Morphisec Breach Prevention Platform Reviews

I use it mainly as an additional layer of security since we have quite a lot of servers. I have unblocked a couple of things that got filtered out, and it worked great. We are a small company, not a really large firm.

We were on-prem before, but now we are on a SaaS service that they provide, which is hosted through AWS. This makes it easier for me to access from any location. I can also have Morphisec lock it down to a specific IP for allowing me to get into the system. I would need to be on a computer within the network in order to access the AWS site. 

They provide some information about security events from Microsoft Defender. I know recently when there was that Print Nightmare issue, they did release an email saying, "We are aware of this, and Morphisec is basically on it as well." So, they don't release just random little Microsoft stuff. They would release any major breaches and ransomware. This is where they would notify clients that Morphisec has been updated already to block these things. This is definitely important to us. I am usually up-to-date on all these things. However, if I don't hear from my software vendor, I would be a little bit worried, "Are they blocking it? Is this something that will be blocked? Are they looking into it?" So, it is good to be informed on these things.

Morphisec stops attacks without needing to know what type of threat it is, just that it is foreign. It is based on injections, so it would know when a software launches. If a software launches and something else also launches, then it would count that as anomalous and block it. Because the software looks at the code, and if it executes something else that is not related, then Morphisec would block it. That is how it works.

Most of the alerts that we have gotten are for legitimate stuff. They have typically been for logins and stuff that users might try to install, e.g., WebEx or some background Google update, so we block them. We have been working internally to block the use of plugins and stuff. It's not that they are fake; they are real notifications. It is just that we have to restrict certain access to certain browsers.

It reduces two alerts every month. It is not so much. We have locked down a lot of things, like our internal group policies. In this way, we don't have to run into any random alerts developed in other people's software for a lot of little things, which we noticed that we can immediately remediate. We have Morphisec doing its real job versus just blocking tiny little programs that don't matter to it. We just have it there as a layer of security on top of our layer of security policies that we already have. I don't think it's going to really catch a lot of stuff, but if something were to happen, it is the backup. That is why we have it.

Every month we get a security report, which tells us, "These are all the things that it scanned, and these are the things that it blocked." 99% of the time, there won't be a lot of stuff, but it gives us an executive report at the end of the month. I usually review it just to make sure that things are okay, e.g., any machines that we might have replaced, need to get rid of, or archive. That is really all I would really look at the security report for. Because if I were to get something like a threat, I won't see it at the end of the month. I see it right away.

Morphisec makes it super easy for our IT team to prevent breaches of critical systems. It is a one-click install, then it takes care of the rest. If we have to evaluate anything, they will notify us. After it has been prevented, we can jump in and release it or create a new rule. Then, if it gets deployed, it gets deployed to all our endpoints. It is really simple for the amount of stuff that they actually do.

As far as threat prevention goes, it does great. There have been a couple of preventions that it blocked from browsers and stuff. From time to time, Google may try to install something through the use of a plugin and it blocks that out. 

The dashboard is really easy to use. It is not super convoluted, which is great.

Like any other threat prevention platform, this one is mostly specific to memory attacks. That is what I really like about it. I get emails if there are any threats. 

Right now, it's just their auto-update feature. I know they are currently working on that. When they release a new version of the threat prevention platform, I do have to update that, rolling out to every computer. They have said, "From version 5, you would be able to do an auto-update." While this is very minor, that is the only thing that I would say needs to be upgraded. It would just make life a lot easier for other IT teams. However, I have simplified the process, so all I need to do is just download one file.

At my company, we have been using Morphisec for about three years.

I have been using it since last November, which is when I took over from the previous IT manager and was introduced to Morphisec. 

The stability seems great. There is literally no downtime that I have ever noticed.

There is no maintenance. Morphisec does everything. As long as the endpoint is connected to the dashboard, which is hosted online, then there is nothing that I need to do besides just making sure that it has Internet access on my side, which is how it gets updates.

Scaling is very simple. We just have to add a new computer, then install Morphisec. There is really nothing else to do.

There's only two users who have access to it: a backup admin and me. In the event that something were to happen to me, the backup admin could still get into it, but I am the most active admin on the account. I usually make sure everything is up and the devices are checking in. I just check it from time to time to make sure that all the devices are cleaned up and archived. Since we have been replacing computers, I want to make sure that they are not going to be showing up in our list as offline devices if they were replaced. I just have to remove them and archive it.

I contacted their tech support once, when I was deploying the software. I just had to update an IP, and that was it. It was pretty fast. I have a direct contact with their support tech, and even our account manager. I can send issues to them, then they will forward them to their tech support team. They get back to you within an hour, and they are in different time zones. Time-wise, in terms of getting back to you, it is pretty fast.

We previously used Carbon Black. We switched to Morphisec because Carbon Black had a lot of false positives. Based on my knowledge, it was really noisy for stuff that really didn't matter. So, Carbon Black was not the best choice.

When I came in, my company was on an older version, so I had to roll out a newer version. It was literally a migration. We moved from the on-prem server to the cloud. I had to do that from scratch. It really was just Morphisec saying, "This is your new link. There is an installer. You can either install it on all your computers one by one or you can script it out." They provide all the information. Therefore, whenever a computer signs in, it would just install the program and point it to the new server.

The migration took a few seconds. Once I have set it up, all I have to do is wait for people to turn their computers on. Then, I can see them start populating inside of the new dashboard. It was just a waiting game for whenever the CPAs would turn their computers on and log in.

We are in a domain, so all our computers are managed by user accounts. We can set specific rules, e.g., when a user logs in, this happens. So, I set up a rule that would install the new version of Morphisec when a user logs in. Then, I just have to wait for them to log in from wherever they are.

Before, we had to manually install it. However, I am a believer in automating things and doing things a lot faster. So, I was able to roll it out to every computer, even making sure that we had it on all our computers by using their built-in, automatic deployment.

I get emails if I have to set up anything.

I met the guys from the support team and also used a program to deploy it.

Deployment was done in-house. My main thing was that I didn't want to have any computers being missed. It was all done on a one-to-one basis, where the guy would go to every computer and install it. So, installing it would be policy. I know Morphisec would reach out to every single computer, as long as it is joined to the domain. That was my main strategy when rolling it out to everybody. Once it popped up, I made sure the numbers matched up to know whether Morphisec was on every computer on the domain.

It is more of a peace of mind. We know that we have an additional layer of security that is protecting our endpoints, since we are working remotely for certain things. We have the threat prevention platform. 80% of our stuff is based on security materials, because of the data that we work with day-to-day. Having Morphisec made us a little bit more comfortable knowing that our servers are not going to get hacked by any random stuff. However, if it does get hacked, then Morphisec will prevent it.

Morphisec has reduced the amount of time that we spend investigating false positives. It gives me the breakdown of where things originated from. It is easy for me to identify whether it is a false positive or not. Most of the stuff is legitimate. So, I have never had to deal with a false positive block.

The solution has reduced our team’s workload. We don't have to really go in, look at stuff, and monitor a dashboard. There is something we set that will notify us. We just have it getting sent to our mailbox. Therefore, if we get an email, we would know (at that stage) that something is going on.

I know my organization was paying a lot more for the previous software that they used through an MSP. It was charged per user and cost quite a bit to use per endpoint.

I don't have to purchase any additional licenses, unless I go over. I have a license limit of 80. Whenever we renew our contract, if we have gone over that amount, then we will get billed for that amount.

Our licensing is tied into our contract. Because we have a long-term contract, our pricing is a little bit lower. It is per year, so we don't get charged per endpoint, but we do have a cap. Our cap is 80 endpoints. If we were to go over 80, when we renewed our contract, which is not until three years are over. Then, they would reevaluate, and say, "Well, you have more than 80 devices active right now. This is going to be the price change." They know that we are installing and replacing computers, so the numbers will be all over the place depending on whether you archive or don't archive, which is the reason why we just have to keep up on that stuff.

The two main contenders were Carbon Black and Morphisec. We made a decision between those two. We had two trials, where they were trialed them on different machines. Morphisec was more detailed. Morphisec was detecting stuff that was correct versus Carbon Black, which mostly just protecting literally every little thing that you do but not really malicious at all nor causing a memory issue. Morphisec was a little bit more real-time with real stuff versus just a bunch of anomalous stuff. Though, I think Carbon Black learns as it goes. 

