Splunk Enterprise Security Reviews

My main use cases for Splunk Enterprise Security are log management and enterprise security. Those are the key.

Splunk Enterprise Security has helped improve my organization's business resilience. We load much of our data and information that we use. It's really helping us in our log management solution, and also for forensics and alert triaging purposes. Forensics is one of the big pieces, along with incident management, IRP, and data management. It's fulfilling all those gaps and helping us mature our security operations.

The features of Splunk Enterprise Security that I enjoy the most include reporting, dashboards, and RBA. These features have benefited my organization since the dashboards and reports help us review security alerts and events in a timely manner. The RBA is what we are currently working on to develop and have some early detection on security alerts and notifications.

Currently, I am using disparate security solutions that integrate or import data into Splunk Enterprise Security. This integration supports my security operations by providing some visibility into security. Yet we have many basic issues where we need to fix the log sources, integration, and quality of the content that's going into Splunk Enterprise Security.

I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security quite basic. We don't have any sophisticated process. We have contractors and MSSP who are timely filling those gaps, going through the rule review process, going through regular security testing, and prioritizing what is more important as an organization.

Though we have not completely explored the product functionality, Splunk Enterprise Security itself has many features. This morning I was reviewing all the AI capabilities, such as version 8.2 which has included incident triaging and process. That's probably a very good feature. Our organization has very limited resources, so we would want to expand some of those automation and AI capabilities to fill those gaps.

I have been using Splunk Enterprise Security for two years.

I would assess the stability and reliability of Splunk Enterprise Security as generally good, with very few downtime, crashes, and performance issues. I've been with the organization for a little over a year. I have seen one or two occasions where the enterprise resources crashed. I haven't really seen any significant issues.

Splunk Enterprise Security works efficiently with scaling growing needs since the distributed architecture is very well planned and easily scalable. All you need is to spin up a few additional resources and you can build your collectors, forwarders, and indexers. It's quite easy. At the same time, it comes with its own complexities since it's an on-premises solution. 

Overall, it performs well. I haven't seen any outages or resource challenges while using it.

I would evaluate customer service and technical support as very responsible. Anytime that we have issues or challenges, I could see they were helping us behind the scenes and going through all these improvements. They were excellent.

Positive

In previous organizations, I have been well-versed with many other SIM tools. QRadar is one prominent tool I used. The McAfee Nitro, which isn't available anymore, was another. RSA NetWitness, RSA enVision, ArcSight were among the many tools I've used. In modern SIM tools, I am more familiar with Sentinel and Google Chronicle. I would say Splunk Enterprise Security has more capabilities, and maturity-wise and roadmap-wise, this product has become much more mature than the other two products I could compare.

I was not present for the deployment.

I have definitely seen a return on investment with Splunk Enterprise Security.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection relate to the RBA, which is something that we were struggling with. We are working with the SIM and our reseller to streamline that process. That's something that's not easy for every organization. We are going through the same turbulence.

My organization does not completely utilize risk-based alerting in Splunk Enterprise Security as it's not fully mature. It is supporting our SOC in a limited way. We still have a long way to go. The product is not completely mature. We are a unique organization, so it requires additional resources to get that work done.

My organization is in the process of expanding our security use cases. It's a multi-year model where we are strategizing and exploring all our security needs. I would say we are still in the early phase. Although we have the product in place, it was not yet mature due to some resource issues.

My advice to other organizations considering Splunk Enterprise Security is that it's a good product. It's definitely helpful. If somebody is looking for security and log management, investigations, incident, and IRP, then they can look into this product and explore it. It's one of the market-leading products. It definitely stays up to the mark. 

On a scale of one to ten, I rate this solution an eight.

My main use cases for Splunk Enterprise Security are detection, attacks, analysis, and investigation.

The features of Splunk Enterprise Security that I find most valuable are the correlation and correlation data. These features have benefited my organization through the model of investigation, correlating with correlation alerts, and integration with other tools, which is a good point.

In my experience with other tools in previous jobs, the time is reduced by around 70% compared to the previous tool.

My impressions of Splunk's ability to predict, identify, and solve problems in real time are positive. There are points to consider when enriching the data with these kinds of inputs. It is a good opportunity for companies trying to start with this environment, though it might be a challenge for those who have been using it for a long time since it requires identifying the context and use cases.

