Netwrix Endpoint Protector Reviews

I use Endpoint Protector to protect our end server.

Endpoint Protector's best features are its protection and user-friendliness.

Endpoint Protector would be improved with more DLP templates.

I've been using Endpoint Protector for two to three months.

Endpoint Protector works perfectly.

Endpoint Protector is scalable.

The initial setup is easy with a private cloud.

Endpoint Protector has machine learning and AI, and it prevents 99% of ransomware. I would give Endpoint Protector a rating of nine out of ten.

I work for a financial services company. As a consequence, we work with multiple lenders and lender clients; essentially banks and building societies. There's a requirement in this industry for tight controls from an information security point of view. For many years we've had industry requirements to deploy a number of technical controls to secure things like device control.

Prior to using Endpoint Protector, we used Ivanti Device Control. However, from the UI point of view, it was a bit of a dated product, and some of the functionality wasn't brilliant. We also took a recommendation from our service provider, who had been using this product with other customers, and as such we deployed CoSoSys Endpoint Protector. We primarily have one single purpose, which is to secure all of our endpoints, mostly laptops. We have a very small number of client computers as well, but we primarily use it to block all removable media and all USB points on the laptops.

As a business, we don't enable and support the use of removable media. We do have a small number of use cases where that is allowed, primarily within our IT team, but they are the exception. As such, every single USB port is blocked across the business with Endpoint Protector to mitigate the risk of somebody intentionally, accidentally, or for whatever reason being tricked into inputting their USB drive into our network which would then cause potentially a risk to the confidentiality, integrity, and availability of our data.

We have a contractual requirement for us to have a tool like CoSoSys. It mitigates risk for us as a business by enabling us to be sure that no one can exfiltrate data from our company via USB media or be infected by malware by plugging a device into an endpoint.

We only use that one particular feature. I believe there are other features available but I don't believe we pay for the other elements of functionality of the software. There are other features like DLP within the software, however, we have a suite of additional tools within our business to control those other elements so we use CoSoSys exclusively for device control.

We only use it for a very small use case. It certainly has a wide range of functionality, although, we don't use the vast majority of the functionality because we don't pay for it or because we have other tools in place that are specific for a certain purpose.

The granularity of the policies that we can create is good. We block USB media. One of the reasons we left our previous provider is because of the lack of this functionality. We have built some custom rules to make exceptions for staff members that should be able to use USB media. Of course, the ability to amend and write policies is far more granular than the previous product that we used. Switches, disabling and blocking Bluetooth, weren't available with our previous supplier. 

The feature that locks down USB devices means that if you plug removable media into any of our USB drives, it blocks it. As we block, we blacklist all the types of USB devices, and the cloud running trail blocks that. If someone puts the USB drive in, it will block them from opening that drive or even registering that drive. If they want to make an exception, they have to make a formal request to do so, and that can be made either by email or through an application to our IT desk.

The versatility regarding the exit point Endpoint Protector supports in making sure that important data doesn't leave our organization is vital for us. In the industry that we're in, data breaches are a significant concern. While our staff is contractually required to maintain confidentiality and they're all very aware that they shouldn't try and transfer company data of different classifications elsewhere to non-company devices, there's a risk. If we didn't have Endpoint Protector in place, they could plug in a USB drive, copy a file onto the USB drive, and then take that onto their personal computer or share it externally, whether that be with the press or the public, etc. This tool stops that from happening. It means employees are unable to share files and exfiltrate data via that channel.

We have other controls to stop other channels. One of the biggest concerns for us as a business is employees sharing data via the internet, dragging files and confidential information from our computer drives into Dropbox or into Webmail, et cetera. We have other controls and tools to stop that. But Endpoint Protector is used exclusively to stop USB media.If we didn't have Endpoint Protector in place, they could plug in a USB drive, copy a file onto the USB drive, and then take that onto their personal computer or share it externally, whether that be with the press or the public, etc. This tool stops that from happening. It means employees are unable to share files and exfiltrate data via that channel.

We have other controls to stop other channels. One of the biggest concerns for us as a business is employees sharing data via the internet, dragging files and confidential information from our computer drives into Dropbox or into Webmail, et cetera. We have other controls and tools to stop that. But Endpoint Protector is used exclusively to stop USB media.

I have been using Endpoint Protector for 18 months.

The stability is very comfortable. We have no qualms or concerns. There have not been any incidents or issues with it not working, or any problems that I'm aware of. Any kind of such problems would be raised to my attention and discussion review, and there haven't been any concerns raised by users or with our IT service desk. There has been no concern there.