Morphisec has helped us to save money on our security stack. Considering other platforms that we have gotten quotes from and other platforms that I have looked into, based on our initial investment into it, it has saved us quite a lot of money on external and internal devices that we would have needed to purchase from other vendors. Right now, it is saving us anywhere between the range of $9,000 to $20,000 per year, because we put a lot of money on security. We house a lot of sensitive information, so we can't afford to go around something. That would put all our clients' information at risk.

We use Morphisec as one of our security artillery platforms. We have other software that we use for security threats, so Morphisec is not the only one. Morphisec is probably around the second stack. We have our main threat prevention software that we rolled out, and after that is Morphisec. After Morphisec is our DNS filtering. 

Read the instructions. They literally tell you everything you need to do. Just make sure that you know what Morphisec is before getting into it, because it is not an antivirus. They have a feature that binds with Windows Defender. Windows Defender is an antivirus and Morphisec is more of unified threat prevention for memory attacks. So, you still need to have an antivirus.

Morphisec is a security platform. The things that it does are better for companies who have sensitive information that they don't want to risk getting out. If they have Morphisec, they can feel safe that their stuff is protected.

I would rate it 10 out of 10. It is a great program. We will definitely be renewing it when our renewal period is closer.

When Morphisec first came out, it was on-prem and we used a group policy to deploy it to the endpoints. Working with them was one of the things I did and then obviously when Covid hit I had a large majority of my workforce that started working remotely. And deploying new endpoints remotely using GPO can be a struggle. I talked to them about that and the next day I got a phone call. We're actually moving to their cloud platform that does automatic updates in the cloud now. So that if I have people working remotely, they get the update automatically. It's not signature updates and whatnot, since it's signatureless, but agent updates. If you're 4.1 to 4.15 or 4.16, those will all get deployed automatically from a cloud server, which really opened up a lot of things for us as well.

That was our request. I went in and they started working on it. I worked with them on the development of the dashboard. They're always looking for customer input about what they can do better. They're constantly asking and getting input from their customers about stuff to improve the product, and there are not a lot of organizations that do that either.

Morphisec has reduced the amount of time we spend investigating false positives. We can see what's going on in the dashboard. We're a robotics company so we do a lot of in-house development. And so we see false positives on occasion due to whatever reason. When I see that, I contact them, we'll look at the signatures, the hash and the memory affirmation, and stuff that's provided through the attacks. They analyze that, we look at the application and then they resolve it, or if it's a rare thing, I can just exclude it so that it doesn't get looked at.

It's very quick and easy to do, so it's not like I'm waiting weeks for them to analyze data. We send them the logs or they get the logs automatically, depending on how I have stuff set up, they review them, call me the next day, and tell me what we need to do. And it's over with. It has reduced my team's workload by 30 to 40%.

Morphisec absolutely helps us to save money on our security stack. Budgets were tight during COVID and we had some companies that were jumping. Their prices were going up and up and taking advantage of what was going on in the industry. Morphisec didn't do that. They stuck to their guns and said, "This is the cost of our product and we're not going to take advantage of the customer." That economic side was huge for them as well. Compared to other products, their pricing is very good and very competitive.

The product has absolutely worked flawlessly. We have had basically no issues, either with the product or with any type of virus or zero-day attacks, ransomware, nothing. It has caught everything. And the one thing that's been unique about them is I read a lot and do a lot of research on the products that are out there, and there have been some products that are widely used like CCleaner and such that had been packaged in some of these programs that Morphisec has caught. They've contacted the manufacturers of those programs to say, "This is what we found." And rather than just letting it go on, they're contacting other manufacturers saying, "You just deployed something and it's got some adware." And so they can fix their product and then redeploy the fixed version out to the public. They're looking out for themselves, but they're also looking out for other organizations as well.

There are two primary valuable features. 

It works without the end-user having to do anything. It just works. 

Second, the fact that it's signatureless is valuable. It's very light on the endpoint and does not have any performance hindrance on the endpoint. That is a huge plus as well. We've used some other products in the past that just really bogged down the machine. If we do scans in the background, and I get a request that someone wants to do scans at night, it's fine. You can take your computers home and turn them off in the evening. I don't have any of those kinds of issues with Morphisec.

Morphisec's approach to using deterministic attack prevention is a big deal for us with all the zero-day attacks and ransomware that's going on in the industry. What we've seen is quite a downturn in the virus or signature-based attacks on the endpoints and even malware. The zero-day attacks are really at the forefront industry-wide, whether it be my company or financial companies. 

Since using Morphisec we have seen a downturn in attacks because Morphisec protects us versus Defenders and whatnot that are signature-based. I know we have not had any issues with ransomware or other zero-day attacks that we've seen with machines that, all of a sudden, have become before we instituted the product. Now the machine had to be re-imaged and there was a loss of data because something was on the machine. You couldn't really determine what was on the machine because nothing was picking it up. The products we were using weren't picking it up.

We're getting ready to deploy the cloud platform. I've already got the cloud portal and everything available to me. There are some nice additional features in there that were some of the things that I had requested previously. Those are some of the features that I was looking for on my on-prem platform that they've already instituted in the cloud and that I'm sure will be instituting on their on-prem platform as well. Having to have an on-prem server required a lot of administration. Being able to push that to the cloud and have it managed up there for us is a real nice addition.

We've been using Morphisec since the inception of the product. We were really one of the first commercial organizations in the United States to use it in production. So, we started with a version 1 product, which was several years ago. We were looking to complement our stack of endpoint security products. I then went out and started doing research for primarily zero-day signatureless software that we could utilize on our endpoints. Doing my research, I came across the Morphisec product, placed a call to them, ended up talking to one of their founding members of the product. We also looked at CrowdStrike, Carbon Black, SentinelOne and some of the other similar types of software out there. We decided that Morphisec would definitely be the best solution for us.

As far as scalability, you can put it on a couple of endpoints or you can put it on thousands of endpoints. The initial installation is very fast. It's a minute and a half, two minutes, and you're done. You walk away.

The machine connects to the domain, the application's installed and it shows up in the dashboard and you move on. We put it into the group policy, there's the script, send it out, install it on the endpoint and we don't have to touch it.

Whereas with a lot of the other applications, you have to touch every single machine and make sure that it gets installed correctly, and that it's loading correctly. We just don't have to do that.

It's so fast that the end-user doesn't even really know that it's happening. For the end user's experience, it's absolutely over the top. We've had other products in the past that we've used and we've had complaints. The CPU could be dragging because their thing is doing some big scan in the background, or the application or agent itself is, for lack of a better term, very heavy so it uses a lot of memory and uses a lot of CPU, and drags down the machines. I have a company of engineers and scientists and they want all the horsepower they can have on their machines and don't want something running in the background that's dragging down what they're trying to, where they're trying to work.

We're doing between six and seven hundred nodes.

I have several people that monitor this stuff but it really takes one person to set it up and let it go. It takes a very small piece of one person's time to do this. I have multiple people because I want them to be able to have experience and understand what's going on in the environment.

To administer it, it takes less than an hour of my time a day. I get reports sent to me. I can review reports. If I need to go into the dashboard, I can pop into the dashboard very quickly, see what's going on, see if there's anything that needs tending to, and then move on about my day.

I have absolutely without a doubt seen ROI. It's the cost savings compared to other products, the performance of the product, and the amount of time saved by my team on issues that were happening before we installed Morphisec and utilized their product. I got a return on investment in less than a year.

I do not have to pay extra for anything. We're an Office 365 shop but we do not use the MS3 E3. If we would turn around and use that product in the cloud as far as Office 365, then the integration is instantaneous all the way through into Office 365. But that's not dependent on Morphisec. That's a dependence on my licensing with Microsoft.

If you don't have that integration, Morphisec integrates with just the Defender on the desktop. It's built-in. You're not paying extra for something to have that feature set.

One of the things we looked at was to see how the solutions affect the endpoint performance. Because when you start stacking up products on top of each other, on the endpoints, you can run into performance issues, memory consumption, CPU consumption, and whatnot. Morphisec was very light and does not consume hardly any CPU or memory. It runs in the background unknown to the user. It doesn't do a bunch of alerts and stuff to the end-user. It just works in the background. Then you have a dashboard and a portal that you can manage and see what's going on. Morphisec was a really good fit for us.