Splunk Enterprise Security could be improved in the dashboards that provide KPIs about environmental behavior.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include correlation when we have inputs or tools about security, such as Forescout or CrowdStrike, which presents a good challenge.

My organization uses risk-based alerting in Splunk Enterprise Security, yet not optimally, which presents another challenge. My security ops team takes longer to remediate security incidents with Splunk Enterprise Security compared to our previous solution. It is very complex.

I have been using Splunk Enterprise Security for four years.

I would assess the stability and reliability of Splunk Enterprise Security as good. However, it depends on the Splunk architects or the best practices provided by the admins and power users. They should avoid creating bad practices in correlation alerts, queries, and dashboard reports, but overall, it is a good, stable product.

Scaling is smooth in certain functionalities but can be more difficult when involving different areas. When under the same scope, it progresses smoothly.

Customer service and technical support are good. They can sometimes be expensive, but the cost is appropriate given the professionalism in providing reports, diagnostics, and analyses.

We may need more follow-up for remediation, which is sometimes noted as expensive, however, it is acceptable as part of the partnership agreement.

Positive

Prior to adopting Splunk Enterprise Security, I was using another solution, SOAR, to address similar needs. It accomplishes that along with the implementation process, and I need to consider the different policies within the company regarding privileges, roles, and dependencies across different areas.

The process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security is part of the onboarding process. We sometimes need to review it based on our needs or use cases we need to apply, and we need to correlate the data with different inputs, sometimes directly from security or IT data.

I have seen a return on investment with Splunk Enterprise Security. If the account executives for Splunk do not explain the implementation process clearly, we may face challenges, as our company's first question is usually about seeing immediate results for the amount spent. We often need to follow a process and achieve a certain maturity level, which requires a prompt response from our management.

Regarding my experience with pricing, setup cost, and licensing, it is good. I saw around 2016 when the license was one option, however, now it is good, although sometimes it depends on the business of the company since we do not always have the budget to increase, decrease, or try to change.

The factors that led me to change to Enterprise include the new improvements. This is the correct path, and next year we will need to review the challenges concerning AI governance, which I plan to use in Splunk Enterprise Security.

Splunk Enterprise Security has helped improve our organization's business resilience. It helps us respond to various needs in our different regions or plants, aiming to obtain critical information to reduce the impact of hacks in our plants.

I would absolutely recommend Splunk Enterprise Security. Every time I have the opportunity to promote or explain how it works, people say it is amazing, and I agree. It is an integrated solution that stands out against competitors, and though it may be expensive, it delivers good quality.

I would rate Splunk Enterprise Security overall a nine on a scale of one to ten, considering the current improvements.

My primary use cases for Splunk Enterprise Security are correlation searches and the workflow that enables our SOC analysts to work through an entire incident from start to finish.

An example of how these features benefited my organization is that the mean time to detect compromised accounts from the time that we're able to detect that account and then launch some automation to actually disable the account and work with the end user to fix the issue has gone from taking a couple of days to literally taking two to three minutes.

The features of Splunk Enterprise Security that I value most are the correlation searches, being able to bring multiple things together and to have one result to look at in a single pane of glass. 

I'm not sure how Splunk Enterprise Security can be improved, but I'm sure it will be improved; the features that they add, I constantly never even think of. One of the big things is making it a little easier for the intro analyst to be able to understand and work through without a lot of dedicated training.

I've been using Splunk Enterprise Security for probably about the last two years.

I would assess the stability and reliability of Splunk Enterprise Security as having not experienced any issues that would be in the realm of Splunk's.

Splunk Enterprise Security has scaled very well with the growing needs of my organization. We started out with a smaller deployment and now we're ingesting multiple terabytes of data a day and being able to scale as much hardware as we can throw at it.

I evaluate customer service and technical support as excellent. Anytime that we've had an issue, we've been able to engage with Splunk support, and we also have agreements with some other folks that help us out, some private organizations that we leverage.

Positive

Prior to adopting Splunk Enterprise Security, we were just using Splunk Enterprise and formulating our own searches and finding stuff ourselves.