Scalability is about the policies. We could deploy it simply to larger groups of people as and when required. There's a procedure where we deploy using an RMM tool. It's easy to deploy.

At present, we don't have plans to increase usage. We have a number of different controls and requirements, and we have specialist tools for each of the different requirements. We're also trying to move towards a Microsoft stack where possible because we have so many different tools in use. Microsoft doesn't do device control. 

I have never personally been involved with technical support. There was joint deployment with our MSP. There have been no problems, so I think it's fairly positive.

We were previously using Ivanti.

The setup was quite straightforward and didn't cause any issues. But I wasn't involved. Our IT system team deployed it around 18 months ago. I was quite new to the business at the time. It went relatively smoothly, there were no hiccups, and there were no deployment problems.

It took under a few weeks to implement. It was not a couple of weeks of solid work. We deployed it slowly within a UAT testing environment and only on a small number of laptops. Once we were comfortable that the config was working as expected, then we deployed our tool to other users. We deployed the end client to all endpoints using an RMM tool we use from SolarWinds.

We have a managed service provider who we use to support some of our IT needs. They were the ones who recommended the products and they would have been the ones who actually implemented the product and do much of the actual deployment with our IT service desk.

The implementation required around 2-3 staff members. It was one person from the MSP and two people in-house who would have worked on that project to deploy it. It was a normal project team for the deployment of that size.

Day-to-day maintenance only requires one or two employees. We don't have somebody looking at it daily, but our service desk will review it, update it, and amend things within the tool as and when required. It really runs by itself, it's not a huge amount of maintenance, which is a good thing.

ROI is very hard to quantify but Endpoint Protector is ultimately priceless. If device control wasn't in place, any single data breach that could occur as a consequence of a USB device being able to transfer data externally could result, for us as a business, in considerable loss, and considerable fines. There are massive fines for data breaches in the UK.

Data breaches could have a very significant reputational impact on our business. It's very difficult to quantify, but we haven't had any of these breaches. If we didn't have Endpoint Protector in place, we would be at a higher risk.

The pricing is very fair. No concerns. We don't have massive budgets, we're quite a small company, but we don't have small budgets either. I think it's quite competitive.

I don't believe there are additional costs in addition to standard licensing. 

We reviewed Ivanti Device Control, which is the previous tool we were using, and we compared it with Endpoint Protector's product set. Then we compared the prices and compared the features, and decided to go with Endpoint Protector over the previous supplier.

We have a third-party that automatically encrypts confidential data transferred to USB storage devices. That's not a use case for us with Endpoint Protector.

We exclusively use Windows. We do have instances of Linux, but from an endpoint point of view, it is exclusively Windows. 

As a business, we're never going to move into a Mac OS environment, so the fact that it supports Windows, Mac, and Linux wouldn't be one of our prerequisites. We looked at Endpoint Protector to make sure it supported Windows but the fact that it supports all platforms wasn't that important to us. Obviously, if it didn't work with Windows we wouldn't have used it, but from that point of view, it's not important for us now.

We also don't use it to search for keywords that are important to our business. We have a third-party tool we've had in use for several years that classifies all our data and ensures that we have visibility of where data is and what type of data is at risk.

I would rate Endpoint Protector an eight out of ten. I'm by no means an expert on the tool, however, it does appear to offer quite a large range of different functions within the toolset. Sometimes, it should try to focus on one thing rather than multiple things. Endpoint Protector does device control very well, which is why we use that particular function.

Our primary use case is for data loss prevention. 

The most valuable features are:

• The OS platforms that it is capable of running on.
• The ability to detect source code as well as file types for the policies. 
• The SIM integration. 

These were identified previously as key features in a DLP program and Endpoint Protector had them. They are a business need.

The granularity of the policies that you can create is pretty good. I would give it an eight out of ten. It's very granular, but there are still more possibilities for granularity. There's still work to be done, but it's very granular.

Endpoint Protector offers the ability to lock down a wide variety of USB devices. That is a key feature. It was one of the main features we were looking for.

We plan to use the EasyLock USB-enforced encryption app to automatically encrypt confidential data transferred to USB storage devices. 

I would rate the versatility regarding the exit points an eight out of ten. The exit points are pretty diverse, cover the majority, and are constantly updated, but there are still some application types and categories that we would like to see in there. They are responsive to our feature requests and are quick to add applications to the list and categories to the list of exit points.

The cross-platform management is good. I understand that there are some features that won't exist because of the technical limitations that are presented based on Linux, for instance, versus Windows. There are some things you can't do in Linux that you can do in Windows. EasyLock, for example, is a technical limitation that they have because of the nature of Linux. There's work to be done there but I understand why there are technical limitations.