In the early days, on a Windows platform especially, you had third-party virus protection applications. McAfee, Kaspersky, Norton Symantec, and those types of things, and we've used several over the course of the years. When we finally migrated fully to Windows 10 platform, Windows Defender was much better at what it did. And one of the things that came up the pipe was Microsoft integration with Morphisec so that I can see what Defender's doing as well as what Morphisec's doing in our dashboard or portal. That was very unique and this worked out very well.

The other solutions at the time did not provide those things, and so that was a big plus for us too. It was nice to be able to see what's going on with Defender endpoints as well. It has been a great product for us. It definitely does what it says. Their support is second to none. If I have an issue with a false positive or something, I can place a service request and they're on it right away. We review it and they resolve it. I really can't say enough about the product and the team that supports the product. They've been great. They've treated me like kid gloves since the very beginning.

I've used their product since its infancy, if they're looking for a product that is reasonably priced, does what it says it's going to do, requires very little administration and deployment effort, then this is the product I would be looking at.

Compared to what I've seen out there right now, I'd rate Morphisec a 10 out of 10. I really can't say enough about the product.

There may be some other products coming out there that are going to compete, and that's fine. And if you look at those other products, you better take a really good, hard look at Morphisec and see what they can do. Look at the whole entire package, the support groups, and what type of support they get that you're getting, that you may not get with other products. That's an important piece for us, if something does go wrong, you know you've got someone you can call, you know you've got a support portal to put in a ticket that you're going to get a very quick response from. You look at the whole package, not just one piece of it.

Since the beginning, their deployment strategies and everything has continued to improve and get better and better. You can't do that if you're just sitting in a room, a bunch of engineers and say this is what we're going to do and this is how the customer has to do it. 

They treat me with kid gloves and I really can't say enough about the product and how it's performed for us and the support we continue to get, even years later. I get the same amount of support that I did in the early days.

Our primary use case is to protect against ransomware.

We had been hit by ransomware and a couple of our servers went down as a result and some staff computers were affected. We locked everything down very quickly. We were able to restore everything and we didn't lose any data. It took us about eight man-hours to restore the servers, restore services, and get everything back up and running, but it could have been a lot worse than it was. So we looked for a solution that bridged the gap because we have antivirus, we use Microsoft ATP and some other network security measures, but none of them caught it.

We were looking for something that we could layer with security, like what we had preexisting. It turns out it works and integrates very well with Microsoft solutions as well. It bridges that little gap of memory protection that we were looking for to help prevent further ransomware attacks and things like that.

Morphisec has enabled us to become a lot less paranoid when it comes to staff clicking on things or accessing things that they shouldn't that could infect the whole system. Our original ransomware attack that happened came from someone's Google drive and then just filtered on through that. It has put our minds at ease a lot more in running it. It's also another layer of security that has been proven to be effective for us.

It makes use of deterministic attack prevention that requires the investigation of security alerts. We can always see those and investigate further. It is pretty self-contained and automated. We have not had to really go in to investigate really.

This has made our security team's operations a lot easier. Ransomware has been the biggest threat for us. Of course, we get little attacks here and there on other threat vectors, viruses, and other malware that we have to go in and disinfect. But ransomware has not been an issue and we've even gone through and run a couple of simulated tests for ransomware from other companies. None of them have been successful like Morphisec. It just stopped it dead in its track and it was not able to do anything.

Morphisec has reduced the amount of time we spend investigating false positives. I would say by about 5% to 10%. That typically is how many ransomware-type attacks that we see. It's a low number but it's a very destructive number.

Our team's overall workload has also been reduced by about 5% to 10%. That's just for normal detection, looking for these threats, and trying to find out what it is.

Now, if we were to be infected again, it would then be reduced by a lot, just because depending on how far the infection gets, how many man-hours that would be, we know that would be very significant. We've only been hit once in the past by this. And luckily it was pretty minimal, but it could have been very severe, and then it would have really impacted us on man-hours.

It helps us to save money on our security stacks. It's priceless just because if we were to lose all of our data from an attack like that, there would be no way to get it back without paying massive amounts for ransomware. And there's no guarantee that if you pay for the decryption key from whoever's holding your data ransom, that that's even going to work or that you'll get everything back at the end. Morphisec has been a real lifesaver.

It makes it super easy for IT teams of any size to prevent breaches of critical systems. They have a way to mass deploy it on all of our Morphisec clients. It's very easy to manage, very easy to deploy, and it's also very easy to maintain.

The fact that it's able to automatically detect and block ransomware attempts is the most valuable feature. 

The dashboard is the area that requires the most improvement. We have about, I would say 5,500 computers currently, and searching through all of those takes some time to filter. So as soon as you apply the filter, it takes a few seconds. It crunches, it thinks, and then it brings up the clients that match.

Our computers are named and they have a serial number in front of their name. To be able to see who is signed in or who has a computer-based on their Microsoft account, that part is cut off unless you have a larger screen on a tablet. But on your cell phone, there's no way that I can find a scroll over to see who owns that device because the username is just cut off. Besides that, it's a simple interface. It's a simple product that's easy to maintain and manage. There's not a lot that we have to do with it. It just does what it needs to do.

I have been using Morphisec for close to a year. 

In terms of stability, so far it's worked great. It's been very stable, with no problems, and it continues to be effective so far. If for any reason, we get ransomware infection in the future, we'll know that there's a problem, but so far it's been good. All of the tests that we've run with ransomware simulated software from other vendors have all failed.

Scalability is very easy. It's not a problem. If you have the means to remotely deploy the client to all of your computers, scalability seems so far infinite, it's not a problem. If you can afford the budget for all your computers then you're good.

We are right around 5,000 or 5,500 users and their roles are anywhere from student to staff members, to administrators, and even our board of directors use it. Everyone has it. All of our computers are deployed by us. So everyone gets a computer, whether it's a student or a staff member, it's not on personal devices.

Every one of our computers is using it. All of our servers are using it. It's pretty extensive in how we're using it in that sense. But it's really just toward the ransomware side.

We used technical support only for the deployment or the migration from on-prem to the cloud. We've been having to deal with them on what steps we need to take and what we need to do to make it work. They made sure that it's a smooth transition, that we don't leave anything exposed as we're moving from one to the other, but that's it.

Support is pretty good for the most part, once in a while though, just because of their accent, it's kind of hard to understand them. We in particular had one tech that we were speaking to about the migration portion of it. There were three of us sitting in on that meeting and none of us could really understand or comprehend what he was trying to convey. It was not an issue with everyone else that we had dealt with.

We were using another solution that wasn't necessarily specific to ransomware. We were using Microsoft ATP in conjunction with Sentinel. We were starting to deploy Sentinel as well, which is also Microsoft's product, and trying to tie everything together, to make it more robust, but they did not have anything that dealt with the memory type encryption that Morphisec uses to help protect against those types of infections that ransomware often exploits. We didn't have anything specific to ransomware other than Microsoft's ATP and it does not catch everything.

But we still run ATP anyway. It ties in with Morphisec very well, even within the Defender dashboard, you can punch in your key and it will bring it up and give you some more information about it, making sure that they play well together. It literally bridges a gap that Microsoft ATP has.

The initial setup was very straightforward, especially for self-hosting. One thing to note is that we're currently looking to move to their cloud-hosted system and move away from the on-prem. That is proving to be so far a little more complicated to move from one to the other, at least from on-prem to the cloud. But not impossible. There are a lot more steps and processes to getting everything migrated over. We have to push out a new client to all of our client computers.

The deployment was a matter of a couple of hours once they provisioned the license and everything for us and provided us with everything. We were able to spin up a virtual machine to install everything on, open up the ports that were necessary, which were very easy. Then we just push out the client to all of our devices. We use a combination of Intune and SmartDeploy for remote imaging to push the software out to everybody. Once that was done, we plugged the license key into our Microsoft ATP, just for the integration of that. And that was it. It was up and running and good to go.

We tested it on just a couple of client computers initially, and then one test virtual machine for our servers. Once everything was looking like it was fine, then we just went ahead and pushed out to everything. There were no conflicts, there were no problems. Nothing came up as a red flag. Nothing got blocked that shouldn't have been. It went nice and smooth.

It took two of us to get this done, and that was our systems admin who deals with our servers and a lot of our client computers and then myself, which I handled the networking side, like opening up ports, making sure all the IP addresses were correct. 

We went directly through Morphisec. I don't think we had a third party or a vendor for the implementation.

