me pushing it out. However, I don't push them out automatically. I always hold back a little bit on updates, like Windows updates, because quite often updates come with more problems than they solve. I usually wait a week or so before implementing them.

What about the implementation team?

We did a two-week audit of it to assess what threats we had. That was done with our Cisco rep. He put a device in that sniffed out all the traffic on the network and produced a report to show where our weaknesses were and what we had on the network sitting there benignly. That gave us a benchmark to configure the product in its initial stage before implementing. The rollout was quite easy.

The deployment was done with a Cisco rep and me.

What was our ROI?

Because I was able to get on top of our ransomware attack fairly quickly, I was able to restore stuff from backups. Disruption is time, and we are a time-based business. We have done the numbers. If we had 100 technical people at X amount of dollars per hour charge-out rate, then that gives us an hourly cost as a very rudimentary way of working out hourly cost. Therefore, if we're down for half a day, or even a day, then we can very quickly work out how many dollars we will lose every time we get taken down by an this type of attack.

We haven't paid any ransoms because we didn't need to and we wouldn't do that. However, the other side of that is the downtime, assessing the damage, fixing it up, and then all the subsequent tidying up that goes on afterward, which can go on for a while. It would probably be a couple of days of lost productivity, which is not a huge amount in terms of time, but dollar-wise for a small to medium-businesses, it can be quite substantial in a month.

We haven't had to spend time dealing with too many threats. That time is minimized in terms of how much we need to spend.

The solution has decreased our time to remediate. We do a lot of stuff automatically, but we can manually go in and apply remediation straightaway on devices at a device and policy level. We can apply this throughout the business, which is what we want. If we see a threat at some particular level, we can make a decision to go in straightaway and tackle that threat through manual intervention because you can't blindly put your faith into something and expect it to do everything for you. You have to manage it and be proactive at all times. However, the amount of time spent doing the manual intervention is minimized.

What's my experience with pricing, setup cost, and licensing?

The pricing and licensing are reasonable. The cost of AMP for Endpoints is inline with all the other software that has a monthly endpoint cost. It might be a little bit higher than other antivirus type products, but we're only talking about a dollar a month per user. I don't see that cost as being an issue if it's going to give us the confidence and security that we're looking for. We have had a lot of success and happiness with what we're using, so there's no point in changing.

There is also the Cisco annual subscription plus my management time in terms of what I do with the Cisco product. I spend a minimal amount of time on it though, just rolling out updates as they need them and monitoring the console a couple of times a day to ensure nothing is out of control. Cost-wise, we are quite happy with it.

Which other solutions did I evaluate?

We did look at another solution. At the time, there wasn't a lot of software for small to medium-businesses.

I was looking for something with a business name reputation behind it that would give us a good level of security. That's why we went with the Cisco solution. We initially went with Cisco based on its name in the industry, and we have been very happy with it.

Cisco AMP comes with an in-built antivirus, but we have another antivirus that we use. Though AMP works whether you use their antivirus or not, it doesn't matter, we thought, "If we use a separate branded antivirus, they may have some extra sort of pickups that the AMP antivirus may not," to spread the risk a little. We have some other systems in place internally in terms of how we protect file installations and macros running on the network. Therefore, we do add extra layers of security that we feel that we need. However, we are confident that this will pick up most of this stuff along the way.

What other advice do I have?

At the start, we realized how much we didn't know what was going on in the network and where all the endpoint weaknesses were. That opened eyes up straight away to the risk that was involved. Then, we did the numbers, and said, "For us, risk is downtime, and time is dollars." We just did the sums very quickly and worked out what it would cost us if we didn't have any idea what was going on in the network and got hit by something that we should have been aware of. Because if the software is out there and gives you this type of visibility, you should be using it. 

We do use it with another Cisco product, Cisco Umbrella, which is a DNS-level content-filtering, web-filtering software. That has had an impact on the business world in terms of restricting a lot of stuff which may have come in for some web pages or websites that may not have been secured. We have seen a reduced impact on the business because we're using the two Cisco products together.

I would give Cisco AMP a nine (out of 10). It is as good as anything out there. I can't see any reason why we would look elsewhere for a product. It does the job it's meant to do and is improving all the time. We have been very happy with it.

Which deployment model are you using for this solution?

Hybrid Cloud
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
Buyer's Guide
Cisco Secure Endpoint
December 2022
Learn what your peers think about Cisco Secure Endpoint. Get advice and tips from experienced pros sharing their opinions. Updated: December 2022.
657,397 professionals have used our research since 2012.
Mark Bonnamy - PeerSpot reviewer
Technical Director at Ridgewall Ltd
Reseller
Targets issues more accurately, helping us to focus high-cost engineering resources more accurately
Pros and Cons
  • "If somebody has been compromised, the question always is: How has it affected other devices in the network? Cisco AMP gives you a very neat view of that."
  • "The ability to detonate a particular problem in a sandbox environment and understand what the effects are, is helpful. We're trying, for example, to determine, when people send information in, if an attachment is legitimate or not. You just have to open it. If you can do that in a secure sandbox environment, that's an invaluable feature. What you would do otherwise would be very risky and tedious."
  • "...the greatest value of all, would be to make the security into a single pane of glass. Whilst these products are largely integrated from a Talos perspective, they're not integrated from a portal perspective. For example, we have to look at an Umbrella portal and a separate AMP portal. We also have to look at a separate portal for the firewalls. If I could wave a magic wand and have one thing, I would put all the Cisco products into one, simple management portal."

What is our primary use case?

We needed an endpoint security product and this was the one that we chose. We also use Cisco Umbrella, which fits in neatly with the endpoint as endpoints are moving, more and more, out of the office now. Traditionally, it's slightly harder to manage that, so we use Cisco AMP and Umbrella on those endpoints to secure them.

It's almost entirely on-premise. Although there are some small cloud installations where we use it.

How has it helped my organization?

The fact that the solution offers cloud-delivered endpoint protection makes it simpler to use. Historically, Cisco's appliances have been relatively expensive and that has been a block to Cisco getting into the SME space, which is our particular focus. Having it cloud-based, where there's no cost, as such, to get the deployment running, has made it easier to sell to small businesses. We've got AMP installations with as few as two users. In the past, with Cisco, we would never have been able to deliver into that size of business without some sort of cloud for delivering it.

It also has a neat web interface that allows us to access it simply and therefore more people are able to manage it, rather than it being a specialist product. We're able to give it to more junior people on the helpdesk and they're able to determine quite quickly and simply what the state of the environment is and, if needed, escalate it to more senior people if they believe there's an issue. That's worked well for us.

We had quite a large client that had a partial AMP installation only covering key assets, and they were hit by ransomware. It was only Cisco AMP that showed where the problems were. The rest of the antivirus that they had across the estate was completely ineffective. AMP was intact and it gave the engineers the vital information they required to remediate the problem. With all attacks what we're interested in is knowing what was "patient zero," where the problem came in, and where it's spread. That can be a challenge sometimes when you've got multiple devices in a network and you're looking across a large number of PCs to work out who was compromised first and, therefore, what the course of action is.

It has decreased our time to remediate. In the scenario of the client that was hit by ransomware, effectively, none of the endpoints were compromised. We were able to detect what the issue was via the AMP client, which discovered and alerted us to what the actual problem was. We then had to do a cleanup process on the remaining. It certainly showed its value to us and the client in that particular incident. It is hard to say how much time it saved us, because in that particular incident they only had a limited deployment. It actually took six man-days to solve the problem, but it didn't affect any of the AMP clients. It arguably could have taken even longer, had they not had AMP deployed on at least some of the assets. It's very simple: If they had had AMP on all of them, they would have probably avoided the problem in the first place. And they certainly wouldn't have needed six days to actually resolve the issue.

Cisco Threat Response accelerates Cisco Umbrella security operation functions. The abilities of Talos are definitely one of the reasons we bought into this as a product. It enables us to react more quickly. We're relying on Cisco providing that updated information in a timely fashion, and that obviously has a knock-on effect on our ability to support our clients if they've been compromised. That ability to push information automatically into Talos and their environment and then prove it's a problem or otherwise, and then update the system automatically, saves us an enormous amount of time. It gives us a lot of confidence in what we do, because Cisco is able to update things and do that part of the function for us, rather than our relying on in-house skills to try to determine what is good and what is bad.

We use it internally, in our business, to secure us, as we are an MSP, which means we are at particular risk. Obviously, we have a duty of care for our clients to ensure that we take the utmost responsibility and steps to secure our businesses and, in turn, secure our clients' businesses. The Cisco suite of security solutions definitely gives us a great deal of comfort that we are doing that. Relying on Cisco for those updates certainly takes a load off my mind, knowing that we've got the backing of Talos across the suite of products. We feel, with all the steps we have taken, that there are very few gaps in our security.

The solution has also made our team more effective by being able to focus on high-value initiatives. We have it integrated into our helpdesk system where it alerts us of things that are of particular concern. That minimizes the amount of time that we're looking at non-threatening situations. A lot of these systems can throw up an awful lot of information and you can end up spending an awful lot of time looking at things that aren't an issue — false positives. If we're able to target things more accurately, it helps us focus that high-cost engineering resource more accurately. It does save time and money.

Cisco AMP has definitely decreased our time to detection, relative to where we were with previous products. Before this type of next-gen solution, we were relying on things like antivirus, which is pretty poor and didn't produce much in the way of protection, certainly around ransomware and other things. We were relying heavily on perimeter protection, like firewalls. That was, of course, completely ineffective when people took their laptops home. The risk was great and we saw more people bringing problems back into the business. The AMP and Umbrella combination has made life a lot more secure and enables us to deliver consistent policy, which is the other important thing. When people are in our building, we've got a reasonably consistent policy because we have greater control. But the minute a person leaves the building and connects via a phone or at an internet cafe, we lose most of the traditional protection we had. The endpoint becomes everything.

The decrease in time to detection has been significant. It's very hard to put a percentage to it because, before it, we were often blissfully unaware that devices had a problem at all. It's given us visibility and we are much more effective. I'm guessing in terms of what it saves time-wise, because it's given us visibility that we otherwise didn't have, but I would say 80 percent, if I had to put a figure on it.

What is most valuable?

It has a number of valuable features. One of them is its ability to look across the estate. If somebody has been compromised, the question always is: How has it affected other devices in the network? Cisco AMP gives you a very neat view of that.

It has worked well where there have been compromises of clients and the software has automatically sent a sample to Cisco. Cisco has very quickly turned that around and an update has been issued and therefore, within an hour, all the devices are protected against it. We've been quite impressed with that.