We use the clipboard granularity feature to monitor copying and pasting to specific exit points in a limited capacity. It wasn't one of the main use cases, so it hasn't affected our DLP implementation too much.

The search for keywords is very important in our security operations because one of the key use cases we had was for the ability to search keyword-based on an internal database of keywords that have been submitted by other project managers within the company that's around intellectual property. The ability to search on keywords was part of that.

Endpoint Protector provides a single platform to support Windows, macOS, and Linux devices. There is some improvement that is needed there. The policies must be created per OS and in a large deployment with the diverse OS platform use case which can get a little bit unwieldy. Room for improvement there could be a way to clone a policy and map the old policy to the new policy on a new OS. Right now, you would just have to open it up on two different screens and map it manually, but a way to clone it to a new OS and map the differences or map the similarities would be room for improvement.

I would rate the role-based access features for administrators a six out of ten. There's work to be done on the granularity of roles that can be assigned to an administrator but there is role-based administrator access present. That's why it's not a zero rating.

We would probably make better use of tier1 support texts and give them granular abilities within the user interface to help us administer it and then move it to a different tier 2 tech support if the role-based permissions were more granular.

A feature request would be treating a deny list as an exit point. We'd also like to have the ability to tie an allow list to a group rather than a policy so that the allow list follows the group of users or computers. Whatever policy they hit they're always allowed certain URLs. That would be a nice feature for management purposes. 

It could also use some minor UI improvements. There's a little bit of inconsistency in the UI that takes some getting used to.

We've been using Endpoint Protector for about four months in production. Before that, it was about six months in the POC environment.

Due to the diversity of our use cases, we found a few stability issues during the POC and pilot phases. We weren't too concerned about it. Endpoint Protector has given us wonderful attention and they've considered us a partner in developing our product. The stability issues were resolved quickly.

Scalability needs some work. There's probably a better way to manage policies. We only have 30 policies or so, but if we were to get into the hundreds of policies, it would be the way it's presented in the UI. That part could use a rework. 

In terms of scalability as far as deployment, there are no issues there. Policy creation is the only issue. Determining the effective rights of a machine needs some work. Needing to run a report every time is a bit cumbersome. An easier way to see the effective rights of a user or computer without having to run a report would be nice. Those are all scalability issues because as you get more complicated and deploy it out to more users and computers, those types of issues start to manifest.

It requires more administrators than we have due to the complexity that we have. We have two dedicated administrators and we're rolling it out pretty slowly. It depends on how fast they want to roll out. A team of five or so would, with one architect and two tier 1 and two tier 2-type support folks would probably do it for a deployment our size. The admins are IT security engineers.  

I would give their support a ten out of ten. I have nothing but good things to say about them. They have good availabliity. 

We supplemented our current DLP. The current DLP we had was within the Google Suite and Proofpoint through email. So we supplemented our DLP program with an endpoint solution, which was Endpoint Protector.

The initial setup was straightforward. It was just an installer that we sent out through our configuration management software and once machines got sucked into that, we were able to group people through active directory sync.

We're a big company with over 20,000 endpoints. There were about eight months of POC and pilot. After the POC and pilot, we were able to deploy it to 20,000 endpoints in about two months.

CoSoSys helped with questions we had, but it was all the internal workforce that did the deployment.

We also looked at Forcepoint, ObserveIT, Digital Guardian, SecureCircle, and CoSoSys. ObserveIT hit a lot of our requirements, except it couldn't do any blocking. All it could do was monitoring and warning. Their approach was a bit different. I don't think SecureCircle was a mature enough product for what we needed.

My advice would be to do an extensive test on the DPI and detour features to make sure they're compatible with your environment before deploying to the whole company. Do an extensive pilot with all features turned on, and then evaluate the results based on performance decreased and accessibility restrictions or limitations. Deep packet inspection tends to break some of the internal capabilities.

I would rate Endpoint Protector an eight out of ten. 

The main reason that we brought this solution into our ecosystem is that we work with a number of financial institutions who value all of their data, whether it's marketing material, all the way up to client data, which we don't really handle as data.

Because we do promotional stuff, we need to adhere to what our clients are asking us to do to lock down the ability to lose data. We use Endpoint Protector to limit our employees' access to removing data off of company computers.

We are running the current version of the server, which I updated recently. We are running different versions of the client on different machines because we're currently doing some testing to see whether our software has conflicts with theirs.