We absolutely saw ROI. We did not pay that much for the licensing. It was very affordable. The peace of mind and not having to deal with or worry about as much as we did in the past about ransomware attacks, and just knowing that we're pretty well covered for the most part is ROI.

It is a very cost-effective solution. It's very affordable for what we're having to use Morphisec for.

It's extremely affordable for what it does, at least the product that we're using through Morphisec. I know that they have a few others that we're not using, but we don't need it. They did provide us with educational pricing as well. They were very flexible because we deployed it during COVID times and a lot of people were getting hit more and more with ransomware. And so they were also very flexible in what they were able to provide for the price. They understood that our budget was being cut because we had lost a lot of students as a result of COVID. They really worked with us, which was great. 

The licensing is also very fair. It's per device. So it was also very easy.

It's just a year-to-year license that we are paying for. There's nothing hidden, no extra charges that were unexpected or anything like that. It was very straightforward.

We looked at a couple of solutions and it would have been a full deployment where we would have to install their entire antivirus line on the product. They didn't have anything that just handled what Morphisec does. It would be a full product suite. We'd have to deploy that to everybody. We would have to ditch Microsoft ATP, which, again, we get free because we are Microsoft partners in education so it's included with our licensing of Office 365. And it would have been a lot more expensive to go a different route than what we found in the end.

My advice would be to make sure that if there are a lot of computers, especially if they're remotely distributed, make sure they have some sort of solution to easily push out and deploy it to multiple clients. That's probably the biggest hurdle that I think a lot of people would have. And we had two solutions already in place for us in the past that worked and that were compatible. The nice thing is that they were able to provide a Microsoft MSI Installer so that you can even have it so that it pre deploys it while you're imaging your computers if you're using Microsoft for imaging. It's the same thing if you're using Intune through Microsoft.

We've always been looking for something that would help to protect more against ransomware in our case. And this was it. This is the best solution that we found that worked for us.

I would rate it a ten out of ten. My only complaints are the dashboard and that's not even terrible. It still works. You just have to be a little patient.

We are in healthcare and when the pandemic started we were really getting hammered with phishing attacks. Thankfully, none of them really got through or were successful, but the uptick in the attacks made me really concerned about the potential for the results of a successful ransomware attack. 

The way I've set up our world is as a bunch of different layers, from what I consider to be best-of-breed. We have a gateway with one company, we have endpoint protection with another company, we have firewalls and connectivity to the internet handled by another company. We also have a company that monitors all of our logs. On top of that, the last thing that I saw as a big hole in my defense strategy was all these Zero-day attacks that were getting through some of the other products. They hadn't gotten through to us yet, but I had read that it was more and more of a threat. Morphisec is just another layer on top.

Part of the reason I purchased the product is that we are a very bottom-heavy IT organization, in that we have a really strong help desk group. Anything more complicated than help desk is my problem, and I have a lot of other responsibilities besides IT. I count on being able to bring in vendors that are very useful to me to subsidize that.

They have a new deal where things are controlled by their cloud controller, which is on AWS. I updated to that about two months ago. It used to be on-premises but thankfully it's not anymore.

As far as I can tell, in the year that it's been in, it hasn't stopped a significant attack of any kind. But that's not a negative for me. It is helping me to feel comfortable that all the other layers I've put in place in front of it are doing their jobs. It has definitely increased my comfort level that we are doing the utmost to protect the systems here.

Morphisec saves me from paying for a higher-tier license to get visibility into Defender AV alerts. While it doesn't really save me any money, because I didn't think it was worthwhile to have a product to do that on its own, I love that I get that as a benefit from using Morphisec. But I wouldn't have spent the money on something just to show me the Defender alerts.

I really like the integration with Microsoft Defender. In addition to having third-party endpoint protection, we're also enabling Defender, although we haven't rolled it out fully yet; we have had a test environment. I like the reporting that we get from Defender, when it comes in. I like that it's one console showing both Morphisec and Defender where it provides me with full visibility into security events from Defender and Morphisec. With our help desk situation—where it all comes to me, and I'm responsible to make sure that I am seeing anything that could possibly be a problem—having both of those in one location has been very important for me.

Morphisec stops attacks without needing knowledge of the threat type or investigation of security alerts. It absolutely does do that and that's because of the way it looks at an executable when it starts and when it asks for memory. If it asks for a specific piece of memory, then Morphisec says, "Okay, it's over here," but it's not really, and then it watches what it tries to do with that. It knows whether it did something that it shouldn't and it will kill that process in that scenario. It doesn't require foreknowledge of the application to protect you from threats. I've seen it happen because we have some old software that does some squirrely stuff, and we've had to allow it to run anyway. That old software does stuff that you wouldn't expect from modern software. If modern software were to do what that old software does, it would definitely be a threat. So I've seen it in action, but not with a live vulnerability.

We have been using Morphisec for a little over a year, although we purchased it about 15 months ago.

It's been very stable. 

Going back to before I had the cloud controller, I probably had to restart the on-premises controller once a month. I would go in and notice that 50 percent of the machines were reporting as offline. I'd restart the web services and they'd all come back. I got into the habit of regularly restarting my machine. That was definitely a stability issue and I was glad to get out of the on-prem solution, to get rid of that.

Scalability wasn't an issue for me because it took very little effort to get it onto our 1,200 machines. I used a third-party software rollout service and it installed, no problem, and worked. 

I don't think scalability is an issue, especially now that it's in the cloud. The on-prem server was never overwhelmed from a resource standpoint, so I think it would have scaled just fine as an on-premises solution, but in the cloud it obviously has all the resources it needs.

It's on every endpoint we have, but I don't think the users know they're using it. It's just running. As administrator, when there's an alert, I go investigate it. That's pretty much it. I don't have to do any maintenance because we have gone to the cloud solution.

In terms of increasing our usage, I could potentially put it back on those application servers, but it's not worth the fight because the software is relatively old on some of those machines and it gives false positives all the time. It's just easier to not have it on them.

If Morphisec had an integration with those older technologies, I would be interested in using it on them. I'd rather have it on every server, but not having it on those application servers doesn't concern me too much. The end-users really can't do anything but run that specific application on the server. They don't have the freedom to run other processes there.

If anything, tech support might be their weakest link. The process of getting someone involved sometimes takes a little time. It seems to me that they should have all the data they need to let me know whether an alert is legitimate or not, but they tend to need a lot of information from me to get to the bottom of something. It usually takes a little longer than I would expect. The last time they did an investigation, it took about two weeks to decide whether the alert was a false positive or not.

The only thing I was unhappy with was that during the sales process, I thought I was going to be getting a cloud controller. I was very disappointed that I had to build my own controller and operate it. But I don't have to do that anymore. That was the only major issue and they fixed it.

I did not have a previous solution. 

During the process of looking into Morphisec, I sent a couple of the details of some of those Zero-day vulnerabilities to the different companies that I was relying on at the time. I said, "Hey, how does your product protect me from this?" and I got them all to basically admit, "Well, we don't." I got back to Morphisec and they were able to explain how their product would protect us from these types of vulnerabilities, because they were memory attacks, and that's what Morphisec does.

The initial setup, when it was on-prem, was kind of complex. It took half a day of working with someone from Morphisec to get it set up and then four or five follow-up calls to make sure everything was set up right. When we went to the cloud controller, obviously, I had knowledge of how to run the product by then, and it took about an hour to get set up and we were running. It couldn't have been easier. I was very happy with that.

When we rolled it out, we had about 1,200 PCs and endpoints. I put the product on about 50 of them to make sure that everything was fine. We do application publishing and I put it on the application publishing servers immediately but that was not a great idea. Those are the servers that were running that old software that I mentioned, the software that was getting false positives all the time. We ended up not putting it onto those servers, but after those 50 machines ran for a couple of weeks with no issues, we rolled it out to the rest of the endpoints.

We were fully running within a month.

The only third party was the reseller, Softchoice, but they didn't do any of the work, they just sold me the product.

They charge per endpoint, per year. For 1,200 endpoints and another 60 servers, with the cloud subscription included, it was just under $43,000 for the year.

I think there are competing companies now, but I don't think there were when I was first introduced to Morphisec. I was looking for a solution and Morphisec was the one that I found. I didn't find anyone else of consequence advertising they were doing the same kind of process that Morphisec does. And I'm not looking at any competitors right now because I'm happy with Morphisec.