We're a Cisco-centric organization. We use things like Cisco FirePOWER, the Next Gen features, as well as Umbrella portal and AMP. We've got a SIEM solution and we see all the events. It gives us a very good overall view of what's going on, very quickly.

We get all the alerts fed in centrally and it enables the security team to act upon them quickly. The alerts seem to be high-quality. We don't get an awful lot of false positives. With the dashboards it's clear, and you can understand quickly where the issues are, with instant responses.

The tools provided by the solution to help you investigate and mitigate threats are very helpful too. I'm the person who manages the engineers, so I don't use it on a day-to-day basis. I use it to get an overall view of, and a feeling for, where our various clients are in terms of issues: How secure they are, whether the engineers have been acting upon threats, etc. But our engineers like the product very much. The ability to detonate a particular problem in a sandbox environment and understand what the effects are, is helpful. We're trying, for example, to determine, when people send information in, if an attachment is legitimate or not. You just have to open it. If you can do that in a secure sandbox environment, that's an invaluable feature. What you would do otherwise would be very risky and tedious.

All our engineers have been very impressed with the features that it delivers and the fact that it has been low impact on the endpoints. It hasn't caused us any problems with performance. Generally, it's a very well-liked product amongst the engineering team.

What needs improvement?

Some of the dashboards don't always populate with data. Most of them do, but some of them don't. 

Another issue for me, that would be the greatest value of all, would be to make the security into a single pane of glass. Whilst these products are largely integrated from a Talos perspective, they're not integrated from a portal perspective. For example, we have to look at an Umbrella portal and a separate AMP portal. We also have to look at a separate portal for the firewalls. If I could wave a magic wand and have one thing, I would put all the Cisco products into one, simple management portal. If I were Cisco, that would be my greatest focus of all because it would be of such great value if I could give one pane of glass to an engineer and he could look across all the Cisco products. 

The other thing I would say to Cisco is they need to move more to a consumption model like Office 365, because I want to be able to sell it and deploy it by just adding things on to a particular client.

For example, you set a client up on the AMP portal, which I'm looking at as I speak. I have X number of clients. If I need to sell or deploy Umbrella, I've got to go through a completely different process and enter exactly the same sort of thing. I've got to create the client somewhere else, I've got to put the information somewhere else, and I've got to run the deployment from somewhere else. Whereas with the Office 365 model, I'm able to upgrade packages and add features and functionality all from the one place. That is an incredibly powerful selling tool.

The other area for improvement is to make billing simpler. The billing process for us is hard where we've got those two users. We've got to create a separate bill for those clients and we have to create a separate report to Cisco to say that we're billing those clients. Anything they could do to make that billing process more seamless would be of great value. If they could almost automate it, so that it is something that links in with accounts packages to make the billing process neater, it would help promote the sale of it and make it more profitable to sell. If someone deploys AMP For Endpoints on a client, at the moment that process is very disjointed. We've got to do a check once a month to see how many deployments there are relative to last month and, if we had to add one, we not only have to bill an extra one but we also have to buy an extra one from Cisco. And all that is manual.

For how long have I used the solution?

I have been using Cisco AMP for Endpoints for three years, maybe more.

What do I think about the stability of the solution?

The stability is very good. We've had no issues with performance or things crashing. That aspect has all been very positive. When doing as much as these products are doing, it can create quite an overhead and take a toll on the performance of PCs, but we have had none of that kind of experience.

We are predominantly a Microsoft environment. I'm aware that it supports Mac, but I don't think we have any installations across Mac environments at the moment. From a Windows standpoint, it works very well. It hasn't caused instability. It hasn't affected performance in a negative way. All those things are really positive, given what it's actually doing.

What do I think about the scalability of the solution?

Without any question it's scalable. We've got it on as few as two, and as many as 250 or so clients. We don't have any questions about scalability.

How are customer service and technical support?

I've not personally used any support around this solution. I don't think we have needed to from an implementation perspective. It's all gone smoothly.

Which solution did I use previously and why did I switch?

We used Sophos in the past. We're replacing it, so when the renewals come up we replace Sophos with AMP, wherever possible.

How was the initial setup?

The initial setup is quite simple. We needed a method of delivery and that's the hardest part. But the deployment and the actual tuning of it are relatively minimal, so that has been a good experience. We didn't have to mess about with performance tuning, whereas with other products we have to do quite a lot for excluding this, that, and the other directory, to make sure the performance is reasonable.

If it's a small environment, it's quick to set up because we've got closer management. But in bigger environments, we bump into the challenge — and this is not an AMP issue or an installation issue — of people who are away, or people who haven't restarted their machines. Those sorts of little things tend to be the things that are a little bit more of a pain to get the final installation done. But the rollout of AMP, per se, is quite straightforward. The setup time of AMP isn't an issue and it is quite acceptable. These types of problems would exist with whichever product was chosen.

In terms of an implementation strategy for this product, our security team is very comfortable with rolling it out. The sales process is that we define the client's needs, the number of devices that they intend to secure, and that goes to the security team to coordinate and roll out. That's a reasonably templated process now for us.

In our company, the security team is comprised of four people, and they are the people who primarily look after and manage the products. We also have a deployment team, another three or four people, who are the people that would ultimately push the client out to the various devices that need it.

What was our ROI?

Certainly, from a protection standpoint, we have seen ROI. It's doing what we want it to do and it's protecting us and the clients who have it installed. Neither they nor we have been compromised and that's the greatest testament of all.

What's my experience with pricing, setup cost, and licensing?

We use the MSP model, so we're able to pay as we go. We report usage based on the actual usage, which is very handy. The old model of Cisco doing it was dated and archaic, and that goes for most of their products. The previous way they did it, which was that you bought something upfront for a certain period, was terrible because of the actual process of updating it. It wouldn't scale down and it was very hard to scale up. When you added users to the system, it wasn't easy to then add licenses to that particular agreement. It was really difficult, in fact; difficult to the point where we stopped selling it in that model, because it was just too problematic.

For example, if we had a user with 10 devices and they bought some more devices, so it went to, say, 15, getting an extra five licenses within their agreement was immensely hard. To me, the only way forward is the MSP model.

Which other solutions did I evaluate?

We looked at a number of different solutions: Carbon Black, Cylance, Sophos Intercept X and we liked the Cisco AMP solution over those products because it fit in neatly with the rest of the Cisco portfolio. We believe that the management of the various security products fit better with one manufacturer, rather than picking various manufacturers to try and manage a security solution.

The integration of Cisco Threat Response with Cisco Umbrella is getting a lot better. What we like, across the board, is that the solutions are backed by Talos, and Talos is the largest, independent, security-research and threat-hunting organization in the world. We like the fact that the protection is spread across the Cisco environment. That's where this set of products wins when compared to other vendors. It's not that other vendors, like Carbon Black and Cylance, aren't delivering good products. They're just not doing the whole suite. They're not providing the firewall, they're not providing the CASB solution like CloudLock. I'm not sure if they're doing DNS filtering yet; a lot of vendors are catching up on that. But effectively, when you get a known issue, Cisco have the ability to roll it out across a suite of products and therefore you get protection very quickly. So if you discover a problem in Cisco Umbrella, they can update that threat, where need be, in AMP. That's quite a unique selling point for Cisco.

What other advice do I have?

It's very simple to deploy, doesn't cause much in the way of management overhead, and does what it suggests. I would have no hesitation in recommending it. We obviously do, as we're selling it and have been using it for a number of years.

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: Partner.
PeerSpot user
Security Officer at a healthcare company with 51-200 employees
Real User
Gives great network visibility by showing how a file interacts with other systems, devices, and files
Pros and Cons
  • "The visibility and insight this solution gives you into threats is pretty granular. It has constant monitoring. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. You can see what happened after the threat. You can see what other applications were incorporated into the execution of the threat. For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. Then, after the event, something else was launched by whatever the threat was. Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. This helps you understand and nail down what the threat is and how to fix it."
  • "One of the best features of AMP is its cloud feature. It doesn't matter where the device is in regards to whether it's inside or outside of your network environment, especially right now when everybody's remote and taken their laptops home. You don't have to be VPNed into the environment for AMP to work. AMP will work anywhere in the world, as long as it has an Internet connection. You get protection and reporting with it. No matter where the device is, AMP has still got coverage on it and is protecting it. You still have the ability to manage and remediate things. The cloud feature is the magic bullet. This is what makes the solution a valuable tool as far as I'm concerned."
  • "The one challenge that I see is the use of multiple endpoint protection platforms. For instance, we have AMP, but we also have Microsoft Windows Defender, System Center Endpoint Protection, and Microsoft Malware Protection Engine deployed. So, we have a bunch of different things that do the same thing. What winds up happening is, e.g., if I get an alert for a potential incident or malware and want to pull the file, I'll go to fetch the file to analyze it. But, one of these other programs has already gotten it, so the file has already been quarantined by another endpoint protection system. AMP doesn't realize that and the file fetch fails, then you're left wondering what's going on."

What is our primary use case?

AMP for Endpoints has Endpoint Connectors, which are agents on the endpoints, providing security against malware and intrusion detection. It also provides intrusion prevention. We install the Connector on all the endpoints before they're deployed and also on our virtual desktop images. They provide constant monitoring and alerting on any events or potential threats to let us know when there is something going on that we can further investigate.

AMP intersects with a bunch of other Cisco tools, such as Threat Grid, Threat Response, and Talos Intelligence to identify threats, then automatically quarantine or remove them. It also gives you the ability to isolate endpoints to prevent further spread of any sort of malware, like a virus that might infect other machines.

How has it helped my organization?

The visibility and insight this solution gives you into threats is pretty granular. It has constant monitoring. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. You can see what happened after the threat. You can see what other applications were incorporated into the execution of the threat. For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. Then, after the event, something else was launched by whatever the threat was. Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. This helps you understand and nail down what the threat is and how to fix it.

The solution’s actionable alerts in the security console are granular. They take you right to whatever the incident was so you can start investigating it. One thing that I have noticed lately, as we have spun up more tools associated with our Enterprise Agreement, is that AMP interfaces with all of them, then takes on some automated actions. One of the things that AMP allows you to do if there's an incident, it gives you an alert. This is because a threat was detected. You can click on the threat that's detected, then it takes you right to it in the timeline. Finally, you can pull/fetch the file and submit it for analysis. However, it will also do that automatically.