We are a smaller company and at this point, we don't have a whole lot of concern about losing data. So, in that sense, using Endpoint Protector has not really improved anything. On the other hand, we've had a couple of hiccups where some employees have had issues with operations like attaching documents. In this regard, it's given us a slight burden, although we've been able to resolve such issues fairly quickly.

As time goes on and we become more familiar with the system, this will change. For example, as we run tests, and as we've done certain implementations, we've discovered some bugs here and there in the process and we have resolved them.

Endpoint Protector absolutely gives us the ability to lock down a wide variety of USB devices and it is extremely important to us. We have multimedia machines, and these machines are used for editing video. We use external devices as caching services or caching drives, and giving certain people access to external devices like that is a risk. However, locking down other flash drives gives us flexibility. It means that our media department can use their external devices while other people cannot.

The versatility in terms of exit points and making sure that important data doesn't leave our organization is something that I find extremely useful. It's been able to do exactly what we needed to have done so that we're adhering to our clients' standards. It's extremely valuable because it's blocking everything that we need to have blocked.

Because we're a smaller company, most of us don't typically use flash drives or other external devices to move data. However, what we really enjoy is the ability to lock down different applications, such as a cloud storage app or even its related website. This means that nobody can move data from a machine to a cloud-based system, such as Dropbox, for example. We can lock down the Dropbox app and the website so it prevents people from moving data via the cloud to it. Another example is blocking FTP transfers and all of those types of situations.

This product has the ability to search for keywords to help make sure that specific data doesn't leave the organization, although we have not used it. At some point in the future, we may get to that level of granularity. However, from a business standpoint, this is not a significant concern at this point. This implementation is primarily in place so that we are satisfying our clients that specifically ask for this type of protection for their data. Thus far, this level of granularity has not been brought up.

The most valuable features are the ability to prevent access to external devices, and also site blocking. We have two of the main features that we enjoy the most, which are device control and then Content-Aware Protection (CAP).

In terms of policy creation, you can get extremely granular. The ability to have multiple departments and having the ability to assign computers on top of specific users is fantastic. We don't utilize that section, but if we had a centralized computer that multiple people would use, I really enjoy that I could specify which user gets which policy. It's the same computer, but it's based on a user-level granularity. It's not just global rights on the computer. I really do enjoy that, although I don't use it.

We are not currently using the functionality for the automatic encryption of confidential data transferred to USB storage devices, although it is on our to-do list. This is something that we need to test in the future.

Endpoint Protection provides a single platform to support Windows, macOS, and Linux, and so far, managing DLP in our hybrid environment has been seamless. I don't see much of a difference between the operating systems in terms of what can and cannot be done. This is extremely important to us because we are 95% Mac-based, with just a few Windows machines. Our Linux machines have just been retired since we've gone 100% remote.

With respect to the feature parity between Windows and Mac, they're identical. On the user side, I don't see a difference between Windows and Mac because what you can do on the client-side is quite limited. On the backend, or server-side, they're identical.

This product provides zero-day protection for macOS, although I'm currently dealing with an issue on the most recent rollout of the Endpoint client that doesn't seem to be fully functioning. It is absolutely important to me, but it has not been successful. This is something that they are definitely working on resolving. I've had multiple IT consults where we've brought on a couple of developers to try and figure out what's going on with the Mac's most recent update versus their most recent update.

We have been using Endpoint Protector for between five and seven months.

Stability has been fantastic and I have had zero downtime. Once we solved the hardware issues, rolling out updates to the server has been flawless. So far, I've rolled out two updates and there has never been a software issue. The only problem was at the very beginning, and it was a hardware issue.

We have not had to scale the system. The software needed a decent machine to run it, and that was it. There are three people who have access to the server-side. There is me on the technical side, one is the office admin, and the other is the VP of marketing.

We don't have plans to increase our usage at this time, but rather it will maintain where we're at right now.

Technical support has been fantastic. They get back to me quickly. They're willing to schedule video conferencing so that I can share my screen. They're willing to bring on a level-two support technician to look at the details. They're able to supply everything for me support-wise.

We did not have another DLP in place prior to this one.

The initial setup was complex. I was not informed at the beginning of purchasing the software that they needed a cloud-based solution. They either hosted it at a cost or you needed your own dedicated server for it. I had been under the impression that they hosted the platform to then roll out updates, but didn't realize that it was a cost to it all.

It took more than a month to deploy because I had to source all of the equipment. They have a very good "how-to" document on deploying the software but once we got to that point, it was not the software causing a problem but rather, it was a hardware compatibility issue.

It was just me in charge of deployment, so you don't need a dedicated implementation team, although I did ask the technical support team questions. During this, their support was amazing.