I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be challenging at times. It takes some of our more advanced engineers to be able to work through a lot of those processes.

The challenges with deploying something like Splunk Enterprise Security are getting the data in, knowing what data you need, and trying just to find it and normalize it. It's such a vast area and we're such a distributed organization, trying to get all that information in one place has been a challenge. 

The process to expand usage has been smooth.

I have absolutely seen a return on investment with Splunk Enterprise Security. I can say that just because of the time that the analysts would take, and I can say that we have saved man-hours, which in the end is money. On average, my SecOps team takes probably at least a quarter of the time, if not more, to remediate security incidents with Splunk Enterprise Security compared to our previous solution.

Now that we can show that we're able to reduce that mean time to detection, we're getting a lot more buy in. So a lot more people are interested in that, and they're excited about that. So that really helps out.

I'm not familiar with the setup costs.

The advice I would give to other organizations considering Splunk Enterprise Security is to work with professional services. It's a large undertaking for your SOC, so work with professional services that have seen different examples and situations and lean on their expertise to help you develop the right solution. 

I would rate Splunk Enterprise Security overall on a scale of one to ten as probably about an eight; there's still some work to be done, however, it's the best that we can do right now.

My main use cases for Splunk Enterprise Security are mainly building SIEM for our customers, implementing it at customer sites, and using it for our own developments.

I really appreciate the all-integrated SIEM feature of Splunk Enterprise Security, which serves as a one-stop shop to get all security tasks done. It actually helps us by not having to develop all the use cases ourselves, providing an integrated product that has everything in one place. 

It has integrated threat intelligence and an integrated use case library, so it requires only one installation and configuration. This specifically benefits my organization by reducing the implementation time at our customers, getting faster time to value with a better turnover rate for our customers.

We are using disparate security solutions that integrate or import data into Splunk Enterprise Security. We are implementing all data sources that are somehow possible, so there's no limitation to that.

The process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security is pretty straightforward. Developing our own solutions is pretty good, and even though we are using the Security Essentials and the Enterprise Security content libraries, that's a very good way to progress.

Splunk Enterprise Security can be improved with more ease of configuration. It is pretty straightforward to get it started, however, to really check if my data is all available and how to activate the right use case and the right correlations is still sometimes a hassle. A guided mode to help us understand how to get started, improve data quality, and prepare data more efficiently for use cases would be highly beneficial for us.

I have been using Splunk Enterprise Security for the best of seven or eight years now.

I have experienced downtime, however, it's very little. The downtimes are mostly hardware issues such as network downtimes, which is nothing that Splunk has a say in. If you deploy a multi-site architecture and make it fail-safe, downtime isn't an issue.

I have expanded usage a lot. This expansion has improved the process as scalability and scaling volume-wise and usage-wise with Splunk Enterprise Security was never a problem for me nor our customers.

I evaluate customer service and technical support from Splunk as perfect. I'm very confident in what the partner SEs and the Splunk Professional Service team can do. If I need to reach out to them, I get instant replies, and the Splunk community itself is very helpful as well. On a scale of one to ten, I would give it a ten.

Positive

Prior to adopting Splunk Enterprise Security, I was using another solution to address similar needs. We were using Splunk Core with our own developments and helped several customers migrate away from products QRadar and FortiSIEM, however, our main go-to platform is still Splunk Enterprise Security.

My experience deploying Splunk Enterprise Security is all in all pretty straightforward. If you are used to how to set it up, it's very good.

I have seen ROI with Splunk Enterprise Security. 

One example is a situation with a customer where we started installing it and actually found active breaches that were short of being used and leveraged for maybe blackmailing or compromising the customer. We couldn't calculate what would have been the cost if they had actually gotten compromised; however, they were in the process, so every investment was returned immediately. It was definitely significant.

My experience with pricing, setup costs, and licensing is a bit difficult. There are competitors that are more cost-effective. That said, for the feature set that Splunk offers, it's okay. It is on a solid foundation, so there could be more rebates and opportunities for us as a partner to offer it to our customers. Still, it's competitive.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are primarily related to customer pricing concerns. I find it's okay for a premium product on top of the Splunk base, however, the pricing is one thing, and I don't know if it's the same for all regions. We specifically sometimes have difficulties getting a smaller license than the Splunk Core one if we don't want to ingest all the data into Splunk Enterprise Security.