I don't want to think that everything I have put in place is perfect, but we haven't been hacked. I know we are being attacked. I see the logs that show we're probed every day and that we have phishing attacks that come through every day. But we haven't been attacked to a point where Morphisec has been hit as the last line of defense. It's a big deal for me just to have that visibility.

We've had lots of reports of potential threats that Morphisec has handled, but we haven't had a single one, yet, that was a legitimate vulnerability that Morphisec stopped. I don't look at that as a negative at all. I look at it as a positive, that the systems that I have in place are doing their jobs. I really consider Morphisec the last line of defense. That's the way it is set up. Nothing should get to Morphisec if everything else is working. It doesn't bother me at all that we haven't had a significant threat make it to Morphisec. But it's great to know that if one of those was to get through, we have it as an additional line of defense.

When we had it on-premises, it didn't send alerts out, so I would go into it on a regular basis to see if anything needed to be checked out. Now, as of the installation of the cloud version, it actually sends alerts. If I get an alert, I go investigate it.

It also has the potential to save money on my security stack. I'm seriously considering getting rid of our standalone third-party AV scanner, when it's time to renew that next year, and just going with Defender and Morphisec alone. I haven't made that decision yet.

I wouldn't say that Morphisec has reduced the amount of time we spend investigating false positives, because every product I use has the capability of throwing false positives at me. Morphisec does as well and I've had to investigate false positives with it.

I'd be reluctant to give it a 10 out of 10, just because it has never done anything significant. But as far as everything that they've promised and put in place, I would give it a nine. They have followed through on everything they promised. The product is working and supporting me, and like I said, even if it's just proving that everything else I have in front of it is doing its job, that's good enough for me.

If someone has the same kind of systems in place that I had before Morphisec, I would almost say it's a luxury, but it's not really because it helps me sleep at night. If someone has had an attack, that means their current systems aren't cutting it and Morphisec is a great product to have in-house. Morphisec as the last line of defense is as good as you can get. Overall, I'm very happy with the product.

It's a part of our security infrastructure. It's next-generation antivirus. It has got endpoint detection and response. 

Because we are in the power sector, we have to adopt a strong IT security policy. We have deployed several systems in place. We have a SIEM tool to monitor all logs. We have patch management. We also do a lot of audits. We are an ISO 27001-certified company. So, we do a lot of security audits. We go through a lot of security exercises internally, and we give a lot of importance to security.

The version that we have is built into the product.

It's the first layer of defense for us on the client and the server side. We haven't come across any instances of ransomware attacks or something else.

Previously, we were using traditional antivirus where a lot of exercises were required from the user's end. We had to monitor the daily updates from the OEM, and in the case of anything suspicious, such as a virus attack or detection of a virus, a lot of exercises were required. With Morphisec, we don't have to do those exercises. It detects everything quickly and takes proactive action as well. It helps with a lot of things. A lot of technical effort gets minimized because of this.

Morphisec has got a lot of features. It's next-generation antivirus. It has got endpoint detection and response. It detects abnormalities or suspicious activities inside the system and reports back. The good part is that we get reports quickly because we get alerts through the server. It provides a quick response, and alerting is also quick. It gives us detailed information about which exact file was infected, what was the suspicious behavior, and how to mitigate it or what steps Morphisec took. If we need any support, we can always contact their support. Their support is very quick.

It has got extended detection and response as a feature. Up till now, we haven't got any ransomware attacks. I've gone through a lot of reviews. A lot of people have recommended it and shared that it works very well when it comes to ransomware attack detection. Up till now, there has been no problem, and it has been working pretty well.

So far, only a few instances of normal infection have been reported. It detected malware on a few systems, but because of early detection, there were no issues. We have a patch-management solution in place. We continue to do all server patching. We have an SOP to do the patching, and Morphisec is also there for protection. Because of these security solutions in place, we haven't had any major security incidents.

Traditional antivirus products take a lot of resources in terms of memory and processor whenever background scanning happens. Morphisec doesn't take many resources. It's very lightweight, which is the best part of Morphisec.

It doesn't require a daily update. If you are installing it on any system that is not always connected to the internet, it doesn't require an update to be done on a daily basis. Whenever there's a patch or a version upgrade, we have to take care of that, but it doesn't require a daily update, which is a good part.

There were a lot of instances where proactive action was taken by the Morphisec agent. When we got an alert and were trying to investigate what exactly we have to do to eradicate or stop the infection, the Morphisec support team told us that there was nothing required to be done from our side. Everything is already taken care of. We now spend less hours than before. We used to daily monitor the logs of the antivirus system. We are PAN India, so we had to do a lot of exercises whenever an infection was found in the system. We had to go for proper patching and update of the antivirus, and we had to look for logs and other things. In the case of an infection, we used to scan in the safe mode, and in some cases, we even had to format the systems to remove the infection. Since having Morphisec, we are not doing those activities. It has saved a lot of our effort. Because of that, we have started concentrating on other securities areas.

Previously, we used to have one dedicated person for the investigation of false positives, and now, we are managing the entire show without a dedicated person. We are now working without that resource for the whole year. It has saved us approximately INR 45,000 or $600 a month.

It has reduced our team's workload. Earlier, we used to go through all the logs and scan the system. It required a lot of effort. When there was any detection, we used to format the systems, which would take six to eight hours and sometimes more than that. That effort has been minimized. In a month, we are saving the effort of four to five days. Similarly, earlier, we used to have a dedicated person, and now, we don't need a dedicated resource, which has reduced our security spending. We are saving approximately $600 a month.

We don't have to do anything as a user or as an admin. It does everything by default with its coding and inbuilt AI-based intelligence. We don't have to instruct it about what to do. It automatically takes corrective actions and quarantines or deletes a virus, malware, etc. That is the best part that I like about it.

It's lightweight. It doesn't take many resources. The users can enjoy working on their computers with better performance.

It saves a lot of effort for a technical person. Earlier, we used to monitor the traditional antivirus for updates. Now, we don't have to bother about updates, whether they are happening on a daily basis or not. A lot of the administration work has been reduced. Previously, whenever an infection was found, we used to take corrective action. We used to do a safe mode scanning of that particular computer. We had to remove that from the network. A lot of that effort has been minimized. We can enjoy working on other projects. It saves a lot of our effort with its AI and ML-based intelligence. Of course, no antivirus or OEM can give a 100% guarantee of protection from ransomware, but after having Morphisec in place, based on the reports we have gone through and the instances and suspicious activities that have been blocked by Morphisec, we are more assured that Morphisec will be able to take care of any such attacks.

We do VAPT four times a year. So far, no system-related or server-related vulnerability has been detected by the auditor. It was more related to networking devices. After installing Morphisec, we haven't come across any system-related vulnerability detection.

It has got two agents: one is for the client and the other one is for the server. It provides good protection for the servers. What I like about this product is that they've got a fantastic different system for the server.

We sometimes have to depend on the support team to know what action we should take. If the solution for an alert can be built into the report that we are getting, it will save time, and the interaction with support would be less. At times, corrective action is required, but at times, we don't need to take any action. It would be good if we get to know in the report that a particular infection doesn't require any action. It will save us time and effort.

Other than that, nothing else is required. They have taken care of everything. We are getting alerts, and we can have multiple admins. We get a good model with this view.

It has been almost a year.

It's very stable. It has been almost a year since we have been using it, and so far, it has been stable. 

It's easy to scale because it doesn't require anything. We just have to deploy the agent. In our case, we have deployed the agent through the Active Directory policy. It was quick. Once the agent is installed on a system, the system reflects on the server. We can see the client on the server. 

We have around 230 users right now, but we have 300 licenses.

We are very satisfied with their support. Their support is quick and prompt. Whenever we need to get details about an infection detected in our environment, we send an email, and their support is very quick. Within half an hour, we get a response with detailed information, which is something good about this product. I would rate their support a nine out of ten. So far, it has been good. There is no problem at all.

Positive

At my previous company, we used eScan. It's an Indian product, and before that, we used Symantec.  

At my current company, we thought to go ahead with Morphisec, as it’s a next-generation anti-virus (NGAV). We switched because we wanted to have a next-generation antivirus solution with good detection. Nowadays, security challenges faced by corporates are very high, and there are a lot of threats and infections. We wanted to have a solution that would take corrective actions and protect our environment quickly so that we don't face any challenges. The major one was ransomware. No one wants to face that kind of crisis. That was the reason we went ahead with Morphisec. It filled a lot of gaps that we had with our traditional antivirus solution.