There are other people in the organization who use the product but technical-wise, it is just me.

As of right now, we don't see ROI explicitly. However, the value is that when our clients ask if we're doing specific things, we can answer and make sure that we're in compliance with what they want us to do, which is keeping their data safe.

For what it's doing, the cost is somewhat high for us, but it's the cost of doing business with the clients that we have. Equivalent-wise, for what it can do, it's fairly close to the other competitors.

During the evaluation, we looked at Jamf and others. Jamf was a more Mac-based deployment software but they offered some of the things that we were looking for. There was a solution by Cisco but the price tag was so high that we didn't look at it further. We also looked at a Microsoft product, but they didn't offer anything on the Mac side.

What sets this system apart from everyone else is that it's one solution for multiple operating systems. Some products do really well in Mac environments but don't really have a good solution for Windows, and vice versa. This is one that covers the three operating systems that we need.

The biggest lesson that we have learned from using this product is that it can keep our computers and data from leaving the organization. That's extremely valuable for us, and I can see how it would be so for other companies, as well.

My advice for anybody who is looking into implementing this product is to make sure that they understand the requirements for the environment ahead of time. Our biggest hurdle at the very beginning was that piece of hardware. You have to make sure that you have either the cost evaluated within the budget to have Endpoint host that solution, or alternatively, that extra piece of hardware to house an internal machine.

In summary, this is a good product and I don't have any suggestions for improvement. We're new to the software and it is quite detailed. I've been able to do everything that I need to have done.

I would rate this solution an eight out of ten.

We use it for detecting the traversal of data through endpoints. We keep a multi-tier isolated environment, so we have inner and outer cordons of access control. And over VPN, users could potentially be one of the exfil points, at least the privileged ones with access. Being able to identify when information enters the system and leaves, based on a number of complex criteria, because we work with medical information from all over the world, is the purpose of it in our organization.

The solution is all on-premises. We're a healthcare organization, and that's actually one of the reasons we use it. We can't have a lot of our security functionality in the cloud.

We operate a Waterfall scene mechanism. We trickle up data from a bunch of different endpoint and network solutions to a central event and processing correlation mechanism. We're able to detect when somebody accesses data internally and correlate that to a DLP event when a file lands on their system. It actually provides a data point within our global view. It's an ongoing operation.

We also use it to monitor all clipboard activity. When a detection occurs, we can generally identify it pretty quickly, but someone would have to be copying some pretty specific data to match the policies we've created. When it occurs, we know. Generally, it's also in the line of business. We have healthcare analysts here, and that's what they do all day.

There are effectively two areas of DLP to look at from a technical perspective. One is how it performs the pickup of information traversing the system and the other is how the policy engine, which analyzes the data, works. On the first aspect, CoSoSys is probably best of breed for macOS because they're reasonably well-integrated into the operating system. They're looking at the file system operations level, not at the execution level. Whereas things like Forcepoint are looking at the applications being run and they try to apply policy to that. The pickup paradigm is a lot better than their competitors.

The search for keywords, in our security operations, is critical and we use Endpoint Protector for that. We're a HITRUST-certified organization, and one of the things we need to do is be aware of the movement of personally identifiable health information. Since we work multi-nationally, we have to be able to identify PHI from across different countries and their different medical coding standards.

Another valuable feature is the  Content Aware Protection. We use the device thing to some degree, but it's the Content Aware Protection that's critical for us. That's the aspect of it which is DLP. The content protection engine is what detects the data when it's traversing, and the rest of it is other ways to lock down the system from being able to move data in and out. But the detection aspect of it, that's the really key part for us, because we have to be able to record that, even if it's completely legitimate.

It's quite easy to manage DLP in a hybrid environment because you have the centralized server that receives telemetry from all of the agents. And because that's what's forwarding the telemetry on to subsequent log ingests, you get a single data stream across all of the agents. We also have host intrusion detection, which is backing a lot of this stuff for us. We have full command execution logging in every machine. Every command that is run is recorded. We can cross-correlate very tightly between the DLP and what's being done on the machine itself. That way, we know execution and data movement.

We use the role-based access features, for the teams that administer it, to some degree, because we have an auditing agency that reviews our policy compliance. It's satisfactory. We don't have complex requirements for it. We've got a couple of internal admins with equal privileges and then we have an auditor role. It seems to work fine.

The policy engine could use a bit of work. They're definitely going in the right direction. We've been working with them over the last few weeks to try and optimize that. But it's reasonably clear that they're just not putting as much effort into the policy engine as into other things, like content discovery.