My advice to other organizations considering Splunk Enterprise Security is to try it if you don't know about it yet.

On a scale of one to ten, I would rate Splunk Enterprise Security overall as an eight. Sometimes it is a bit hard to get the searches and the data done, but all in all, it's a great product.

My main use cases for Splunk Enterprise Security are being able to take our noisy level detections and using features such as risk-based learning that are built into Splunk Enterprise Security, and bubble them up into one larger alert, which makes it easier for us to go after and find adversaries throughout our network.

Splunk Enterprise Security has reduced our meantime to detect. Especially when we switched to RBA. We've seen our noticeable RBA mean to detect a decrease. I don't have the exact number. That said, it definitely has that potential and it's definitely worked in our implementation.

I really love the identity and asset lookups, being able to pull that identity data in and be able to enrich our alerts that are going through. Finding next-level managers, locations, and being able to build out a bigger story for our analyst as they receive these alerts is a huge functionality that I personally love the most.

The identity lookups have definitely benefited our company because it takes that guesswork of looking in other utilities and brings that live data of who our employees are, what their job titles are, and be able to build out the story of what's going on. If we have someone who works as a data analyst accessing sales data, sales information, that's a huge red flag for us so we're able to make an intelligent decision and respond faster by having that data available.

Splunk RBA or risk-based alerting definitely made our lives a lot easier. We went from hundreds of alerts having to be triaged a day, that generally could be false positives or just noise, and bubble them into one overall alert that we can look at on a per-day basis and see what's rising to the top and respond faster, have a higher rate of true positives and find evil a lot quicker.

Splunk Enterprise Security helps us look at high-fidelity alerts a lot quicker because we're using RBA. It's taking the sum of those small alerts that would be generally noise, combining them into a larger picture, boiling them up to the top and letting our analysts then focus on those, which generally have been the true positives of those malicious actors who are impersonating users or accessing through our network and be able to respond a lot quicker.

The way Splunk Enterprise Security could improve is by pulling in and mapping my DHCP data and tracking users' IP addresses as it changes throughout sessions, and being able to keep track of who is actually assigned to what IP address more natively.

I have used Splunk Enterprise Security for about 14 years.

Splunk Enterprise Security is so easy as it scales with us as we grow. As we throw more data sets at it, we can increase our indexers in order to accommodate that, and we know that the data is going to be searchable, ready and available in an instant.

When I talk about Splunk customer support, I'm talking about world-class support. 

They are so easy to get a hold of, they're so knowledgeable and they don't accept 'I don't know.' They'll say 'Hold on, I will go get the next person who does know this' and you'll get the answer very fast. 

That, plus the community members who are writing answers to your questions, there's really not a time when you are going to say 'I don't know,' or you don't walk away with the answer on that day.

Positive

Prior to using Splunk Enterprise Security, I had previously used other SIMs that weren't nearly as advanced or up to the task to be able to input that data in our needs at the time. Splunk really answers the question of the do everything platform. 

Deploying Splunk Enterprise Security is actually a really easy task. The onboarding steps that they provide throughout the GUI have become super simple. 

The documentation through Lantern has been invaluable and can really answer any questions that we had. It really made the setup go from what seemed like it was going to be a tedious job to something that was really easily done in an afternoon. And then it gave us steps going forward on what to do in order to get the full value of it.

For me, the biggest return on investment when using Splunk Enterprise Security is being able to feed any data I need, knowing that data's going to be readily accessible, usable multiple times throughout my organization and I can even bring in non-security individuals to be able to access their data since our back controls that are in Splunk Enterprise Security.

The advice I would give to other organizations who are considering Splunk Enterprise Security is to just do it. It's honestly one of the best investments you'll make. 

You'll start noticing the return on investment really quick. You'll start to notice answers that you did not know you had to questions that didn't exist. You'll start to notice your meantime to detect goes down as you start implementing RBA and embracing the Splunk base itself. 

On a scale of one to ten, I would rate Splunk Enterprise Security a solid ten. It answers questions you didn't even know you had, and as you drill through the dashboards and go through the different features that are available, you start to realize all this available information that's there that you didn't even know your data had those answers to. It really starts bringing that value within your first 30 days of using it.