We haven't found any complexity. It was smooth and pretty easy. We have to deploy the agent and everything starts working. It gets connected to the cloud server, and we get all the reports. That's one of its good features. In traditional antivirus, we had to go through and deploy a lot of policies. There were a lot of things to do, which is not the case with Morphisec. We don't have to do that much configuration. It's ready-made, and it works pretty well. 

We have our IT and security teams for its deployment and maintenance. We have got a team of four. It doesn't require a dedicated person. We all are experts on this solution, and not much configuration needs to be done on the server side or the client side. We just do the deployment, and if there's any alert, it automatically comes to our mailbox. So, not much effort is required. We already have a policy in place where as soon as we configure a system on the network, automatically, our agent gets deployed with the Active Directory policy. It hardly takes any time. It's easy, and everything is automatic through our Active Directory policy.

It has been a good investment. There was a little bit increase in the cost as compared to a traditional antivirus, but we are now more stress-free. Up till now, we haven't come across any ransomware because of the protection it provides. Even though its cost is a little bit on the higher side, we've seen ROI in terms of security. It's a good investment. If somebody is using traditional antivirus and is infected with ransomware, they would end up paying a ransom.

Price-wise, it's on the higher side. A traditional antivirus solution is cheaper, but in terms of security and manageability, its ROI is better than a traditional antivirus. I would recommend it to anybody evaluating or considering an antivirus solution. If your system gets compromised, the cost of ransom would be a lot more. This way, it saves a lot of cost.

You have to keep a watch on all the alerts you are getting. There is no major thing that needs to be monitored or taken care of during the deployment. You can simply go ahead with it and then forget worrying.

I would recommend it for a small organization. The spending on security is less in smaller organizations, and they often don't go for an alert mechanism or a SIEM tool. A solution like Morphisec is recommended for having an analytical view of what is happening inside the server and what kind of infection is there. It has been working pretty well for us.

I would rate it a nine out of ten.

We use version 4. It's not the absolute leading edge, but it was the first version that they supported with Linux.

We use both environments to protect our corporate Windows assets and we also use them to protect our production Linux servers. We're using an on-prem option where we installed the Morphisec server on one of our own pieces.

Our primary use case of Morphisec is to prevent in-memory attacks that would be conducted from ransomware. It's used for frontline and back-end protection. We have it installed on our front-facing web servers and on the backend database servers as well.

Morphisec has given me a lot more visibility into if my employees are actually encountering ransomware. Luckily, to date, we have not actually had any positives come through. We have had false positives, but at least it has given me the peace of mind that upon the investigation that we have not been exploited or have had ransomware, for that matter.

In the future, it'll help me with ensuring that viruses are not inundating our machines as well. Right now I have to go through a separate interface for that.

Morphisec makes use of deterministic attack prevention that doesn't require the investigation of security alerts. Anything that's suspected gets blocked immediately on the machine, which is nice. It allowed us to go back and see what was going on in that situation. And if it was in fact a false positive, then either we figure out a different way to execute whatever the person was trying to do or we can whitelist the event.

Morphisec does not save us at this point from paying for a higher-tier license to get visibility into Defender AV alerts. I'm sure once we get upgraded, absolutely it will, from what I've seen.

It reduced the amount of time we spend investigating false positives. In the past, we haven't had any legitimate ransomware attacks, all we have had is a false positives pop-up. But knowing that ransomware, once it's on a machine, pretty much tanks it, I'd say it saves me hours upon hours of having to recover individual machines, and of course, it could become exponential requirements if there was more than one machine affected. At the very least when it could be one server, it would definitely save me hours of labor up the scale if I had 80 machines that I had to fix. But, that would be a serious time issue. The protection itself saves me potentially an exponential number of hours trying to recover the organization.

Morphisec reduced our team's workload. Instead of having to go to multiple UIs, or instead of having to do manual investigations, I should say rather. It's at least put stuff to the forefront. More so, after we do the upgrade. 

Morphisec has absolutely helped save money on our security stack. The ransomware at the end of the day can cost organizations millions upon millions of dollars. Investing in tools like Morphisec is a great reduction in that cost. If I can spend $10,000 in a year to protect assets that could be ransomed for $20,000,000, that's definitely a bet that one should pursue. Morphisec absolutely it's worth the investment.

It gives us 99% peace of mind in terms of knowing our systems are not being ransomwared. Once we get the upgrade, I'm sure it'll give me much more peace of mind in terms of the antivirus functionalities, knowing that there are no viruses on our machines, as well. But, for now, the only thing I can definitively say is that it gives me confidence that in terms of ransomware attacks, we are not going to be susceptible.

The in-memory attack features have been the most valuable. As we transition to a newer version, I'm excited to see the antivirus reporting functionality search come into effect. We are planning on updating and renewing our contract with them.

My company offers online and mobile banking services. Much like your own bank or credit union, the company has apps and a web interface and provides that to various credit unions and banks. As such, we have direct connections into the various financial institutions' banking courses. We see our environment as a prime area, or vector of attack against this course. We've installed Morphisec over two different production data centers, and it's hooked into our workstations. 

Morphisec's new version provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard. The version that we're on right now does not. That's one of the things I'm excited about getting in the upgrade.

This is extremely important to my work. My team is very small. We have four guys across two data centers. Our data centers are through Rackspace, but we are the primary people that interface it. We have a team of four people that own those two data centers and make sure services are functional. We have a small team and having as much information in one basic user interface is critical.

The ease of use is great. It's a basic UI. It clearly tells us how many of our agents are checked in and how many are not. It gives us a very simple UI to be able to see attacks over time-series data, and to be able to drill down very quickly to see which assets or computers are affected. We can see what user was on there and what application was at play. So, in terms of being able to drill down really quickly, they're great.

It would be useful for them if they had some kind of network discovery. That kind of functionality I think would give IT administrators a little bit more confidence that they have 100 percent coverage, and it gives them something to audit against. Network discovery would be one area I would definitely suggest that they put some effort into.

I have been using Morphisec for around a year and a half. 

So far it's been extremely stable. Their UI has never crashed once. The agents do check in regularly. Overall, I have not had a single issue with them which is the way it should be.

We have the Ansible playbook for doing the automated install on Linux. At this point, we tell it what server to install to and it does it. In terms of scalability, it's really easy. It's pretty straightforward.

There are four users using this solution including the director of DevOps, the director of Software Engineering, and we have a DevOps Engineer and a Corporate IT Engineer.

The DevOps side folks and the software engineering guy are focused mainly on what our production systems are saying through the UI here, while the corporate IT guy is focusing much more on the Windows workstations. That said, if we do notice an attack, all four of us come together to analyze what we're seeing there.

We don't require any staff for deployment and maintenance.

At this point, we have to do the installations of any updates to the Morphisec server, or the Morphisec clients. But for that one person is enough to handle that. It's either me or the IT administrator, but it's really not that painful. 

The Windows corporate machine is the weakest spot because we don't have automation configuration managers for the Windows side. But, on the Linux side, as far as running updates, it's very straightforward. A couple of commands and run through the Samson playbook and off it all goes.

We do have plans to increase usage. So, as we transitioned to AWS, we're planning on having them with us right off the bat. 

It's critical to our security portfolio. 

We contacted technical support a couple of times towards the start, and just had to do with installation. When we first started working with them, it was using a release candidate of their latest stuff. So, it was just a couple of back and forth exchanges, but they were very attentive and forthcoming.

The setup was straightforward. With our Linux environment, our production Linux environments, we were able to deploy using Ansible playbooks to automate, and then on the windows side, they have a number of options available to us. However, because we don't have, on the corporate side, any kind of configuration management tool or whatever, I did have to have my IT admins go in and run a PowerShell script that made the appropriate calls for set up scripts so that they're set up. In terms of our own windows deployment, it was more of a manual process. But, I can tell you from experience with larger organizations and all as well, that the packages that were provided to us could have easily been loaded into a configuration management tool and pushed out much more automatedly.

Once we had things going, I mean, we had everything installed I think, in a total of 10 minutes. That's running these installations concurrently of course, or in parallel. And on the windows side, I'd say over the course of a week, we are able to manually go into all of our workstations and get this installed. Being the COVID environment that it is right now, a lot of our employees are working remotely. A lot of that overhead in that week was simply negotiating when we can actually have the employee make their machine available, remotely.