It's somewhat lacking in terms of the granularity of the policies that you can create. Because this is a Mac environment, you have slim pickings. You have really good detection mechanisms, like Code42, but a lot of those players don't operate at the medium business size. So, in terms of the market segment, CoSoSys is really the only player that will be able to still effectively pick up on it, so they're the only game in town on policy. They don't really have much competition in this segment.

I've been using CoSoSys Endpoint Protector for two years.

The stability has been quite good. They did have one shaky patch cycle in the last two years, but compared to the ginormous mess in this industry right now, they're definitely doing better than most.

The scalability works for our use case. It's actually quite resource-light for what it's doing. Being an OSSEC author, I'm writing a C application that does a lot of the same stuff for processing of live-streaming, textual telemetry. They did a lot of optimization work to make this efficient. It's an expensive operation, inherently. What they're doing is really CPU-costly. Most of the time they don't match on anything, and the worst thing that an expression engine can do is not find anything.

We are constantly growing. We're probably going to be growing by 30 or 40 percent again this year. We're going to have to bump up our license counts.

Our experience with their technical support has been better over the last year. Initially it was a little bit shaky, but they've definitely gotten better. There's always room to improve, but on a scale of one to 10, they're probably at a six or seven. They're doing better than the rest of the industry, like Cisco for example, which is a one out of 10.

We did not have a previous solution.

We just used a Zen appliance, so it was incredibly straightforward; it was effectively drop-in.

Configurations are ongoing. As we get new data in, we do continue to configure. And, obviously, with updates and new features and features being removed, changes are made all the time, but the initial deployment took about half a day.

Our implementation strategy was to understand our data first. We do a lot of in-house software development, so we understand regular expressions, pattern matching, and mechanisms like that; what's expensive and what's cheap. We defined what was identifiable in our data, figured out an identification strategy and policy mechanism first, and then went to implement it across the board. We knew that the number of endpoints we had was relatively small.

In terms of the staff employed in the deployment, we're probably not typical. We hire top-tier talent. Everybody here starts out well into the six-figure range. So it takes one of us to deploy this. We're not your average shop.

In terms of maintenance, there's the occasional update. There is almost no downtime. The hypervisor is more unstable than the VM itself.

We have about 100 people using Endpoint Protector across our organization. It's literally everybody in the organization, including me and the CTO and the CEO. We're all beholden to this. There are no exceptions.

You get ROI in the first year. Endpoint Protector is a facet of our visibility into the environment, but it's a daily-use facet. It's like the passenger-side mirror on your car; you use it all the time. You could probably live without it, but you use it all the time. It's a necessity and it's a useful one. It's one that I endorse within our company to relicense every year.

Pricing is quite reasonable. For smaller organizations, it lets them get into the product domain, whereas a lot of vendors won't even talk to them. Endpoint Protector is just about at that sweet spot of being serious enough that you have to budget for it, but at the same time, affordable enough that the value is well worth it.

I work across the industry. I've used just about every solution. In the Mac space, CoSoSys is probably the market leader, because of the level of detail that they've put into the platform is very significant. They really did bother to optimize it and to make it run efficiently. A lot of these tools are afterthoughts on Mac and, if they do run at all, they destroy the machine. When you have a bunch of engineers trying to code, they notice.

This solution is right up there with Forcepoint Data Loss Prevention and Digital Guardian, but Code42 Next-Gen DLP is probably the closest comparable thing. But that is not a data loss prevention tool, it's just an identification and tagging tool. But it has a very similar semantic of pickup and analysis. 

Endpoint Protector is in the same market space as Forcepoint, in terms of pricing, but it's an apples-to-oranges comparison. Forcepoint is pretty well-known for having a good policy engine, but their detection and pickup mechanism, especially on the Mac platform, is just not practical. I can walk around it in my sleep. Again, we hire highly-talented engineers who can do the same thing, so if one of them decided to go rogue on us, Forcepoint just wouldn't help.

In my private practice, I work with a lot of other firms, including some design firms that are Mac-based and, as they start to ramp up their security—because they're now becoming vectors of attack into their own customer bases—this product is definitely something that's on the radar.

The ability to lock down a wide variety of USB devices is a secondary thing for us, because we do central policy management through another solution, so we have devices locked down through other policy engine mechanisms. But it is very convenient how CoSoSys has implemented it. That ability is definitely on the list for us but not at the top because for us, for policy regulatory compliance, we have to be able to tell when the data is moving in and out. That's the big thing we look at.