My main use cases for Splunk Enterprise Security are detection and investigation.

Splunk Enterprise Security has helped improve my organization's business resilience.

I never liked Splunk Enterprise Security much until the new version, and now that they've ramped up RBA and made changes in version eight, I prefer it much better. 

Splunk Enterprise Security streamlines the creation of what they call notables, which takes a lot of the effort that we would have to put into creating our own solution off the table and does it for us.

We haven't made the newspaper yet, so Splunk Enterprise Security is doing its job. That integration supports my security operations very efficiently, or we wouldn't use it. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security effective. That's my bread and butter.

My organization uses risk-based alerting in Splunk Enterprise Security. The SOC is still in the development and testing phase for RBA, so they're not seeing any risk-based alerting yet. Within the next week or two, they should start seeing it.

I have no idea how long on average my SecOps team takes to remediate security incidents with Splunk Enterprise Security. I am not using any new threat detection features in Splunk Enterprise Security since we write our own correlation searches from scratch.

Regarding Splunk's ability to predict, identify, and solve problems in real-time: prediction capabilities are not present at all, identification is pretty good, and resolution is effective. It's a good tool. We've got really amazing people behind it, using it, and although there are only four of us behind it, we've got really amazing people using it.

Splunk Enterprise Security is not exactly user-friendly. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are assets and identities, which are a pain in the neck, and the documentation for RBA is horrible. 

They've got it now to where it pretty much deploys itself as long as you know what you're doing, yet it does some really weird and impractical things such as putting file extensions on lookup tables that shouldn't be there, which you have to go in and clean up. It's got some quirks that aren't documented, or not all documented.

I have been working in this field for ten years and using Splunk Enterprise Security for eight.

I have not experienced any downtime, crashes, or performance issues based on Splunk Enterprise Security.

We've expanded our license dramatically since the merger, and Splunk Enterprise Security handles it just fine. It's not really affected by scale; the infrastructure it sits on is affected by scale, however, the software itself isn't.

Regarding customer service and technical support, their support is the worst I have ever run into in any industry. On the front line, they put people who don't know what they're doing, refuse to escalate, and are not helpful. 

When we go to Splunk support, we've already done everything and are really good at what we do, however they make us do it over again or won't help us, and that's enough.

Neutral

Way back in the day, we used QRadar, however, as soon as we converted to Splunk, we bought Splunk Enterprise Security with it.

They've got it now to where it's pretty much as long as you know what you're doing, it deploys itself. However, it does some really weird things, like putting file extensions on lookup tables that shouldn't be there, that we have to go in and clean up. 

It has some quirks that aren't documented or aren't fully documented. That's Splunk. They're not good with documentation. If you conduct thorough testing in a development or testing environment, you'll find 99% of what doesn't work and be prepared for it, ensuring that it does. 

We have seen return on investment with Splunk Enterprise Security, and we're getting our money's worth. It streamlines the creation of what they call notables, which eliminates a significant amount of the effort that would be required to create our own solution, allowing us to achieve a good ROI.

I considered the change initially due to a better product, as it was an evaluation of a better product for a better price back then.

My advice to other organizations considering Splunk Enterprise Security is that unless you're really big, don't spend the money. On a scale of one to ten, I rate this solution an eight.

Splunk Enterprise Security by our SOC organization to aggregate and triage alerts used to identify IOCs.

Splunk Enterprise Security has a strong feature set that helps identify, and solve problems in real time.

The benefits of those features for my organization, more specifically, are that it prevents us from being hacked. 

The features of Splunk Enterprise Security that I prefer most are the correlation engine and the common information model, basically the aggregation of data. It's usually designed to take all the data, normalize it into a flat schema, so you can then see patterns more easily. That's the significant aspect.

The problem with Splunk Enterprise Security generally, is that organizations strugle to fit into their cultures and workflow. For better outcomes, companies have to fit their internal processes to how the tool has been designed. At times, this can be too complex to run, has high overhead requiring constant tuning. Newer versions e.g. 8.3, hint at greater ease of use.

I have been working in my current field for around 12 years.

