The feature I've found the move valuable is the 24/7 monitoring. We are a small organization that supports a LOT of endpoints and clients. Without this tool, it would be impossible for us to confidently tell clients that we are secure. Alongside this, the ability for Field Effect to make decisions on its own based on what it has learned from all the "training data" that we have provided in the past. It will only get better over time. We have had some false positives; for example, using a legitimate networking scanning tool from the terminal has been blocked. However, we were actually impressed when something so simple was caught!