In terms of Endpoint Protector's support for Windows, macOS, and Linux, in our case, Linux is a non-starter. We operate big-data clusters. DLP just doesn't work in that context. The information is broken out into multiple pieces and spread all over the environment and traverses between the nodes as part of computation. DLP can't work in that kind of technique. As far as the Windows mechanisms go, we currently don't have Windows workstations or any Windows assets. I'm a red-teamer by trade, one of the people who gets paid to break into places, and Windows has a shared authentication model, meaning that if I compromise one of your servers or workstations, I can basically move unfettered throughout your network. Our environment is a mix, a heterogeneous environment, so that attackers would have to adapt to every different point they want to compromise.

Overall, Endpoint Protector really provides what you expect from it. There are no huge surprises one way or another. If you do your research, it's exactly what they say in their advertisements. They are not promising things they can't deliver. It does its job well.

We use it to block USB and any external devices for read-write. We only allow people to read an external device, not to write to an external device, unless we approve it. Our main reason is that we have 30 percent of our workforce working globally around the world. In addition, a lot of them do not have WiFi access, as they are working in the desert. We needed an application that allows us to unblock or block something by giving a code and could be sent by WhatsApp or SMS.

It's hosted on the cloud, then deployed to workstations. This is a portal from the vendor that we have access to where we can see and remove the agent.

Once you put a policy in place, you can see if somebody is trying to access something, even if it's not allowed and will not go through. In IT, we need to make sure that we think first before applying the rules that we do want. We have different groups levels of access. Once you have done this correctly, then it definitely stops any misuse of data and leaks. However it is not the software. It's you, as the administrator, who has to make sure that the profiles are set up correctly.

Sometimes, we have engineers who are in the desert taking pictures with an external camera, etc., and they need to send these pictures ASAP to our online portal for reporting. These devices are normally blocked. We can then very quickly (within seconds) open up this device for a certain time to be fully accessible. Then, we do not have to worry about it because the policy will kick in after the period that we have given. This helps us a lot when people are onsite doing reviews of company sites and they need to send a report. It also gives us control of what people can access at that moment, because most of our field engineers have zero access to any external devices. They are only given the device once we decide, "Yes, they need it and for how long."

We are a pretty small company. We only have an IT engineer who administers everything along with myself. We don't have a big IT team; it's only one engineer and me. The access is great because we can do it from home. We don't need to be inside the company since all of it is cloud-based.

There are a lot of features, but the main feature is that I can use a device serial number to unlock any particular machine or for all machines. If I have a phone, like a Samsung phone, I can whitelist that specific phone for full access wherever it is plugged into any of our devices. This is the same with a USB, because most USBs come in bulk and have the same serial number. I can then whitelist that particular USB to be read-write with full access.

When you want to uninstall and reinstall, there are a lot of issues. You have to do a lot of workarounds to reinstall Endpoint Protector. This is a major issue that we have constantly because we still have old systems with XP. While there are only very few, we need to run them because there are machines attached that only run on XP. When we need to uninstall and reinstall on XP or Windows 10, we have serious issues left in the Registry Editor everywhere. There is a lot of manual interference to get the reinstallation to work. For the uninstallation of Endpoint Protector, they need to work on this so it doesn't leave any leftovers behind.

We have been using it now for a little bit over one year.

The stability is very good. I had no downtime nor any other issues. It doesn't require a lot of maintenance from our side. We don't need to go, and make sure, "Is it running or is it not running?"

Even if people are not in our LAN, it's still protected. We have tested it in various locations.

If you ever need more devices, it would be very easy to get more licenses within 24 to 48 hours.

We are using 162 licenses.

If we have an issue, their support is great. They come back normally within the same day with either a solution or remote session to assist us.

We have rarely used Endpoint Protector support directly. We have very good connections with the reseller, who has a technical support that normally responds within the same day, or at least by the next day.

We had GFI EndPointSecurity, which was a good solution. I can't say anything bad about it. However, GFI stopped developing the product. For our use of just blocking external devices, it was very good, but Endpoint Protector is quite a bit better and has many more features. Even if GFI would come back, I would not go back to them because I'm extremely happy with the functionality of Endpoint Protector.

The initial setup is very straightforward.

Because our current system is from a different vendor, we needed to have minimum downtime. When we switched the old one off, we needed to switch the new one on instantly. The groundwork was done before the old one was switched off, then deployed over the weekend. Things worked absolutely fine. We had very few systems which didn't take the implementation. They were mostly those which were not online, but the rest of them worked smoothly.

Our reseller assisted us in our initial deployment by setting up some basic rules and helping us to understand how it works. From there, we took over. They were extremely good in their technical knowledge of the system.