Cisco is standing up so much stuff right now. This solution interfaces with Talos Intelligence, Threat Grid, Threat Response, and SecureX. All of these things are integrating together and a lot of stuff is now starting to happen automatically, e.g., if a threat is detected, it is automatically interfacing with Talos Intelligence to figure out what that threat is and the hash value of whatever file that is. If it thinks it's suspicious, it automatically submits it to Threat Grid, which detonates the file in the sandbox, but also in the cloud, and returns a report saying whether the file, or whatever it is, is an actual threat/incident. Then, it remediates and quarantines it, and you find out about it later. It's doing a lot of stuff in the background as the integration with other tools increases.

Cisco Threat Response accelerates security operation functions. It gives you great visibility into your network. You start with a hash value, and you can search for that hash value within your environment by just dropping it into Threat Response. Then, it'll show you how that file has interacted with other files, systems, and devices. It gives you immediate visibility with a chart that shows you where that file has gone and where it's been. If you're looking to contain outbreaks, it's all there.

Cisco AMP simplifies endpoint protection detection and response workflows, such as security instigation. It really shortens the window to respond to an incident. You can do something in five minutes that probably would have taken several days in a big, diverse, ambiguous environment, where you have a lot of people working remotely. It would be tough to run down all this stuff. It is saving not only time, but manpower. Another person plus myself can now fix a problem. Whereas before, I would have to crawl through four or five different people before I got the right guy to get to the right place to do the thing that I needed him to do.

What is most valuable?

I like all the features. They're continually adding features to the product as well. One of the most recent features that they added is Orbital Advanced Search, which gives you great visibility into each individual endpoint. If you need to go look and see what's going on, it gives you that ability very easily.

I've only used Orbital Advanced Search on individual endpoints. Unless what I'm looking for is of great urgency, then I don't want to run very complex queries because they can take a lot of time and use a lot of resources for the endpoint. I'm still getting used to it so I don't know its full capabilities, such as, what it can do without interrupting the use of the endpoint. However, if the endpoint is compromised, it doesn't really matter. If I'm just investigating an incident, I don't want to lock the box up if a user is still trying to use it while I'm trying to figure out what's going on.

The Orbital Advanced Search is a great tool that gives you visibility. Otherwise, you would have to track down the device physically and possibility even do a forensic image of it to figure out what happened, or take it out of the environment just to investigate it. Having the ability to use Orbital to get the information off of a device to determine whether it's legitimately compromised, or if something weird is just going on, shortens the timeline of your response because you have immediate availability and visibility into the device that might be compromised.

Orbital helps reduce attack surface and investigate real-time data on our endpoints. For example, a device alerted in AMP for having a potential browser hijacker. At the same time, the user was also opening a help desk ticket because they were unable to access some online resources necessary for them to be able to work. I was then able to get on the device using Orbital (out of AMP) to locate the device and figure out what was going on, and it was a legitimate infection of a virus: It was a browser hijacker. All that happened in the span of five minutes, and I was able to get one of my guys out there to remove the device from our environment, reimage and replace it with another device.

I was able to figure out what was going on with that device in the span of five to 10 minutes. Then, I was able to have a guy onsite within the next three hours to get the device out of our environment. Previously, that would have taken days to figure out what was going on with the device, remote into the device, and find out where the device was physically, then get somebody to go to where the device was physically and pull the device out of the environment. That used to be a much longer process, and the longer that you have a threat risk in your environment, the riskier it becomes.

One of the best features of AMP is its cloud feature. It doesn't matter where the device is in regards to whether it's inside or outside of your network environment, especially right now when everybody's remote and taken their laptops home. You don't have to be VPNed into the environment for AMP to work. AMP will work anywhere in the world, as long as it has an internet connection. You get protection and reporting with it. No matter where the device is, AMP has still got coverage on it and is protecting it. You still have the ability to manage and remediate things. The cloud feature is the magic bullet. This is what makes the solution a valuable tool as far as I'm concerned.

What needs improvement?

The solution’s endpoint protection, in terms of the operating systems and devices that it protects, is pretty comprehensive. The one challenge that I see is the use of multiple endpoint protection platforms. For instance, we have AMP, but we also have Microsoft Windows Defender, System Center Endpoint Protection, and Microsoft Malware Protection Engine deployed. So, we have a bunch of different things that do the same thing. What winds up happening is, e.g., if I get an alert for a potential incident or malware and want to pull the file, I'll go to fetch the file to analyze it. But, one of these other programs has already gotten it, so the file has already been quarantined by another endpoint protection system. AMP doesn't realize that and the file fetch fails, then you're left wondering what's going on. 

It's a rapidly evolving product. Every time they turn on a new feature, you're going to have glitches. Recently, they put out a bad version of a Connector, but they put out a new version of a Connector every other week it seems, so they pulled that back and put out a new version.

For how long have I used the solution?

About a year.

What do I think about the stability of the solution?

It is very stable. I haven't noticed it being unstable. It is what it is and does what it does.

On a regular basis, we have four or five network security engineers working on its deployment and maintenance.

What do I think about the scalability of the solution?

It is easily scalable. It's a simple deployment. You can push it out through any sort of desktop management system that you have.

Because we're a hospital, some things (like an imaging device) will not be using the solution as it may stop the imaging software from working. As far as endpoints for regular people who are not doctors using nuclear medicine imaging computers, it is pretty much on all those devices, including all of our virtual desktops. We have about 5,000 endpoints.

How are customer service and technical support?

Their technical support is excellent. I often wind up working with the same people who are responsive, knowledgeable, and available to do live troubleshooting and analysis. They also do a great job of teaching you things that you otherwise wouldn't know about the tool.

Which solution did I use previously and why did I switch?

We still do use System Center Endpoint Protection (SCEP). I am in the security group, and there's an infrastructure group who deploys the desktop. As part of their deployment, not only do they include AMP, they also include the Microsoft tools of various types.

Mostly, AMP affords us utility and visibility. Whereas, we had very little control and visibility into other tools because they weren't ours. we didn't have such great access. For endpoints, it's really been great for us as far as having that level of visibility and ability to control what's going on. To not only have the responsibility for security, but the ability to provide security has been the big deal for us. We didn't have such great access. 

When we only had the SCEP solution, we would get alerts but that would be it. We wouldn't have access to the tool to get more information from it. This left us sort of trying to troubleshoot the device in a vacuum without understanding what was going on.

How was the initial setup?

The initial setup was straightforward, easy, and quick. When we first started testing and deploying it, we were installing it on individual machines ourselves. It's just a matter of downloading the Connector or having the URL to the Connector that you just run on the machine. All you need is local admin rights and it takes about five minutes. That's it. 

In our testing environment, deployment was probably a month or two, because we were just testing. Once we felt comfortable with it and started deploying it, we gave it to our desktop engineers because it's an integral part of the image that gets installed on every machine. Therefore, for our entire environment, it probably took a total of four months, since three months were for testing.

Initially, we deployed it to individual desktops for testing. Then, we incorporated it into the standard image deployed on all desktops, laptops, or endpoints.

What was our ROI?

We have absolutely seen ROI. The way that it is starting to integrate and work with all the other Cisco products, as far as the ease of use, visibility, and being able to respond to incidents. We can know if something bad is potentially happening instantaneously and prevent it from happening. We can go to a device and isolate it before it infects other devices. In our environment, that's millions of dollars saved in a matter of seconds.

The solution has made our team more effective and productive.

The solution has decreased our time to detection because we are getting alerts letting us know that something needs to be looked at. Now that it's integrating with all these other tools, it's automatically submitting files for analysis to determine whether they are dangerous. Up until about two months ago, I would get a bunch of alerts about certain files. For example, I used to get alerts about a machine having a file, then I'd have to fetch the file and submit it for analysis. That stuff is happening automatically now. So, I went from about 100 or so odd alerts a week to around five because everything is now happening on its own.

What's my experience with pricing, setup cost, and licensing?

We have an Enterprise Agreement with Cisco for a bunch of tools. This is one of them.

The Enterprise Agreement is like an all-you-can-eat buffet of Cisco products. In that vein, it was very affordable.

Which other solutions did I evaluate?

We looked at a bunch of different things. We looked at Carbon Black along with two or three other of our tools that we didn't really have any control over. 

Cisco AMP came as part of the Enterprise Agreement with Cisco, so it was included. This made it much easier to spin up and use.

What other advice do I have?

You need to look at your exclusions. You need to understand everything you have in your environment that needs to be able to operate. Because one thing AMP does, if doesn't know what a file is, it will go get that file and isolate/quarantine it. That file might be part of another software platform that's needed to function for whatever it is you do. Chances are you won't have any visibility into whatever that platform is until it stops working, because AMP has quarantined one of the central files for it. Knowing what you have in your environment, what the exclusions are, and how to create and apply those exclusions for those other systems is a key piece.

I think that AMP is really effective in isolating and stopping things that it doesn't know. This is probably good because you don't know if a threat is really a threat until you get a chance to look at it. AMP gets out in front of that. This can cause problems if you don't know that you need to have an exclusion, but you're better safe than sorry.

We are using Cisco Email Security, Cisco Firepower, Cisco Talos, Cisco Threat Grid, and SecureX. We have not stood Stealthwatch up yet. We are refreshing our ISE instance. The integrations across the board have really been a multiplier for each tool individually, and certainly through AMP. It's really launched AMP into another level far as automation is concerned. The integration of all these tools is seamless and very effective.

I would rate it an eight (out of 10). It is all still a work in progress; it is all still a new thing. Not only is the tool itself a new thing, but how the tool integrates with all the other tools. It's in development.

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
Wouter Hindriks - PeerSpot reviewer
Technical Team Lead Network & Security at Missing Piece BV
Real User
Top 5
Its dashboards immediately show you what's going on in your environment, what's being blocked, and what needs to be investigated
Pros and Cons
  • "Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."
  • "We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment."

What is our primary use case?

We were looking for a security product, which would not only block known viruses, but give more visibility and control over anti-malware. We offer Desktop as a Service (DAAS) for small and medium businesses, so we have hundreds of laptops, desktops, and virtual machines. Because users click on everything, you need to have a solution in place which will detect if something happens and log it, if there's anything malicious, then it will be blocked and reported.

The main reason for going with Cisco AMP is its integration with other Cisco solutions. It can integrate our firewalling, DNS protection, and email security appliance, so if there's a malicious file, and I see it on one of those devices. I can say, "Hey, I want to have this blocked," and it will immediately stop it being emailed in or out our environment. It also can no longer be downloaded from the Internet. Thus, with one click, we have multiple points protected.