Our first and foremost deployment was on our Linux front-end servers. We're thinking, get our production environment for a layer of protection right off the bat. So, we protected our web front end as most attackers would be coming through the front door, essentially, aka those web boxes. So, we figured that if we deployed there first that we'd get a nice level of protection.

From there, we did the installations of the windows front end or the endpoints of the window on the corporate side, just to make sure that employees that would be interfacing our source code, or our production environments, would have protection in place, not only to protect their own assets but to also protect the rest of the network that they'd be interfacing with. From there, we went back and upgraded or installed the backend Morphisec agents.

We did our own deployment.

If there was a valid attack one could easily say that they could have tried to ransom us 20 million dollars.

We pay per year, and per endpoint. So, if it's a Windows server, it has its own skew. Versus, a Linux server has its own skew. Pricing is a little bit different between those.

To cover 100 Windows endpoints we're at $5,699. It all comes with the annual maintenance and support crew.

We had looked at a couple of options, but none of them actually seemed to be really what we were looking for because Morphisec handles everything in-memory as things are going. Whereas it seems like a lot of those other tools out there, like Kaspersky and the like seem to be more reactive.

My advice would be to really consider the reality. It's not a question of if you're going to get attacked by ransomware, it's a question of when. And while this seems like something that would be easy to kick down the road, in terms of evaluating the overall battlefield if you will, a ransomware attack will take down your organization. There's no doubt about it.

I would advise you to realize that with that inevitability and how much of your environment it can takedown or render useless. This would probably be one of the higher, first choices, and first endeavors you should make as you go into your source of security portfolio.

The biggest takeaway from this that I've had is, never underestimate would-be attackers. You have something on the internet, they're going to go for it. The other lesson I've learned is that sometimes users of computers do weird things, or do things differently than others would normally. That leaves the door open for would-be attackers of having tools like this in place. It will help you avoid headaches down the road.

I would rate Morphisec a nine out of ten.

We do a multi-layered security approach. Morphisec is really our last layer of defense. It is our insurance policy. So, if a vulnerability gets through the user, network security layer, and antivirus, then Morphisec will then come into the fight.

We have it deployed across all of our workstations and server environments. We have 800 workstation licenses and 75 server licenses. 

Right now, we are using 100% on-prem. We have just converted to Office 365. With that, we will be doing cloud hosting as well

In the last month, we have had two instances that Morphisec stopped, one with Internet Explorer (IE) and the second with another update. We don't know the specific vulnerability that was exploited. We shouldn't be using Internet Explorer here. So, it notified us:

1. We had a user using IE.
2. It prevented something. 

I don't know what vulnerability within IE that it was attacking, but it did go to attack a vulnerability, and Morphisec prevented that.

Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. It changes the memory locations of where certain applications run. If you think of Excel, opening a PDF, running an Excel macro, or opening a web page and clicking on a link, all of those actions run in a certain area of memory. Morphisec changes the memory locations of where those run. 

If an attack comes in and the hackers are doing a vulnerability on an Excel macro, for example, they know macros are always deployed in a certain area of memory. They write their hacks to that area of memory. Morphisec removes that area of memory and deploys all macros into a different place. When the macro goes to run, it runs in that old area of memory, which no longer is running Excel macros. It basically goes to deploy and blows up, so nothing happens. By morphing the memory location, the hack still gets through, i.e., it doesn't stop the hack from getting through. However, when it goes to run, it doesn't do anything. From that standpoint, it's really looking at: If something happens, it is the last line of defense. 

We have a number of other applications that are more forward-thinking where we are looking at logs and training people as well as doing network security. But if a hacker actually gets through all of those different protocols and goes to deploy a vulnerability or malicious piece of code, it will deploy but not do anything. The reason it won't do anything is because Morphisec has moved that process to a different area. So, it is really after the fact. 

Morphisec is really good about sending us alerts of security incidents that have happened in the world, saying, "Okay, here is an incident that is happening. It is a zero-day and Morphisec protected it in our labs." They send those out as they come up. I usually get one a week. 

We heard there was a company that had deployed Morphisec on most of their servers, but not all of their servers. They actually got hit by a hacker. All of their servers that had Morphisec running were 100% protected. All of the servers that did not have Morphisec got hit. From my standpoint, we have Morphisec across the board. We are acquiring a few other companies, and one of the first things that we are doing is deploying Morpiesec to all the servers and workstations in those other companies.

What it does is valuable. A vulnerability might be able to potentially get through and still not be able to run. This is not a question of "If," but a question of "When" someone will get through. If they do get through into our environment, we are comfortable knowing that our last line of defense is Morphisec. A lot of times, without Morphisec, we wouldn't know until we knew. You either get the encryption or it could take a long time to understand. This solution is more of a peace of mind for us.

Morphisec stops attacks without needing knowledge of the threat type or reliance on indicators of compromise. Their development team has developed the security capabilities over a large number of different vulnerabilities, e.g., Adobe Acrobat or Excel macros. We don't have to be experts on any of these. More importantly, the zero-days concern me. All our other security software says that they can stop zero-day threats, but hackers are really good and this is really profitable for them. When the zero-day threats actually get used, it's nice knowing that we have Morphisec. 

We don't have false positives with Morphisec.

From a company standpoint, a little more interaction with the customers throughout the year might be beneficial. I would like check-ins from the Morphisec account executives about any type of Morphisec news as well as a bit more interaction with customers throughout the year to know if anything new is coming out with Morphisec, e.g., what they are working on in regards to their development roadmap. We tend not to get that up until the time that we go for a yearly renewal. So, we end up talking to people from Morphisec once a year, but it is usually at renewal time.

I tried to sign up for something, but I am still not getting any alerts when Morphisec releases a new version or when our console has been updated. So, I would like to be cognizant when any changes are being made or feature enhancements are added. It would just be helpful to be alerted when that stuff comes out.

Until we migrated to their cloud platform, I wasn't even aware that some of the updates were being pushed out. Then, I came to find out that we were two iterations behind a major release. So, getting those updates or bulletins are very helpful.

If I look at the dashboard, I can see one or two applications hit every once in a while for things like Internet Explorer or some Visual Basic Scripts. I can see that stuff is being prevented, but I don't know exactly if it is securing us in any way that we wouldn't have already had in place. Overall, I don't know 100% if it's increasing our security posture, but it does give us a nice peace of mind.

We have been using it for two years.

It seems very stable and rock-solid because it is not causing any issues.

I don't require any maintenance on our side.

There haven't been any issues with scalability since we have been on the cloud platform. We do not have to maintain the on-premises servers anymore. It is hosted in an AWS environment, which should be pretty easy to deploy once we add more employees.

Our technical resource is the solo admin at this current time. Two other people have access, but there is not much that we look at or review on it. We just make sure it gets deployed on all our endpoints. That is the only thing we really monitor. As for looking at the console, unless there is something that we need to look at, we are not really reviewing it.

We get security bulletins and an email that says, "Hey, this vulnerability just took down whatever company." So, we get technical bulletins that say, "This new zero-day vulnerability just came out, we have tested and stopped it."

The technical support is pretty solid. I did have some issues after we migrated from versions, switching to the cloud version. I ran into a few deployment issues that turned out to be a bad package. They were able to help me with that. They have been pretty good. Anytime I have an issue or question, they are pretty responsive.

Before Morphisec, we did not use anything greater than our normal antivirus or malware protection.

The initial deployment was pretty straightforward. It was basically just following the included documentation and working with the admin at the time. We set up a package to push the install out to all our machines. Then, anything that was outside the default library. I added to the protector plan. Certain applications, like Notepad, weren't included in the original deployment. This is stuff that is specific to our environment, like Power BI.

Our deployment took about two weeks.

My technical resource was the one who implemented Morphisec.

It has given us peace of mind that we won't be on the news. We do a good job with backups, but if we don't have to use them, that is much better. If the federal government and major corporations who have full-on security teams can get hacked and are vulnerable, then I am not going to say we are not vulnerable. So, for us, it is just a question of when. With Morphisec, at least when it does happen, I feel confident that we have in place solutions that will not only prevent it, but also let us know when something has happened.

Morphisec has 100% enabled our team to focus on other responsibilities or affected productivity. It has reduced our workload by one full-time employee. 