It all depends on how the reseller supports this installation. We had a very good overview by our reseller and support during the installation. I found the installation very straightforward and quick, but that all depends on your reseller and how good they are trained. This process was very technical for us. The reseller assisted us in switching over within two days from the old system to the new one.

It is a software where I always want it installed, then up and running. The only time that you need to look at or interfere with it is when new agents are coming in, so you can deploy them. 

It has a fair price. They just changed recently from perpetual licensing. When I bought it, I bought it on perpetual license, then they changed the whole company policy to go to subscription. It was a bit of a shock to us because we haven't upgraded it that many times. However, after speaking to CoSoSys directly, they gave us a very good renewal price.

There are many vendors out there who do protection access of external devices. However, I haven't found any vendors, other than Endpoint Protector, who let you enable or disable the device without being on a WiFi, Internet, or just by giving a code. That was our main thing because maybe 30 percent of our workforce are around the world or somewhere in the desert with extremely weak Internet connections. This solution is a very good option where you can just send them an SMS code. Then, the code that we create depends on what we say, for example, "Should they have access for the whole day or 10 minutes?" Afterwards, I don't have to double check if the system is blocked. 

Have a look at a good demo. You will see the benefits of the system. We only use it for device blocking, but there are so many other features. It depends what you want out of Endpoint Protector. An overall demo of its capabilities will let you see that it is worthwhile.

There is an application out there that does multiple things in one go. We looked only at blocking off other devices, but we are rethinking that. Next year, we will be looking to buy usage of all the other features. It would be nice to have one application that does multiple things in one go, which normally other people would use several applications and software subscriptions to do the same thing. 

There are so many policies that we have not even had time to explore all of them.

We don't use the EasyLock USB Enforced Encryption app to automatically encrypt confidential data transferred to USB storage devices. Instead, we have a secure online storage called FileShare, similar to Dropbox, but only for us. This way, people don't save it on their USB and actually have to send it directly. They can only then send it from the camera into their desktop or laptop. Then, from the laptop, they send it directly into our cloud system.

I would rate this solution as a nine out of 10.

The product's most valuable feature is its ability to support Linux operating systems.

CoSoSys Endpoint Protector's network-level DLP and integration with mail servers need improvement.

We have been using CoSoSys Endpoint Protector for five or six years.

We never encountered any bugs or issues. The product has been running for many years since we set it up with the server.

We have 10 CoSoSys Endpoint Protector users in our organization.

The technical support services are good.

CoSoSys Endpoint Protector can be deployed on the cloud and on-premises. It takes 15 minutes to set up the server and get it running. The process is easy.

The product is worth the investment.

The product has average pricing.

The product supports Linux systems and multiple source codes. I advise others to go for it. I rate it a nine out of ten.

We are using it for data loss prevention, basically managing all our employees throughout the region. Our servers are installed in our HQ in Singapore. We use device control, content-aware management or content-aware protection, and enforce encryption.

We like that content-aware and device controls can easily be managed. They're not complicated. You don't need to be a rocket scientist to understand them.

As for overall experience, Endpoint Protector is very user-friendly.

Because it is only an Endpoint Protector at this point in time, it does not have a network DLP component. There's only an endpoint DLP component. In the future, it would be good if a network DLP component could be embedded and extended to have network DLP capabilities.

We've been using Endpoint Protector for more than seven years.

It is stable.

It is very easily scalable.

In my company alone, we have close to 100 users. They are scattered across three countries in the region. We manage for our end partners who have about 15,000 users.

I am satisfied with Endpoint Protector support services. It is exceptional.

It is super easy to set up. It takes less than one hour to set up the whole system, and you can actually get the users to get on the basic policies and tools in under a couple of hours as well.

The pricing is very competitive and is cheaper in comparison to that of other solutions. It makes it an easy decision to go with EPP for the data loss prevention infrastructure.

In terms of the ease of deployment, the ease of management, and the ease of actually getting the basis of Endpoint Protector to move on, EPP is one of the easiest. I have seen more difficult ones, including those with setups that can take days and weeks.

In terms of the infrastructure needed here, EPP only requires one VM to run the whole infrastructure, unlike McAfee or Symantec that require a database server with an operating system. You will need a file server and an operating server, which will make the infrastructure itself too expensive. With EPP, you will need just one VM server, and you can start your data loss prevention just like that.

End users need to understand what data loss prevention is; otherwise, they will select the wrong solution. It will become too difficult, and they won't know what to do with it. It's best to start off with the baselines of Endpoint Protector and then move up to more complex situations with network DLP-based options.

I would rate this solution at nine on a scale from one to ten.