AMP is a bit of a time machine for our environment. We can see any action being executed, connection being made, or file being written, whether it's malicious or not. Everything is been logged. I can basically go back in time and see, "This user opened this website," or, "This process created this file." If at any point in time, we do get something where, "There has been malicious activity there," we can completely follow it back:

  • How did it get there? 
  • Did it change other files? 
  • Did it leave a scheduled task somewhere? 
  • Did it connect to other machines? 
  • Did it drop software on another place even before it was know to be malicious? 

All activity has been logged. If something turns out to be malicious, or if it's a user doing something they shouldn't be doing without using any malicious software but just using system tools, you can still see every command being run from the console.

The management console is cloud-based and the deployment goes to the endpoints, which are either in our data center or on the laptops and desktops that users have in their offices.

How has it helped my organization?

We worked a lot from home over the past few months. This was our only product that did not need to be changed in configuration when all the laptops did not come into the office for a few weeks. As long as there's an Internet connection, it will get the updates. Anything happening locally will upload to your cloud so you have full mobility on it. You have no need to update your console. You log in one day, and there's a note saying, "We added these new features. Click here for more." It has taken a lot of the hassle out so you don't have to worry about the connectivity or updates. You can just worry about stopping the malware you're investigating and incidents in your environments.

Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us.

With Cisco AMP, or any Cisco security products, you get Cisco Threat Response. Threat Response takes the intelligence from all your different solutions, then combines it with sources, like VirusTotal, and includes general information that Cisco has available on those threats. E.g., if I see a file somewhere, I can with one click go from my AMP console to Cisco Threat Response, and there it will be enriched, saying, "We have already seen this piece of software two months ago in Japan. This is what we thought of it. We did an automatic analysis on it. These are the indicators on this piece of software being either malicious or benign." With Threat Response, it is very easy to go from what's happening on my environment to what's happening in the world.

If there's spam coming from a machine, I can with one click determine, "Has there been any other intrusive events originating from this machine? Has it been sending me just spam or has it also been scanning me, making connections to other machines, or login attempts?" With Threat Response, we get the view from all sides, both inside and outside our network.

Orbital helps us with investigation, especially if there's been an incident on one machine, and I want to know, "Are there other machines in my environment with the same type of modifications." It's just a click away. I don't have to leave the Orbital or AMP to do the incident investigation. Thus, I don't have to pivot to another solution to check the event logs or files on the endpoints, and not having to leave the tool is very efficient. You have the same casebook in which you can keep notes of your investigation, then you can share the notes with your colleagues. 

The solution simplifies endpoint protection, detection, and response workflows, such as security investigation, threat hunting, and incident response. This positively affects our operational efficiency. We don't have to guess anymore if we have everything or need to use different tools. I can query the machines directly from Orbital. It's a complete tool set. You don't need anything else besides the tools you get with Cisco AMP. There are things now possible which we could not do before, and they're easier than before as well.

What is most valuable?

I find the the integration to be valuable. Cisco Email Security, Threat Response, and firewall are all completely integrated with this solution. It's very easy to connect your firewall or Email Security appliance with AMP to get visibility within Threat Response. On Cisco's end, we have had no trouble integrating. You go to the menu, and say, "I want to integrate this kind of device." Then, it basically shows you which buttons to click to integrate. It has been very easy.

The ability to create groups and policies precisely to your liking is also valuable. You can choose which engines you want to use for specific groups and what type of protection you want for what machines. It's not a single, one-size-fits-all. You can precisely match it to your requirements. E.g., if I have a file server and a laptop, then I want a different type of protection for those machines.

The console is really great. It's web-based. You can give everybody access. It has some great dashboards, which immediately show you what's going on in your environment, what's being blocked, and what needs to be investigated. It also makes collaboration very easy. If I start an investigation, I can open a virtual casebook that will be also stored on the console. I can invite other users to collaborate with me on the same investigation without having to send them notes or have another communication channel open to check things. E.g., I open the casebook and add interesting events to it, then other users are being updated immediately. They can also add to the same casebook, as it is very easy to collaborate from within the console on incident response.

Orbital is a good feature. It's based on SQL query. You can say, "I want to see failed login attempts," to see if there is anything out of the ordinary, then select a random or specific number of endpoints. It can run queries against the machine without you needing to make sessions. You can check if:

  • There have been any alterations in the host files.
  • Any new applications were installed.
  • There have been any events taking place in the event log, without having to leave the AMP environment.

What needs improvement?

We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment.

For how long have I used the solution?

At least a year.

What do I think about the stability of the solution?

The stability is very good. We have had no issues with the console. It has always been available. The connector also runs well.

What do I think about the scalability of the solution?

I have to ensure that the connector is installed on every device, whether it be an iPhone, Android, Linux, or Windows. I don't have to worry about the console, the amount of data, or the back-end, as that is all being handled by the cloud. Therefore, I can scale as much as I want, as long as I have enough licenses.

We currently cover 500 endpoints with Cisco AMP and are looking to scale that up to 3000 this year.

Working on the console: We have seven users. 

Working on machines protected by AMP: We have about 5,000 users.

How are customer service and technical support?

There have been a few incidents where we used their technical support, which has been very good. The highest level of certification is Cisco Certified Engineer, and these are the first people whom I talk to as I log an incident with Cisco AMP. They are certified at that level. Therefore, I'm talking to somebody who has intimate knowledge about the products. They react quickly and know what they're talking about. They say, "Can we schedule a remote session? I can work with you on the problem." Then, it's always been either the same day or the next day that they say, "I have a solution," or "I'm going to continue to work with you towards that solution."

Which solution did I use previously and why did I switch?

We previously used Microsoft System Center Endpoint Protection. We switched away from it for two reasons:

  1. System Center Endpoint Protection is a classic antivirus product, which will block no malware and only work on Windows. There is nothing advanced about it. It does not have login or the cloud console. It will only give you alerts if the machine is connected to the domain. It was a legacy product looking at the malware and the threat landscape. There was no ransomware protection. There was no sandboxing any threats if there was an unknown file. Now, it will be sent over to Cisco Threat Grids and go right on the VM, then there will be a verdict passed saying, "Good file, bad file, suspicious file." Previous solution didn't have that. 
  2. Our company was very happy with the price of Cisco AMP. It was about a third of what we were paying for System Center Endpoint Protection.

We had ransomware before we had Cisco AMP. Basically, the user calls you to say, "Hey, there are some files I cannot access well." You log into the machine and look at the processes, then you see there is a process encrypting all the files. You kill the process, get the files (which have been touched), and then start to restore. However, how can I be certain that the process which was started by the user did not leave a scheduled task saying, "In five hours, we have to start another thing," or did it upload any user data to a different machine? How can I know if was there was data loss involved in this incident?

With our previous solution, you had no way to be sure that you were not missing something, if there were not any files left, passwords/data stolen, connections made to different machines, booby traps or scheduled tasks left, etc. With Cisco AMP, if it manages to execute, I can say, "How did we get this file?" With one click, I can block it from being downloaded from the Internet and being emailed in/out of our environment. I can also see if there were any files created or connections being made. Then, I can be 100 percent sure if there was a data exfiltration, anything left behind, or if we missed anything. AMP is very thorough.

With our previous solution, if it was known malware, we would get an alert. If it was an unknown malware or ransomware, our users were our detectors. Then, it might take hours before they could say, "Hey, something's not working for me." Cisco AMP will get you that same alert within minutes of an incident occurring.

Before we had the Orbital tool and Threat Response, we were just feeling around in the dark if we were doing an investigation. We were never sure, "Did we get everything?" We did positively identify malicious malware, but, "Did we miss anything? Has anything else happened? Is this also happening on different machines?" There were these questions we were not able to get 100 percent satisfying answers on. With Cisco AMP, Threat Response, and Orbital, we are 100 percent certain that we got every trace of malicious software. We're also certain that no other machines have been compromised or will be compromised in the same way.

How was the initial setup?

The initial setup is straightforward. Because the console is cloud-based, you get an email saying, "An account for you has been created. Click here to login." Then, there is the console. There are some basic groups there, and you say, "I want to have these settings." You download an installer, which already has the policy you defined included, and run it. It installs the connector on the endpoint, then the endpoint starts talking with your console. That's all you have to do. 

You log into a website, configure your settings, get an executable that you deploy to your endpoints, and that's it. Any policy or connector updates can trigger from the console, because if you can use a web browser, you can deploy Cisco AMP and update it.

I had the first machines deployed within an hour. After, we started a fine-tuning process, which includes policies, exclusions, and rights. Total deployment was probably two or three weeks before it was part of our default image, where every new machine was being imaged with a connector included.

What was our ROI?

Time to response is a lot faster. With every incident, at least six to 10 man-hours are saved because the damage has been reduced significantly. Additionally, if I have to work on file restore for six hours, for those six hours, my IT users cannot work on that application. This does not even take into account lost productivity of hundreds of users waiting to get access to the data again who also have to wait for six to 10 hours.

The visibility has increased a lot because all the heavy work is being done in the cloud. Therefore, we see a lower CPU and memory footprint on the endpoints. All the connectors on the endpoints send your information to the cloud where it is being analyzed, then it just gets the information back. There is not a lot of heavy stuff going on with the endpoint compared with the previous solution where you had a lot of work being done on the endpoint. Thus, you're taking away CPU cycles and memory from the applications you wanted to run there.

Our technicians are doing more meaningful tasks. They can just do their threat hunting and incident response without having to find tools that can do the things already built into AMP and Threat Response.

What's my experience with pricing, setup cost, and licensing?

There are a couple of different consumption models: Pay up front, or if you have an enterprise agreement, you can do a monthly thing. Check your licensing possibilities and see what's best for your organization.

Note: You can upgrade or increase the number licenses by just placing a new order.

Which other solutions did I evaluate?

We did do a product selection, but we did only the proof of value with Cisco AMP. We looked at Trend Micro and a VMware product on paper. However, looking at our integration possibilities, since we were already using Email Security and firewalling from Cisco, there was no other product that offered the same level of integration.

What other advice do I have?

Read the manual. There is a lot of information in there. 

Cisco gives threat hunting workshops globally, which are free. They take about half a day and show you how to use this product for threat hunting. Because we're looking at protection and antivirus, we're looking at a reactive response if there is a nasty file to be blocked. With Cisco AMP, you get the possibility to proactively go hunting for threats and find them before they become a problem. With this workshop, it will really shows you the different tools with real life examples, how to effectively test, and make the most of your investment in Cisco.

The solution’s endpoint protection is very comprehensive in terms of the operating systems and devices it protects, e.g., servers, Windows and Linux, smart devices, tablets, or home PCs. As long as it has an Internet connection, I can deploy an endpoint connector. I can get all the input into Microsoft for that endpoint as well. We haven't had any operating systems or devices in which we could not get visibility with AMP.

