We performed a comparison between Carbon Black CB Defense and SentinelOne based on real PeerSpot user reviews.
Find out in this report how the two EPP (Endpoint Protection for Business) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
"Device Trajectory is one of the most valuable features. We're able to dig in and really understand how things came to be and where to focus our efforts."
"The most valuable feature is signature-based malware detection."
"Definitely, the best feature for Cisco Secure Endpoint is the integration with Talos. On the backend, Talos checks all the signatures, all the malware, and for any attacks going on around the world... Because Secure Endpoint has a connection to it, we get protected by it right then and there."
"Another of my favorite features is called the Device Trajectory, where it shows everything that's going on, on a computer. It shows the point in time when a virus is downloaded, so you can see if the user was surfing the internet or had a program open. It shows every running process and file access on the computer and saves it like a snapshot when it detects something malicious. It also has a File Trajectory, so you can even see if that file has been found on any of your other computers that have AMP."
"The most valuable feature is its threat protection and data privacy, including its cyber attack and data protection, as we need to cover and protect data on user devices."
"The integration with other Cisco products seemed to be really effective. We had Umbrella in place and we were using AnyConnect as well as Firepower. Once a threat was detected, being able to do the threat lookups and the live tracking was really useful."
"I'm only using the AMP (advanced malware protection) which is protecting my file system from all the malicious things that might happen. It should protect all kinds of things that might happen on the servers, things that I cannot see."
"The biggest lesson that I have learned from using this product is that there is a lot more malware slipping through my email filters than I expected."
"The whole purpose of the product, like application control, is very good, and also if you need to update some policies, it works well and instantly."
"The product is pretty strong in terms of security and their features are very good in that respect."
"It is a very complete platform."
"The solution has a library where we can have multiple threat intels onboarded. We just have to subscribe to a particular site intel and they'll provide us with all of the truncated details so that we can create IOCs and alerts on the basis of those IOCs."
"One of the most valuable features is that it will block vulnerable sites. If there was a connection between one of our devices to a known malware site, it will block it."
"The product allows us to focus on endpoint and antivirus protection."
"The initial setup is very easy."
"We have another piece of that infrastructure that does what they call threat emulation. It's like sandboxing where it takes files that it doesn't know about, puts them in a VM-type environment, and it kicks them off to see if there's any malware or tendencies that might look like malware, that kind of thing."
"The most valuable feature varies from client to client but having absolute clarity of what happened and the autonomous actions of SentinelOne are what most people find the most assuring."
"The reporting part is awesome."
"The AI solution makes it easy for customers to detect and manage policies, as well as documents that help customers manage their platform."
"It's quite scalable."
"Their platform is really easy to work with."
"The best thing is it has a secure shell command that you can use to get into any endpoint and do some jobs."
"The XDR capability is quite good."
"When there is an incident, the solution's Storyline feature gives you a timeline, the whole story, what it began with, what it opened, et cetera. You have the whole picture in one minute. You don't need someone to analyze the system, to go into the logs. You get the entire picture in the dashboard. The Storyline feature has made our response time very fast because we don't need to rely on outside help."
"It could be improved in connection with artificial intelligence and IoT."
"In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through."
"We don't have issues. We think that Cisco covers all of the security aspects on the market. They continue to innovate in the right way."
"The GUI needs improvement, it's not good."
"In terms of the user experience, if the UX design could be much simpler [that would improve things]... if they could make it more intuitive for someone who is not an engineer so that they still can read what's going on in their webpage and understand, that would be something."
"The Linux agent is a simple offline classic agent, and it doesn't support Secure Boot, which is important to have on a Linux machine. The Linux agent has conflicts with other solutions, including the Exploit Prevention system found in Windows servers. We didn't find a fix during troubleshooting, and Cisco couldn't offer one either. Eventually, we had to shut down the Exploit Prevention system. We didn't like that as we always want a solution that can fit smoothly into the setup without causing problems, especially where security is concerned. The tool also caused CPU spikes on our production machine, and we were seriously considering moving to another product."
"An easier way to do deduplication of machines, or be alerted to the fact that there's more than one instance of a machine, would be useful... That way you could get a more accurate device count, so you're not having an inflated number."