Our return on investment is that we haven't needed to have a full-time employee manage it. It hasn't taken away from our other initiatives. Efficiency is really where the savings is. We are getting peace of mind at a decent cost. We can see it working, and it doesn't take full-time resources to manage it.

It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately.

Through the years, we looked at Darktrace as well as two or three others. They came with astronomical price tags, while I think Morphisec hit the better price point.

It was not just the initial price tag, but the number of people required to manage the solution. On some of the other solutions, we were able to knock down the pricing considerably, but we needed one to two full-time employees, which we don't have, just to manage the solution. With Morphisec, our technical resource is the main person who works on it. He spends less than two percent of his time managing Morphisec. It is plug and play. It doesn't take a lot of resources, which gives us more time savings as well as being more efficient.

Ease of implementation and ongoing management of the solution were the two top priorities. Our secondary priority would have been cost.

Make sure you implement it on all machines, workstations, and servers. Don't buy it and miss some machines.

Morphisec says they haven't been hacked. From the instances that I have seen when doing research, I find that to be true. Time will tell, but so far it has been working for us.

We will be implementing the Morphisec Guard probably next month. We are just rolling out Microsoft Defender right now. We are evaluating it now. I think we have also started replacing our former antivirus. 

Windows Defender and Morphisec go hand in hand, at least from an antivirus standpoint. Morphisec was built to work with Defender, and Defender is a pretty good product. So, that is what we will be using moving forward. From an antivirus standpoint, we just switched our antivirus to Defender within the last month. Between Defender and Morphisec, we don't really have another antivirus need after that.

I would rate this solution as a seven or eight out of 10.

We are using Morphisec on 100% of our endpoints.  The Morphisec protector installation is pretty straightforward, currently using the scripting capabilities of ConnectWise Automate.

Previously, we had a mix of AV and EDR solutions that required a fair amount of management.  Policy management was more complex, and reviewing exception reports was very time-consuming.  Even with this extra effort, we still encountered viruses on a somewhat regular basis. At least once or tiwce a month we would have to work on a machine to remediate it. Since we started using Morphisec, that hasn't happened even once. 

This alone has definitely reduced our team's workload. I would estimate we save between four and ten hours a month previously spent on remediation.

The attack prevention doesn't require investigation into security alerts, although we do periodically look and see what types of things are taking place. Even so, we don't spend a lot of time doing those investigations because the attack has been prevented and we don't see it occur again.

Another benefit, something that is important to me, is that Morphisec Guard enables us to see at a glance whether users have device control and disk encryption enabled properly. We want to make sure that we're properly secured and following best practices. Prior to that information being made available to us through Morphisec, we didn't really have a great way of confirming whether a machine had an encrypted disk or other security features enabled.

The solution also saves us from paying for a higher-tier license to get visibility into our Defender AV alerts. 

The primary feature, of course, is the prevention of Zero-day attacks and other related issues.

It also provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard. We've always had that capability with Morphisec. The more recent version appears to do that even a little bit more natively and it's given us visibility that we didn't have otherwise.

We are now beginning to use Morphisec Scout, which provides vulnerability information. At this time, it is able to recognize vulnerabilities and reporting them to us, but it's not actually resolving them. There's still a separate manual process to resolve those vulnerabilities, primarily through upgrades, which are done outside of Morphisec. It might be a bit much to ask, but if Morphisec could somehow have that capability, either natively or through interactions with an RMM system, that would be very effective.

We have been using the Morphisec Breach Prevention Platform for a little over two years.

It's been very stable, both in terms of Morphisec Guard and the administrative console.

We have one primary, default protection plan that applies to all of our machines, and it does the job very well. It's pretty easy to use the administrative console to check on the status of the protectors. For us, it has been very scalable -- we have 1,200 employees, and Morphisec is on every machine.

I can imagine with more complex environments there might be a need for more varied protection plans, and any limitations of the administrative user interface might be exposed. However, that's not something that has impacted us at all.

I know Morphisec is continuing to evolve and to look for additional ways to be of value to its customers, but in our case, the specific items that we are currently using from Morphisec have already provided great value.

We've only had a few instances where it's been necessary to contact their technical support, but when we have engaged them the support has been very good. We've had good responsiveness and the people we've worked with have been very knowledgeable.

Positive

We previously used more familiar EDR tools like Carbon Black and Sophos.  We still use SentinelOne on a portion of our machines, but we found that Morphisec is so effective that those EDR tools rarely have the opportunity to do the work that they would normally do before Morphisec has already prevented the attack.

Every one of those other solutions required more hands-on management and more direct involvement. With Morphisec, we just make sure it's installed.  With the default policies we have in place, things work well without much additional oversight

There were two factors that occurred simultaneously that drove us to make our initial decision about Morphisec. One was that we were in the middle of a transition from Carbon Black to SentinelOne, and I was concerned that we might encounter circumstances during that transition where we were not fully protected. I considered Morphisec to be a good additional layer. We always strive to have layers of security, and in this case, the additional layer did not negatively impact any of the other security processes we had in place. Since that time, it has been a layer that has proved to be very effective at what it does.

The second factor was that we recognized that Morphisec has a different, complementary approach to how secures our endpoints.  That approach has been very effective in dealing with unknown vulnerabilities.

The setup was fairly straightforward. We were one of the first to use the hosted  cloud instance, so there were some small discrepancies in the documentation that didn't properly recognize our scenario. But I perceive the number of clients using cloud instances has increased dramatically—it may be the norm now for Morphisec customers.  The documentation has definitely improved.

Our implementation strategy was to install it on roughly 10 percent of our environment to assess whether there were any unintended consequences,  such as performance issues. Once we validated both the effectiveness and the low impact on performance, we then deployed it across our entire environment.

The deployment didn't take long, and it went very smoothly. The reporting it provides is very good, giving you a sense of the progress. There was nothing of concern. 

I would note that there have been two different instances where we've had to manually push out significant version updates. We're now working with a version where the agent, the protector, will update itself.  We are interested to see how well this works with the next significant update.

In terms of staff requirements for deployment and maintenance, somebody has to initiate the solution, but it's not a primary role for anybody among our IT employees. We have our basic processes in place to make sure the Morphisec Protector is on every new machine that we deploy. Beyond that, we don't really spend much time looking at any of the incidents that have taken place, or managing the security policies. There is very minimal overhead.

We implemented in-house.  The documentation and the onboarding support made the process very easy to manage.

It is definitely a tool that has saved us enough time and reduced our risk enough that the cost is well-justified.

That elimination of instances where we had to manually remediate machines that were affected by a virus has saved us time. We also don't feel it's quite as necessary to use more expensive EDR solutions on every single machine, and we're just better protected. We haven't had issues where we've had data loss or exfiltration.

I'm not sure if we were an early adopter or not, but we enjoyed very competitive pricing when we began working with Morphisec a couple of years ago.  We've been very happy with the value the service provides.

This is the first year that we've had Morphisec Scout in addition to Morphisec Guard. We are eager to take advantage of the additional capabilities it offers. Of course there is an additional cost associated with Scout, but we feel the value will definitely justify the costs.

We evaluated other next-generation EDR antivirus options, but not any other options like Morphisec. I don't know if there are any security solutions quite like Morphisec.

Defender does well with known vulnerabilities, whereas Morphisec does a job that others can't, with unknown vulnerabilities. The other tools that we have in place, such as our file sharing and email services, do a pretty good job of eliminating the known vulnerabilities from even entering into our environments. But if unknown vulnerabilities are somehow used in an attack, Morphisec has done an excellent job with those attacks.

It just works and it's very easy both to install and manage. I definitely recommend evaluating it. I'm confident that anyone would see the same benefits that we have.

There are two things I've learned from using the solution. One is that their Moving Target Defense is a very unique approach and very effective. It's pretty novel.

The second lesson is the benefit of having that layering. Having Defender and Morphisec has been a really good tandem approach to things. There are a lot of companies out there that may not be comfortable relying on Defender alone, even though it's very effective at managing known attacks. Even in the instances where we're using an EDR, in our case SentinelOne, those Defender and Morphisec layers work really well. We've had good success.

Morphisec does a good job of helping us make sure our endpoints are secure. We've definitely benefited from that. The Morphisec protectors have absolutely done their job. We have not had any instances with viruses, and I would even go so far as to say the EDR tools we have in place have been largely underutilized. They're just sitting there because there really hasn't been much for them to take action on.