Other solutions are just the basic, "There was something wrong." They will give you the location, but will not give you the context, from which user, nor show you how the file got onto the system. With Cisco AMP, I just open a dashboard and it will show me (without doing anything), "We had 60 malware incidents via Chrome. We had five malware incidents via Outlook. We had two malware incidents from USB sticks." Immediately, we have an overview of how we're doing today, also showing where the nasty things are coming from. I don't know if there is anything that I'm not seeing.

With Threat Response, there should be some new integrations announced later this month.

I would rate this solution as a 10 (out of 10). 

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
Cole Two-Bears - PeerSpot reviewer
Systems Architect at a consultancy with 5,001-10,000 employees
Real User
Continues to decrease the man-hours needed to perform tasks, such as threat hunting and incident response
Pros and Cons
  • "Integration is a key selling factor for Cisco security products. We have a Cisco Enterprise Agreement with access to Cisco Email Security, Cisco Firepower, Cisco Stealthwatch, Cisco Talos, Cisco Threat Grid, Cisco Umbrella, and also third-party solutions. This is key to our security and maximizing operations. Because we do have the Email Security appliance and it is integrated with Threat Response, we have everything tied together. Additionally, we are using the Cisco SecureX platform, as we were a beta test for that new solution. With SecureX, we are able to pull all those applications into one pane for visibility and maintenance. This greatly maximizes our security operations."
  • "The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications."

What is our primary use case?

AMP was purchased for our organization in response to continued threats that we had from malware and malicious activity on our endpoints. We received AMP for Endpoint and also AMP for Networks as part of our Cisco Security ELA. The solution has made a huge impact on the visibility of what has actually been transpiring at the process level on our servers and workstation endpoints as well as being able to look in detail on those processes to see whose executed those processes and what the trajectory was for those processes.

AMP for Endpoints is Software as a Service. It's a subscription service. You do download a connector onto the endpoint. Then, there is the option to run it to an air gap mode where you connect to a local server that does back out to the AMP Cloud. However, that's not the deployment we have in our case, we have it connecting back directly to Cisco Cloud Security.

How has it helped my organization?

While I can understand from a theoretical standpoint how some organizations may not want a cloud connection, it increases the processing and detection because of ETHOS and SPERO detection. Throughout all the other Cisco security products, it is able to add this detection into the threat analytics through Threat Grid and Threat Response for other customers who have the same type of hash in their environment. There are the options: If you want to submit a file to be removed after submission and also for it to be submitted anonymously.

We tie AMP into our SIEM so we are receiving alerts through the SIEM. I also have AMP independently send me alerts. I have these alerts finely tuned so I'm getting the right severity level on events where I am being notified. If you choose to receive a notification on all events, potential malware, or potentially unwanted applications, you're going to have an overload of information. Therefore, AMP allows the ability to go through and fine tune the alerts, both in the console and remotely, so you get a proper level of notification to make actionable requests and executions.

In our organization, we have about 95 percent Windows operating systems. Then, we have about five percent Mac OS. Therefore, Cisco AMP covers a 100 percent of our endpoints. It's totally comprehensive.

I had a conversation with my CIO about a week ago. We are seeing more security incidents in our organization. However, we believe these events have always occurred, and that we are more aware of them now. For example, last Thursday we had an incident where a device tried to go and reach out to a malicious website. Because of the integration we have with Threat Response between Umbrella with WSA and AMP, we were able to stop that malicious activity. That's something we wouldn't been previously aware of: If we had an endpoint out there trying to reach out to a malicious site. Until it hit our perimeter security, we wouldn't have been aware of that. You don't always want to rely on your perimeter security for everything, as it won't catch everything all the time. Therefore, you want a multilayered approach, and having Cisco AMP and Cisco Threat Response helps us to accomplish that.

What is most valuable?

There are several valuable features that AMP offers:

  • Application blacklist
  • Threat Response
  • Cognitive Threat Analytics
  • Threat Grid
  • Orbital
  • Endpoint Isolation. 

We regularly use all these features on a daily basis. E.g., if we have an alert stating exploit prevention was detected on an endpoint, we will look to see what the hash for that executable/application was, then we can add it to a simple blacklist. Then, everyone else in the organization with AMP for Endpoint running that device can prevent it from running. This is really useful in the event that you have some type of malware incident or event where something is trying to propagate. You can squash it then and there. 

There is also the ability: If you have one device that is running something that's really malicious. You can go ahead and put that in isolation mode to prevent any further spread or damage.

I have used Orbital for searching and taking a bit of a deeper dive. It provides detail on assets, users logged in, the IP address, and architecture. It also helps with going through posture assessment, threat hunting, and forensics. 

What needs improvement?

The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications.

As far as reducing the attack surface, Orbital really doesn't decrease that surface.

For how long have I used the solution?

I have been using Cisco AMP for about 18 months.

What do I think about the stability of the solution?

With most applications, whether it's AV or some type of IDS/IPS running on an endpoint, you will have some type of performance hit or degradation of the endpoint's performance. Out of all the devices that we've put AMP on, which is around a 1,000 devices at this point, we have only had one device that had a problem with performance using AMP. So, we were able to go through and tune the policy from the AMP console for that one endpoint. The overall view of AMP's performance is very good.

What do I think about the scalability of the solution?

You have the same deployment process and methodology for 10 to 10,000. Therefore, it scales very well.

How are customer service and technical support?

I have never had to use tech support for this solution.

Which solution did I use previously and why did I switch?

Threat Response is integrated with AMP and all the other Cisco security products. That has really helped to decrease the troubleshooting time. Back in the legacy days of AV and Endpoint Protection, the typical workflow would be, "Okay, I have a machine over here that has been infected. I have to figure out all the files which touched it." It was almost impossible retroactively to go back and see what everything it touched and where it all went.

You had to witness the malware in the wild (in real-time) to figure out what it was doing. With Threat Response, you are able to see its executables and trajectory across your network, then where it tried to reach the outside world. All of this helps to mitigate our threat response from days or hours to just a few minutes.

Prior to Cisco AMP, we used Sophos Intercept X, which we still do use, and we also used Carbon Black.

How was the initial setup?

The initial setup was extremely straightforward. I performed the initial install, and I maintained it ever since.

The deployment took about 30 minutes.

The deployment plan was to get the console and policies configured. Once the policies were configured, we started with the servers first because the servers were easier for us to get our hands on and ensure that the connector was installed. Secondarily, we went out to the workstation level endpoints and installed there.

What about the implementation team?

There is Cisco documentation on best practices for your specific endpoints. My recommendation would be to get with your Cisco support team or account manager and obtain the most recent iteration of that document to ensure that your deployment goes as smoothly as possible. While the deployment will go smoothly, the main thing that this document does ensure is you have the correct policies configured per endpoint type. E.g., you have a different type of policy for a workstation versus a server.

What was our ROI?

We have seen ROI, but it's hard to calculate that return on investment in terms of actual dollars because it's more man-hours. Time spent on other projects is possible because of the optimization and performance that we have by utilizing AMP.

AMP for Endpoints simplifies endpoint protection, detection, and response workflows. It continues to decrease the man-hours needed to perform tasks, such as threat hunting and incident response.

It has decreased time to detection by 95 percent. A lot of the time, prior to having AMP, even with our traditional AV protection, we weren't aware of any type of malicious activity until it had an impact on the organization.

We had a 97 percent reduction in time to remediation, because it's almost instantaneous. In the 18 months that we've had AMP, there has not been malicious activity on an endpoint that we weren't able to resolve immediately.

In our organization, Orbital definitely does save time. Anything that we can do in our organization to save time is crucial, as we have a small IT staff. Therefore, we really need to find force multipliers.

For each incident which occurs, whether it's an exploit prevention or malware detected, Orbital is saving us five to eight hours per incident. In one week, it could save eight hours, and then another week, it could save 32 hours. It just depends on the malicious activity for any given week.

What's my experience with pricing, setup cost, and licensing?

Whenever you are doing the licensing process, I would highly advise to look at what other Cisco solutions you have in your organization, then evaluate if an Enterprise Agreement is the best way to go. In our case, it was the best way to go. Since we had so many other Cisco products, we were able to tie those in. We were actually able to get several Cisco security solutions for less than if we had bought three or four Cisco security solutions independently or ad hoc.

In our case, it is a straightforward annual payment through our Enterprise Agreement.

Which other solutions did I evaluate?

We evaluated Carbon Black before going with Cisco AMP. The reasoning behind going with AMP over Carbon Black was we already had other Cisco security products in our organization. Therefore, AMP was a native integration versus something like Carbon Black where you're looking at a third-party integration. Also, Carbon Black was a bit more cumbersome when it came to performing a lot of the tasks that AMP performs. Carbon Black was first to market with things like endpoint isolation. However, after speaking with our Cisco account reps, we did realize that, "Okay, Endpoint Isolation is coming to AMP. It's just not there yet." That did come to fruition, so there wasn't an advantage to using Carbon Black over AMP. Plus, there were several advantages to using AMP over Carbon Black. That's what led to our decision.

What other advice do I have?

Integration is a key selling factor for Cisco security products. We have a Cisco Enterprise Agreement with access to Cisco Email Security, Cisco Firepower, Cisco Stealthwatch, Cisco Talos, Cisco Threat Grid, Cisco Umbrella, and also third-party solutions. This is key to our security and maximizing operations. Because we do have the Email Security appliance and it is integrated with Threat Response, we have everything tied together. Additionally, we are using the Cisco SecureX platform, as we were a beta test for that new solution. With SecureX, we are able to pull all those applications into one pane for visibility and maintenance. This greatly maximizes our security operations.

Orbital just went from beta to production recently, so I haven't had the opportunity to go through and do a complex search on anything yet.

Biggest lesson learnt: How impactful proper tool utilization in an organization can be to the overall efficiency.

I would rate the solution a 10 (out of 10).

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
DanTurner - PeerSpot reviewer
CIO at Per Mar Security Services
Real User
Provides me with peace of mind that the network is taking care of itself and that the endpoints are protected
Pros and Cons
  • "It doesn't impact the devices. It is an agent-based solution, and we see no performance knock on cell phones. That was a big thing for us, especially in the mobile world. We don't see battery degradation like you do with other solutions which really drain the battery, as they're constantly doing things. That can shorten the useful life of a device."
  • "Maybe there is room for improvement in some of the automated remediation. We have other tools in place that AMP feeds into that allow for that to happen, so I look at it as one seamless solution. But if you're buying AMP all by itself, I don't know if it can remove malicious software after the fact or if it requires the other tools that we use to do some of that."