Reliability is all about the care and feeding of it. I have not experienced downtime, crashes, or performance issues with Splunk Enterprise Security.

I would evaluate customer service and technical support as an eight on a scale of one to ten. Splunk Cloud's support is not bad. However, there's a gray area between what they do and what they don't do. What they don't do is the blind spot for most enterprise customers; they don't realize they have to handle certain responsibilities. There's a shared responsibility.

Positive

Setup can be complex. Splunk has specific guidelines. Do your home work and read their SVA architecture and capacity manuals. 

And always read their release notes.

My experience with pricing, setup costs, and licensing for Splunk Enterprise Security is limited. The unit cost of Splunk Enterprise Security is slightly less than the core product. 

My advice to other organizations considering using Splunk Enterprise Security is to do your homework. Attend industry peer sessions and learn from other organizations. Splunk's partner program, RBA Community offer compelling resources for new customers.

I would rate it an eight out of ten.

My main use case for this solution is to detect threats.

The features I appreciate the most in Splunk Enterprise Security are the scheduled alerts and the search function. 

The other SIEMs were more menu-driven, similar to Yahoo in the past. With Yahoo, you would navigate to find restaurants in San Francisco. Splunk Enterprise Security operates more with a 'tell us what you want and we'll find it' approach versus directing users to look in specific directions. It is very hunt-friendly. 

We are able to prevent breaches with Splunk Enterprise Security. 

Integration supports our security operations since our analysts operate within Splunk.

Additional features could be included in the next release. The specific functionality I'm looking for relates to alerts and false positives. If we want to filter alerts, currently it's a very manual process. We identify IP addresses and usernames and must manually filter them. It would be beneficial if we could simply click a checkbox to filter and automatically add it to the search, then save it immediately, instead of the time-consuming process of cutting and pasting, which isn't efficient. 

The most significant challenge I face when using Splunk Enterprise Security for advanced threat detection is maintaining balance in search parameters. Creating searches that aren't too narrow to miss threats, yet not too wide to generate excessive false positives is crucial. When determining recurring false positives for filtering, junior analysts who aren't coders must edit code-like elements. This introduces unnecessary risk when they could simply check a box to filter.

I have been working in my current field for 33 years.

I would assess the stability and reliability of Splunk Enterprise Security to be generally acceptable. Some performance issues occur with historical, long-distance searches spanning three to six months, however, these are very rare searches that we perform.

Splunk Enterprise Security scales effectively with the growing needs of my organization because we've never had an issue with it. I don't know if the technology team expands usage significantly, but we've used Splunk Enterprise Security for a long time. The expansion process is so smooth it's barely even a process.

I would evaluate customer service and technical support as frustrating at times. It was similar to experiences with other companies, where they would explain why issues occurred instead of solving them. It took time to reach the right individual who would solve the problem, however, these instances were infrequent.

Neutral

Prior to adopting Splunk Enterprise Security, I worked at a previous job where they had a different SIEM that was inadequate, so we implemented Splunk Enterprise Security. At my next job, they already had it installed. If they didn't have it, I would have brought it in during the first month. I cannot name the previous solution as it was approximately 15 years ago and was a second-tier provider, not QRadar or other well-known solutions from that time.

My SecOps team has never had a previous solution to compare how long it takes to remediate security incidents in Splunk Enterprise Security. When I arrived, they had a developer license and decided to use it going forward for all security purposes. My team has no experience with other solutions.

I have not seen a return on investment with Splunk Enterprise Security. It's similar to having a car. It's a necessity. I don't have to prove to the business executives that it provides return on investment. It's a necessary function and a must-have.

I am aware of the pricing, setup cost, and licensing for it. I don't handle pricing because the primary user is the cyber team. The owners of all technology are the technology team. I inform them we need this solution, and they handle acquisition and management.

We use multiple best-of-breed products to provide data to Splunk Enterprise Security for correlation and malicious activity determination. 

My organization does not use risk-based alerting in Splunk Enterprise Security. We use third parties for threat detection features. 

Splunk Enterprise Security's impact on business resilience is unclear as we use it exclusively for cyber purposes. 

My advice to other organizations considering Splunk Enterprise Security is to use it. 

On a scale of one to ten, I rate this solution a nine.