"The thing I hate the most, which they have not fixed, is when it creates duplicate entries within a console. If you have a computer and you upgrade from Windows 7 to Windows 10, or you upgrade your agent from version 6 to 7, it creates a new instance in there instead of updating the information. Instead of paying a license for one computer, I have to license two computers until I manually go in, search for all the duplicate entries, and clean them out myself."
"The local technical support is very poor, but the support from headquarters is very nice."
"I would like to see the user credentials feature improved. I would also like to see more reporting features and better ways to roll the reports out."
"The solution would be more effective if there was a way to block automatically based on behavior."
"This solution could have greater granular control on how certain applications work."
"This product should be cheaper."
"There could be more knowledge. I think they made a mistake when they took away the Check Point integration, because it provides more automation and also more threat intelligence."
"The GUI and reporting should be addressed and the product's administration features need fine tuning."
"With the on-prem one, the bug has been reported by the community in early January or February, something like that, at the beginning of the year, and it's still not addressed. They have released two versions since then, and yet neither of them addresses this specific issue."
"The solution can use up a lot of resources when scanning. It would be ideal if it was lighter."
"DLP support would be a good addition."
"Some reports could be better."
"There should be more integration models with different security operations tools or soft tools."
"One area of SentinelOne that definitely has room for improvement is the reporting. The canned reports are clunky and we haven't been able to pull a lot of good information directly from them."
"The delay in updating inventory is ten minutes. If it can be improved, it will help a lot."
"One of the things they could do is extend the product range to include Android and iPhone so that you could have the app on your phone as well. There is probably something going on there with that, but that's something that they're lacking at the moment. For instance, if I was to have to recommend a client to protect their phone, I'd have to recommend Norton or something else. I don't have an answer within the SentinelOne solution."
"There is room for improvement with the management interface. It could be more user friendly."
Carbon Black CB Defense is ranked 12th in EPP (Endpoint Protection for Business) with 22 reviews while SentinelOne is ranked 3rd in EPP (Endpoint Protection for Business) with 49 reviews. Carbon Black CB Defense is rated 7.6, while SentinelOne is rated 8.6. The top reviewer of Carbon Black CB Defense writes "The manage, detect, and response feature enables Carbon Black to continuously check logs and advise us on how to improve some of the policies". On the other hand, the top reviewer of SentinelOne writes "Provides deep visibility, helpful and intuitive interface, effectively prevents ransomware attacks ". Carbon Black CB Defense is most compared with Crowdstrike Falcon Endpoint Security and XDR, Microsoft Defender for Endpoint, Trend Micro Deep Security, Secureworks Red Cloak Threat Detection and Response and Darktrace, whereas SentinelOne is most compared with Crowdstrike Falcon Endpoint Security and XDR, Microsoft Defender for Endpoint, Darktrace, Sophos Intercept X and Fortinet FortiEDR. See our Carbon Black CB Defense vs. SentinelOne report.
See our list of best EPP (Endpoint Protection for Business) vendors and best EDR (Endpoint Detection and Response) vendors.
We monitor all EPP (Endpoint Protection for Business) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
Crowdstrike USPs compared to CB and SentinelOne:
1. Very powerful Machine Learning AV
2. Device Control
3. Vulanrablity Assessment ( Sentinel One have the partial capability )
4. AWS Partner Competency
5. Leaders and having a high rating in all major Analyst reviews
6. Automated Threat Intelligence
7. Customer satisfaction and retention
Do evaluate www.cynet.com and you will find that Cynet is way ahead in the way it does Continuous Breach protection and monitoring.
IMO, it depends on whether you have abilities to validate and/or correlate telemetries - these guys brings out quite a lot of telemetry alerts for you to work on...
Are you researching to buy or to resell?
SentinelOne has not been breached
SentinelOne is hands down my recommended solution.
SentinelOne has not been breached and offers upto $1,000,000 warranty if it cannot roll back a ransomware attack.
Please contact me at CyberSec@global.co.za for more information, a demonstration, or a quote.
Your reputation and your company's cyber security is in your hands - make an informed decision
They address slighty differing customer profiles, Crowdstrike has deep integrations to Okta, Sailpoint and others, where as SentinelOne has AI automation that outstrips the general use case associated to most threat detection elements.