What is our primary use case?

We're using it in a handful of ways. We initially bought it to provide endpoint protection against malware and the like on our laptops that were mobile and off our network the entire time. We eventually moved it onto all of our desktops, and we have now integrated with Umbrella, so we have a full protection suite for all of our clients across our enterprise. 

How has it helped my organization?

The most valuable thing about the solution is a feature that's not in the actual product set itself. It's peace of mind. We take a look at security holistically, multilayered. We start from the edge and perimeter and work all the way down to the client. I feel we've deployed best-of-breed in each of the slices of the security layer. For the endpoint, Cisco gives us good clarity about what our endpoints are actually doing. So when we get bad actors into the network, we get quick visibility into which devices are compromised.

We've really subscribed to the whole security stack from Cisco. AMP feeds into that whole Threat Grid for us. We're able to see hashes, and the like, all the way down to the client and we get that visibility because of AMP. As AMP reports back into the Threat Grid, we can see the hashes running on the actual endpoint, and whether they are malicious, and what those things have done. If malware has infected a certain laptop, we get all the forensic evidence around that laptop and, if it's jumped, where that bad stuff has jumped to and what it's done. All that visibility is possible because of AMP.

Even as a standalone product, you get peace of mind having AMP running on something. So if you open up an attachment and it's doing things that it's not supposed to, because your endpoint gets security updates it is protected. Whether it's connected to the network or not, whether it's connected to the internet or not, it is protected. It does its job very well.

The fact that the solution offers cloud-delivered endpoint protection simplifies our security operations. We don't have to worry about updates or signature updates. It takes care of itself in the background, so it frees my guys up to do more meaningful work.

The quality of alerts that actually percolate up for us to take action on are on point. There aren't a lot of false positives so my security team is able to spend its time more effectively. They're not on a wild goose chase. They're chasing actionable things to take care of.

In addition, the security stack that we have in place allows us to see a threat once and block it everywhere, across all endpoints and our entire security platform. If one piece of bad malware gets through, the entire network will self-heal. It makes us more efficient. Standardizing on one pane of glass is the dream that you're after. So even though Cisco doesn't have just one management console for its entire security suite, the pieces plug in properly. With help from Cisco and their security experts, having this deployed the right way lightens the load on my team. We become much more effective. I don't have a team of 15 security experts running around our network, facing down bad guys and preventing them from ever touching our core pieces of data or IP assets they would be after. AMP and the rest of the security stack from Cisco give me peace of mind that the network is taking care of itself and that the endpoints are protected. As long as we are not careless with the pieces that we control, we can rest reasonably well at night knowing that Cisco is doing the heavy lifting that keeps the bad guys at bay.

AMP has decreased our time to detection and to remediate, without a doubt. It's gone down by 100 percent. We're able to detect, real-time, bad or malicious software and mitigate it, not quite in real-time but pretty darn close. If you go back to when we first deployed it, there was no time measurement, so I'm comfortable saying it has sped things up considerably. Now, we're only chasing real threats.

What is most valuable?

It doesn't impact the devices. It is an agent-based solution, and we see no performance knock on cell phones. That was a big thing for us, especially in the mobile world. We don't see battery degradation like you do with other solutions which really drain the battery, as they're constantly doing things. That can shorten the useful life of a device. We're really happy about that. That's why we decided to go full-steam-ahead on that. And of course, on laptops and desktop, there's no performance hit whatsoever. We have Windows, Android, and iOS, and deployment of the agent is very easy, and is done with no user interaction.

The other thing that we really like, from the agent standpoint, is that our end-users are not capable of turning the tool off. That was very critical for us.

The integration of the Cisco Threat Response feature with products such as Cisco Email Security, Cisco FirePOWER, Stealthwatch, Talos, Threat Grid, Umbrella, and third-party solutions means it plugs right in. We use that entire stack, with the exception of email protection. Talos is out there as the guiding force, applying visibility from around the globe, and the insights that it gains, and then feeds back into all the security platforms. Threat Grid lets us see and track hashes with the forensics that we get. It is just out-of-bounds crazy what we're able to do in a very short period of time. That's all dependent on the stack working together. That's where Umbrella and AMP come into play, and having those agents out there running on endpoints and feeding it all the way back up the stack and giving us visibility into all our north-south traffic through the network. That is important.

We use FirePOWER on our firewalls to try to prevent bad guys from getting in. The thing we're really impressed with there is that even if questionable hashes that get through, we're able to say, "Oh, something bad got through," and we're able to track it back and remove it from the network after it's proven to be malicious. We see that on a constant basis. That's a very useful tool. The ability to extract that malicious software automatically is a cross-function of AMP, ISE, and FirePOWER. Using that entire stack, we're able to automate that entire process, with my guys not having to do anything. It just happens.

What needs improvement?

If it could physically go out and slap the end-user to keep him or her from doing the bad thing initially, that would be great.

But seriously, maybe there is room for improvement in some of the automated remediation. We have other tools in place that AMP feeds into that allow for that to happen, so I look at it as one seamless solution. But if you're buying AMP all by itself, I don't know if it can remove malicious software after the fact or if it requires the other tools that we use to do some of that.

For how long have I used the solution?

We've been using Cisco AMP for Endpoints for well over five years. Aside from firewalls, it was our first security software product from Cisco that resides on the desktop. It goes on laptops, desktops, the whole shootin' match. Recently we started to deploy it on mobile devices and we're excited about that.

What do I think about the stability of the solution?

It's rock-solid. I don't think there's more to say there. It's just a rock-solid solution.

What do I think about the scalability of the solution?

We have about 800 endpoints that we protect with it and that number is growing, because around the end of 2019 we started playing around with deploying AMP onto cell phones, both Android and iOS. We kicked that tire for a few months and during [COVID] quarantine, we finally figured out how to make it all successful. We've now started rolling that out and we have close to the same number of smartphones out there as other endpoints. We're rapidly deploying it out to all of our Apple and Samsung devices.

We're a baby user, even at 800 endpoints. We get great value out of 800 endpoints. I've talked to peers of mine who run much larger IT organizations who have it scaled out to tens of thousands of endpoints, with the same ease. It scales very well.

How are customer service and technical support?

Their tech support, overall, is best-in-class. If you ever have a question, TAC gets the answer for you and helps you work through the solutions. 

One thing that we are working on is trying to integrate AMP with AnyConnect. We have our image or our "build." We install AMP, and then we install Umbrella, and then we install AnyConnect. Now Umbrella and AnyConnect have integrated together, and AMP is coming. We've been working with customer support to build all of it into AnyConnect in one deployment model. They've been fantastic to work with.

I don't think it's quite ready for release, yet. We're on the beta side of things. They asked us to kick the tires to get some feedback from a medium sized enterprise on ease and scale. They're trying to make it as simple as possible so that you can just punch in a little bit of configuration info and away it goes.

Which solution did I use previously and why did I switch?

We've been an AMP customer for a very long time. We've always had antivirus on the desktops; that's what everybody needed to do. Then, I went to a security conference and Cisco was talking about AMP and about how ineffective antivirus really was and that you needed something more. This was when they were bringing AMP to market. I seized on it immediately and said, "That is well-priced, well-positioned, and exactly the gap that we need to fill."

It definitely helps us minimize security risks. We were probably aware of those risks, but may have just been limited in the tool sets available to us. AMP came to market when there weren't a lot of tool sets out there. Before AMP, we made our best efforts in educating and the like, in the hope that nobody would click on bad things. But then we were able to plug AMP into the environment and know that we had a piece of software so that if somebody did click on something bad, we had tools in place to prevent it from doing anything totally out of bounds, and business-shattering.

Malwarebytes was probably about the closest that we had to a solution that was comparable to AMP, but they are definitely not direct competitors. That was a tool that we used on a one-off basis if we thought a computer was infected with malware. Once we deployed AMP, we no longer had a need for that tool.

How was the initial setup?

The initial setup was straightforward. I've been at Per Mar Security for over 20 years and there are a handful of solutions that just work the way they're supposed to, out-of-the-box. AMP's startup guide was on point. I'm the one that deployed it, and I still do some of the technical stuff, day in, day out. I was able to go through their Quick Start Guide and we were able to deploy it out to over 800 endpoints in a matter of two weeks, and that was mostly due to how we roll software out. We probably could have deployed it all in one day if we really wanted to. But we have 30 offices, so we just went office-by-office. It was easy-peasy.

What was our ROI?

We've seen ROI, absolutely, in more efficient use of my team's time.

What's my experience with pricing, setup cost, and licensing?

The visibility that we have into the endpoint and the forensics that we're able to collect give us value for the price. This is not an overly expensive solution, considering all the things that are provided. You get great performance and value for the cost.

This is a mature product for Cisco. They've been in this space for a while. There are a lot of competitors out there and, since we deployed AMP, we've had some of the competitors to AMP take runs at us and say, "Hey, look at our little widget. We think we're better. We catch more things at a higher hit rate." Every once in a while we'll get bored we'll take a look at one of these tools. We'll say, "Hey, pretty cool tool." And then we see the pricing and, after they perform CPR on you and resuscitate you and you get back to living, you're like, "Holy cow, that is way overpriced compared to what I'm paying for AMP." AMP is very well-priced. 

When I look at different solutions, I always go back and compare them to AMP. I'll tell the others, "Hey, here's what we're paying for AMP, per user. You guys can't be any more than that, because here's everything we get from AMP. You guys are only doing one thing or two things, and AMP's doing all these other things for us."

AMP's pricing is the gold standard that I compare all other pricing to, from antivirus to other security tools. That's how well-priced I think AMP is.

What other advice do I have?

Take a holistic view of your security stack. If you can only focus in on the endpoints, I understand, but if you take a longer view on where you want your cyber security posture to be over the course of time and over the course of budget, this is a great building block. I took a step back half a decade ago, evaluated where we were and where we needed to be, and I started taking baby steps. We started with AMP; we quickly added Umbrella. And that was a great little solution to endpoint protection. We knew where our people were going on the internet. We could block them from bad sites. We had the power of Talos protecting us.

Over the course of time, and as budget constraints allowed, we were able to add on more layers. I would rate our cyber security posture as very mature. You're always growing, you're always evolving, as the threat landscape does, but I think that we have the fundamentals in place to be able to adjust rapidly to an evolving threat landscape. 

That didn't happen overnight. We didn't just open up the checkbook and write a $10 million check to say, "Hey, we have cybersecurity." We took a very methodical approach over the course of time, trying to plug in the right pieces as they fit and as our business grew and matured. Our fundamental building block was AMP. We started there and then built out from it. Just recently, this past fall, we finished up building security into the core of the data center. We built from the endpoint up to the perimeter and then into the data center. Now, we have good visibility into our north-south traffic, where AMP plays and, with the recent project that we just finished up, we now have great visibility into east-west traffic out of the data center. AMP plays into that, too.

At the end of the day, AMP will feed both data feeds and give you good visibility into all your traffic, whether it's leaving your network, coming into your network, or going across your network.

We're very confident about the security alerts that pop up on Threat Grid. And we use another tool that's not Cisco-related, another SIEM tool, that will alert us for different things. We cross-correlate the two platforms — it's like a check-and-balance, if you will. It makes sure Cisco's doing everything it's supposed to, and that this other tool is doing everything it's supposed to do.

Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
SunnyNair - PeerSpot reviewer
System Architect at COMPASS IT Solutions & Services Pvt.Ltd.
Real User
Excellent scalability with good integration capabilities and easy to deploy in Cisco ecosystems
Pros and Cons
  • "The solution's integration capabilities are excellent. It's one of the best features."
  • "I would recommend that the solution offer more availability in terms of the product portfolio and integration with third-party products."

What is our primary use case?

The primary use case is for endpoint protection. For the larger deployments, we use it for our policy enforcement as well. We use AMP on the endpoints for writing automated policies in order to protect the user when they join the network, for example. 

What is most valuable?

The solution's integration capabilities are excellent. It's one of the best features.

Most of my ecosystems are Cisco-based, so AMP is an easy deployment for me and an easy sale as well. There is a lot of technical documentation which is readily available. There's a lot of Cisco-based education which is really helpful in terms of various unique situations that we run into.

What needs improvement?

I would recommend that the solution offer more availability in terms of the product portfolio and integration with third-party products. 

AMP works very well within the Cisco ecosystem. If it could work along with the third party ecosystem as well, if that integration or even more APIs came into play, I think we could utilize this product a little bit better.

One thing which I would like to see in terms of a major improvement would be AMP supporting the IoT infrastructure, which has been coming up in networks recently. It should also support more factory managed devices, like systems running Linux. Better support is what I'm looking for.

The common endpoints are already covered and we work very well with them. That would be the case if support is extended to new devices as well. I think that would bring real value to the table.

AMP has recently released email security and web security. If there was something like a common dashboard, similar to that of CrowdStrike, it would be useful.

AMP needs to come up with a common dashboard for all of the solutions. That single pane of information would allow us to view everything. 

Instead of installing a plugin, what we need AMP to do is run installs in the background. Then the user doesn't know that AMP is running on the system. That would be a fantastic use case or the recommendation which I would like to make, in they're looking for products and features to develop. Something like that would allow me to have a high-end deployment in place for AMP which would be ideal.

For how long have I used the solution?

I've been using the solution for two or three years now. I have been using AMP since it was acquired as an independent company. That means I have almost five years of experience in AMP and AMP-based products.

What do I think about the scalability of the solution?

Scalability wise, AMP is a sure shot recommendation. I would recommend it for an endpoint protection solution compared to any other product out there in the market. It's number one.

I work with small and medium-sized organizations as primary clients which I have targeted AMP on. The small users or the smaller segment within our clients are from 10 users to 500 users. And when I'm talking about medium deployment, I'm referring to users ranging from 500 to 5000 users.

How are customer service and technical support?

The technical support has always been fantastic.

It has never been a disappointing experience to be very frank. Cisco TAC has been very helpful. I worked in the presales team as well, so there is Partner Plus which has always been favored in terms of providing us with solution-based documents as well as presentations to take to our customers.

In a couple of ways, I think we are doing a very good job in terms of the resources which are being provided as well as the support that has been designed around this product.

How was the initial setup?

The initial setup is very straightforward.

What other advice do I have?

I normally work with Cisco systems, as well as most of the routing and switching companies out there, like Juniper, among others.

We're partners with Cisco. I handle consultation with all Cisco products, which includes all of the safe architecture, security logging, and switching. I'm basically working with the system architecture within Compass. I am a unified, tech grade umbrella for the entire product portfolio.

I'd advise, if users are running a Cisco environment, to definitely adopt AMP as an endpoint-based solution, which makes it a lot easier for them to manage your devices.

I'd also advise that AMP works very well if someone is running a non-Cisco set up (and they're looking at an endpoint solution that works independently). However, there's a little bit of complexity in terms of getting the actual business use case, because there's less documentation surrounding that kind of setup.

In terms of rating the solution overall, I'd rate it an eight out of ten. It has covered most of the feature sets we need. The reason I'm not giving it a full ten out of ten is because there is still room to improve the scope of integration. It doesn't support many of the IoT endpoints as well as the other components on the network, which are not yet compatible but under development. Once that happens, I'd probably give it a proper ten out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: partner
PeerSpot user
MohamedEladawy - PeerSpot reviewer
Service Security Lead at Salam Technology
Real User
Top 5
Good sandboxing features but the technical support could be better
Pros and Cons
  • "It is a very stable program."
  • "The technical support is very slow."

What is our primary use case?

We mainly use this program for our business operations.

What is most valuable?

The feature I find most valuable is the sandboxing.

What needs improvement?

I think there should be better support and I would also like to see an easier implementation of the solution. The support should be cheaper and more available during the implementation stage. It would be great if they could have support teams that involve an AMP team because there's a specific team for AMP.

For how long have I used the solution?

I have been using Cisco AMP for Endpoints for around three years now.

What do I think about the stability of the solution?

Cisco AMP for Endpoints has been very stable so far. 

What do I think about the scalability of the solution?

I believe the solution is scalable. We have around 200 end users working on this program, and then we have a team of 15 that is responsible for technical and maintenance issues.

How are customer service and technical support?

I will rate the technical support a six out of ten because their response time was very slow. Not as fast as they used to be.

Which solution did I use previously and why did I switch?

We also use Micro, so we use two programs simultaneously. 

How was the initial setup?

I did the initial setup myself and it was really easy and straightforward.

What other advice do I have?

I will recommend this solution to others. I would, however, like to see better features and implementation to cover some points. It would be nice if they could add more protocols to support encrypted files, and be able to inspect an encrypted file, or at least be able to support that. Better and faster technical support is also necessary. 

On a scale from one to 10, I rate this solution a seven.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: partner
PeerSpot user
CEO at Oriental Weavers
Real User
It is stable, easy to scale and I like the price
Pros and Cons
  • "I am really satisfied with the technical support."
  • "I would like more seamless integration."

What is most valuable?

I like that this program is very light on the computer and very powerful. I also like the price.

What needs improvement?

I would like more seamless integration, because I have a security solution based on Cisco and I'm looking at integration for the old solution. It would be much easier for the security administrator to monitor integration.

For how long have I used the solution?

I have you been using this solution for almost a year now.

What do I think about the scalability of the solution?

I guess it's easy to scale, because I started a project with the requirements and when I needed to move forward to scale it up, it's been so easy. We currently have around 50 users. 

How are customer service and technical support?

I am really satisfied with the technical support.

Which solution did I use previously and why did I switch?

I also use Trend Micro. I use both programs, because they have different security layers. Both programs are very good.

How was the initial setup?

The initial setup was straightforward as we used one of the Cisco partners. The deployment took a couple of days. 

What other advice do I have?

On a scale from one to ten, I will rate this solution an eight. I do recommend it to others.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Mohammad Siraj - PeerSpot reviewer
Deputy GM at Oregon Systems
Real User
A solution that's easy to implement, is highly scalable and is extremely user-friendly
Pros and Cons
  • "The stability of the solution is perfect. I believe it's the most stable solution on the market right now."
  • "The reporting and analytics areas of the solution need to be improved."

What is our primary use case?

We're in the banking sector. We use AMP to protect security endpoints.

What is most valuable?

The ease of implementation is a very valuable aspect of the solution. It's also very user-friendly.

What needs improvement?

The reporting and analytics areas of the solution need to be improved.

For how long have I used the solution?

I've been using the solution for four years.

What do I think about the stability of the solution?

The stability of the solution is perfect. I believe it's the most stable solution on the market right now.

What do I think about the scalability of the solution?

The solution is highly scalable. It's the best part of the solution because we have done the sizing. We have focused on the sizing, which was highly scalable. And it's very clean, clear and very transparent in this area.

How are customer service and technical support?

We're very satisfied with technical support. It's one of the best.

How was the initial setup?

The initial setup was straightforward. We're well-versed in the solution, so for us, it was easy.

What about the implementation team?

We handle the implementation ourselves.

What other advice do I have?

We use the hybrid deployment model.

I would advise other potential users that if they are looking for a long term security solution, this particular solution is going to add value to their cybersecurity strategy. Cisco AMP is one of the solutions that adds value to your cybersecurity roadmap. It should not be considered as a solution, but rather as a strategy.

I would rate the solution nine out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Solution Architect / Presales Engineer at a comms service provider with 1,001-5,000 employees
Real User
Offers a good scope and a good ability to shut attacks down then go back and see what happened
Pros and Cons
  • "The simplicity of use is its most valuable feature. You can very clearly see things."
  • "The initial setup is a bit complex because you need to execute existing antiviruses or security software that you have on your device."
  • "In the next release, I would for it to have back up abilities. I would like the ability to go back to a point in time to when my PC was uninfected and to the moment of when the infection happened."

What is our primary use case?

I use the public cloud deployment model. I have installed the license, the software, on my VM and it is being managed by Cisco Cloud.

My primary use case for this solution is to test it against malicious links and for encryption and decryption. 

What is most valuable?

The simplicity of use is its most valuable feature. You can very clearly see things. You have the ability to go back in time and get details, where the malware started, what happened and where it went from the minute it got in. It offers a good scope and a good ability to shut it down then go back and see what happened. 

What needs improvement?

It should be doing backups. Every stage that this malware is going forward, it should snapshot the situation. Then I could go back to the first stage before it got infected. It doesn't have this option, and I know that other manufacturers have it, like Check Point, for example. 

In the next release, I would for it to have back up abilities. I would like the ability to go back to a point in time to when my PC was uninfected and to the moment of when the infection happened.

For how long have I used the solution?

I have been using AMP for Endpoints for three months.

What do I think about the stability of the solution?

The stability is good. 

What do I think about the scalability of the solution?

I haven't needed to scale up yet but from what I see it's supposed to be easy. My organization sells this solution. We provide the service and management of the environment of our clients. 

It only requires one staff member for deployment and maintenance. 

I'm looking to expand the usage. I offer this solution to almost every endpoint SMB client. I'm looking to establish a faster solution and I meet with clients to discuss their network security. 

How are customer service and technical support?

We haven't needed to contact their technical support because we've never had a problem that we couldn't resolve ourselves. 

Which solution did I use previously and why did I switch?

We were previously using Check Point Sandblast Agent. We switched because it wasn't as stable as this one. We had some problems with it and we needed to contact their support and it wasn't so good. I would get tough questions from my clients so eventually I told them that we would look into other solutions.

We also work with Fortinet but I prefer AMP. 

How was the initial setup?

The initial setup is a bit complex because you need to execute existing antiviruses or security software that you have on your device. 

The deployment took around fifteen to twenty minutes. 

What about the implementation team?

I deployed it myself. I am the consultant who does the deployments. 

What's my experience with pricing, setup cost, and licensing?

The costs of 50 licenses of AMP for three years is around $9,360. There are no additional costs. 

What other advice do I have?

Just purchase the license, download it, install it to an active device, the main controller, and send it to everyone. My advice is that you need to delete your existing endpoint security solution because AMP actually contains everything that you need. Those two softwares can attack each other which can be a problem.

I would rate it a nine out of ten. 

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner.
PeerSpot user
CISO & COO at a tech services company with 1-10 employees
Real User
Top 10
Improves our security using network segmentation, IPS, and integration with ISE
Pros and Cons
  • "The most valuable features of this solution are the IPS and the integration with ISE."
  • "In the next version of this solution, I would like to see the addition of local authentication."

What is our primary use case?

We use this solution as part of our organization security.

How has it helped my organization?

This solution has allowed us to segment the organization to provide better security.

What is most valuable?

The most valuable features of this solution are the IPS and the integration with ISE.

What needs improvement?

In the next version of this solution, I would like to see the addition of local authentication.

How are customer service and technical support?

Technical support for this solution is good. 

What about the implementation team?

We did the integration ourselves.

What was our ROI?

We have seen ROI with this solution.

What's my experience with pricing, setup cost, and licensing?

The licensing fees for this solution are paid on a yearly basis.

Which other solutions did I evaluate?

We chose this product based on research and for its integration with other Cisco security products.

What other advice do I have?

This is a good product but there are always going to be some issues.

I would rate this solution an eight out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Mohammad Siraj - PeerSpot reviewer
Deputy GM at Oregon Systems
Real User
Cloud-based, highly scalable and highly integrated
Pros and Cons
  • "For the initial first level of support, we provide it from our side. If there's escalation required, we use Cisco tech for the AMP. And again, they are perfect. I mean, one of the best, compared to any other vendors."
  • "The solution needs more in-depth analytics."

What is most valuable?

The most important thing is that they're cloud-based. And Cisco has introduced Cisco Umbrella, which includes AMP, Open DNS, and they integrated certain solutions, and AMP is part of their portfolio. That's why it's adding value. 

What needs improvement?

When we're talking about anti-malware protection, AMP is a very good solution, but again, the CSO level reports are not generated. There is a dashboard, there is a report, but again, those reports have to be taken to the CSO, because when it comes to security, we always want to have high-level reports. So if we had a system that generated reports from the AMP itself, that would be great for us.

Also, the solution needs more in-depth analytics. Right now they have implemented AMP, so, monitoring is happening, but you need to see what exactly is happening, the updates and then the mode of attacks that have happened and have been prevented. An in-depth report could be generated, and it should be on a CSO level. That's the value should be added to AMP solution.

For how long have I used the solution?

I've been using the solution for 4 years.

What do I think about the stability of the solution?

The solution's stability is perfect. It's the best. All the customers we have sold it to have been super happy. We mostly work with SMEs, small and medium-sized enterprises.

What do I think about the scalability of the solution?

It is scalable. Since it is part of the umbrella family, it is highly scalable, and highly integrated as well.

How are customer service and technical support?

For the initial first level of support, we provide it from our side. If there's escalation required, we use Cisco tech for the AMP. And again, they are perfect. I mean, one of the best, compared to any other vendors.

How was the initial setup?

The initial setup was straightforward and user-friendly.

What's my experience with pricing, setup cost, and licensing?

If you talk about the commercial aspect, this solution is not the Gartner one. We have a challenge because there are other solutions which are Gartner solutions, where we have competition. So we have to justify, explain, show the value propositions and then we sell are able to sell.

What other advice do I have?

I would say that if you have a vision or plan for security, and want to have an integrated solution, AMP can be a very integral part of this digitization roadmap. AMP should be considered if you have digitization or a digitalization plan, which most if not all organizations are going for. So I think AMP is good for that, from the security standpoint.

I would give this solution an 8 out of 10. It has all the solutions. 

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner.
PeerSpot user
Chief Information Officer at Sacramento County
Real User
The sheer volume of the number of emails that it blocks has increased staff productivity
Pros and Cons
  • "I am told that we get over 100 million emails a month. This filters them down and allows only somewhere about three million emails, which is a great help."
  • "I would like them to add whatever makes filtering more advanced in scanning and blocking for malware in emails."

What is our primary use case?

The primary use case is email filtering.

We are using the latest version.

How has it helped my organization?

I am told that we get over 100 million emails a month. This filters them down and allows only somewhere about three million emails, which is a great help.

What is most valuable?

We are a Cisco shop, so it just integrates with everything else that we are doing.

What needs improvement?

I would like them to add whatever makes filtering more advanced in scanning and blocking for malware in emails. It would just improve the product further. I think they are working on this, the continuous improvement aspect. 

For how long have I used the solution?

One to three years.

What do I think about the stability of the solution?

The stability seems to work well.

What do I think about the scalability of the solution?

The scalability is fine.

How are customer service and technical support?

The technical support is sufficient. Every time that we have had an issue, we call the tech support, and they are very responsive.

Which solution did I use previously and why did I switch?

We wanted to get a homogeneous environment where everything works together and is integrated well together. This was a big advantage and big driver for us.

How was the initial setup?

The initial setup was straightforward.

What about the implementation team?

We used Dimension Data for the deployment. The experience was positive.

What was our ROI?

This solution has helped increase staff productivity, e.g., if you get 1000 emails a day and 95 percent of those are garbage, then the savings that you receive from going through those emails is immense.

We have seen a measurable decrease in the mean time to detect or respond to threats by 90 percent, blocking a vast majority of threats. 

What other advice do I have?

Seriously consider it. It blocks a lot of emails. Look at the market, do your evaluation, and pick the right solution for you.

We are fairly mature in our security program maturity, but there is always room for improvement.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Edvins Logins - PeerSpot reviewer
IT Security Services Owner at Atea Global services
Consultant
Its most valuable features are its scalability and advanced threat protection for customers
Pros and Cons
  • "Its most valuable features are its scalability and advanced threat protection for customers."
  • "We would like to have an API integration with a SIEM solution, because as far as I know, it currently hasn't yet been released."

What is our primary use case?

We are trying to provide managed security services. This solution would be part of those managed security services.

How has it helped my organization?

We are on proof of concept phase and will see how it works.

I hope it will help decrease mean time to detect and respond, because it provides scalability, and we could make an efficient, effective service providing it for customers.

What is most valuable?

  • Scalability
  • Ability to integrate with SIEM.
  • Advanced threat protection for customers.

What needs improvement?

We would like to have an API integration with a SIEM solution, because as far as I know, it currently hasn't yet been released. We are looking forward to it because it's important for us to integrate the product with a SIEM solution in order to provide our customers a good, robust solution.

It needs major improvement with its ease of integration.

For how long have I used the solution?

Trial/evaluations only.

What do I think about the stability of the solution?

So far, so good.

What do I think about the scalability of the solution?

The scalability is good.

How are customer service and technical support?

We have not had any technical cases.

Which solution did I use previously and why did I switch?

We are providing our customers multiple solutions depending on their needs. So, it's more like what our customer needs. We could go with Cisco or maybe we could with another vendor (we will see). Right now, we are quite satisfied with Cisco.

How was the initial setup?

For what we have already set up, the process has been straightforward.

What was our ROI?

We are estimating 5 to 10 percent staff productivity increases.

What's my experience with pricing, setup cost, and licensing?

Our partner in Norway does the price negotiation.

Which other solutions did I evaluate?

We are looking for cost-effective, efficient solutions for our customers, and Cisco happens to be one of the vendors who fits into that scope.

Microsoft is another vendor who offers a similar licensing model for this type of solution. There is also McAfee and Trend Micro. It depends on the customer's requirements.

What other advice do I have?

We have some mature security services, like anti-malware. We are looking to broaden our service portfolio and are on the first steps to climb further. 

You should always assess your customers' needs. Once you get that information, you just look for respective vendors. 

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner.
PeerSpot user
PeerSpot user
Solution Sales Specialist at a tech services company with 5,001-10,000 employees
Real User
Real-time threat prevention using sandboxing, file trajectory, and retrospective security
Pros and Cons
  • "Real-time threat prevention using sandboxing, file trajectory, and retrospective security."
  • "It does not include encryption and decryption of local file shares."

What is our primary use case?

Endpoint security prevents malware and exploit kits coming into your mobile devices, and when you are outside the corporate network and not protected by the firewall.

How has it helped my organization?

Provides enhanced security, lowering IT risks, and IT operational costs by integrating with Cisco NGFW, network security and email security.

What is most valuable?

Real-time threat prevention using sandboxing, file trajectory, and retrospective security. On the prevention side, AMP has nine engines.

New feature AMP Visibility (beta) is an IR orchestration tool, where the local AMP for Endpoint Intelligence, Talos Intelligence, Threat Grid, AMP global intelligence, Umbrella Investigate, and VirusTotal are correlated. This gives a visual IR tool where you can search by file (SHA256), IP, or domain.

AMP for Endpoints is not a point solution. The AMP architecture also support ISR routers, IPSs, and NGFWs, Email and web security from Cisco is making common cloud threat architecture for all customers checkpoints.

What needs improvement?

It does not include:

  • Encryption
  • Decryption of local file shares
  • Disks and URL filtering are done by separate product (Umbrella/OpenDNS).

For how long have I used the solution?

Less than one year.

What's my experience with pricing, setup cost, and licensing?

Pricing can be more expensive than similar software that does less functionality, but not recognized by customers.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Buyer's Guide
Download our free Cisco Secure Endpoint Report and get advice and tips from experienced pros sharing their opinions.
Updated: December 2022
Buyer's Guide
Download our free Cisco Secure Endpoint Report and get advice and tips from experienced pros sharing their opinions.