What is our primary use case?
I create real-life scenarios with products and work with products such as Trend Micro, CrowdStrike, SentinelOne, Palo Alto, etc. Trend Micro is not my focus item or brand. My focus is more on CrowdStrike, but I am using Trend Micro in my lab environments to check the real-life situation. I am not okay with what vendors share on their websites, so I give my customers and partners real-life scenarios.
How has it helped my organization?
I offer Trend Micro Apex One to our customers just because they want a secondary signature-based solution.
Apex One did not work as per my expectations. I am doing zero-day attacks by myself, and for fileless attacks, it does not work at all.
With the current architecture, Apex One does not have advanced protection capabilities that adapt to protect against unknown and stealthy new threats. It might have these capabilities in the future if they change the architecture. For instance, McAfee merged with FireEye and created a new brand Trellix. They changed the overall architecture. If Trend Micro considers shifting its architecture, it can get this kind of protection.
Apex One is okay for detecting ransomware with runtime machine-learning capabilities. It has some signature-based protection against ransomware, but it may miss the ransomware, which has been a huge threat at least for the last seven or eight years. It is the foundation of zero-day protection, and that is why I am looking for a more capable solution besides Trend Micro.
Apex One integrates with other security products. As part of this integration, when a threat is detected in the network sandbox, it deploys rapid updates to endpoints, which has huge importance because if you can respond to events in a short time, you get the least damage from attacks. It is of huge importance.
Apex One provides us with virtual patching to protect against vulnerabilities even before a patch is available for the source of the issue, but it is a problem in itself because it consumes too many resources on an endpoint. It is a good feature, but it is a problematic feature because it consumes lots of the system resources. If you use signature-less architecture, you do not have to deal with virtual patching because all attack types are already addressed with some framework, such as the MITRE ATT&CK framework. You do not have to deal with virtual patching at all.
There has been no reduction in viruses and malware since moving to Apex One because my customers are using it as a secondary solution. They have primary products, and there are not many things left for Apex One. My customers are using it as a secondary solution just because of their habits of using signature-based. Some of my customers could not understand the concept of signature-less protection. Antiviruses have been there for 40 years or so, and their habits are a little bit hard to change. That is the reason why I am offering this product.
What is most valuable?
I offer this solution only if a customer is looking for a signature-based protection solution. Its database is better than most of the endpoint protection solutions.
What needs improvement?
It is weak in terms of intelligence. By implementing Trend Micro Apex One, I wanted to see real-life scenarios. I deployed it on 50 clients to check if I could do lateral moments and zero-day exploits. I wanted to check how the zero-day protection works with Trend Micro. It fails with most of them because it is signature-based. They are not looking at the MITRE ATT&CK framework, so with zero-day attacks, it mostly fails. Instead of signature-based, Trend Micro may want to change the architecture to use more behavior analysis. Behavior analysis is included with Trend Micro, but it is not a complete set, so it needs enhancement.
Apex One does not provide a single console for cross-layer detection, threat hunting, and investigation. Managing it is a little bit hard. You have to use different consoles for Apex One, Deep Security, and Trend Micro endpoint protection, so managing it is a little bit tricky.
In terms of the learning curve, Apex One is easy for me, but regular users may have some issues. The management of Trend Micro products is a little bit tricky. Apex One does not include every protection in itself, so you have to use endpoint protection, and you have to use Deep Security. If three of them come together, at some point, it will be competitive with next-generation antiviruses or EPPs such as SentinelOne, Microsoft, CrowdStrike, etc.
Its implementation takes too much time. With CrowdStrike, I do not have to restart any operating system, but with Trend Micro, I have to.
Its administration is also a little bit tricky. It is easier when you have background knowledge.
For how long have I used the solution?
I have been using this product for a year.
What do I think about the stability of the solution?
Its stability is quite good. I cannot complain about the stability.
It sometimes also depends on luck. The product can sometimes conflict with other products, but to this day, I never encountered any issue like that.
What do I think about the scalability of the solution?
It is a little bit hard to scale as compared to CrowdStrike. I am using on-prem solutions most of the time. With on-prem solutions, it is a little bit hard to maintain, deploy, or scale a product, but cloud products are easier to scale.
I have a centralized customer, and I also have customers who have distributed locations all over Turkey, so I have both types of customers.
How are customer service and support?
It takes a little bit of time, and it can be improved. Sometimes, I get a response in two days, and at other times, I get a response in two hours. It depends. More consistency would be great, but I have already gotten used to this kind of issue, so I cannot complain at all. I would rate them a seven out of ten.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
I am using other server protections and intelligence products. I still have CrowdStrike in my portfolio. I have clients for that, and I am okay with CrowdStrike.
How was the initial setup?
Its deployment takes time. If I have to deploy it in a huge company with over 10,000 clients, it takes a little bit of time. If I am using CrowdStrike, it would take only two or three days, whereas Trend Micro takes more time. I have not measured the exact time difference, but it takes more time compared to other solutions or the next-gen antiviruses. It also depends on the environment because organizational units are not available all the time.
I deployed it on the cloud and on-premises. It depends on the end-user scenarios and topology. In Turkey, customers mostly prefer on-prem solutions, but this is changing day by day. Customers in Turkey tend to have their information on-premises. If a customer wants an on-prem solution, then I offer them the Trend Micro product or Trellix product. It also depends on their budget.
Its deployment is not too complex in my experience, but from the customer perspective, it is a little bit tricky. It takes a little bit of time. They have to have a little bit of background knowledge.
The implementation strategy varies. Sometimes, I use third-party solutions, and sometimes, I am just pushing from the central management console. It depends on the customer's topology.
In terms of maintenance, it does require maintenance. It depends on the company budget because some of my customers have a few locations in Turkey, and sometimes, they have only one IT specialist. They send that one person everywhere in Turkey or to multiple locations. If they have more than one IT guy and if they are also distributed, they do not have to send those guys to other places. It depends on the customer's budget.
What about the implementation team?
If I deploy the product, then one person is enough, but if I have to leave it to my customers, they need two or three people. They are usually IT specialists, but they are not so knowledgeable.
What was our ROI?
It takes time, but it is better than some of the other products such as Symantec. Symantec takes more time compared to Trend Micro.
What's my experience with pricing, setup cost, and licensing?
It is okay. Compared to Sophos, it is a little bit expensive, but it is a good product and it is better than Sophos, for instance. It is equivalent to Trellix.
Its cost depends on the country. I am in Turkey, and Trend Micro is not so affordable in Turkey. SMB companies are looking for cheaper products. In Turkey, enterprise customers tend to use Trend Micro, and if they have more money, then they use next-generation antivirus or EPP products such as SentinelOne, CrowdStrike, or Microsoft E5 package.
Which other solutions did I evaluate?
I evaluate most of the popular brands such as Trellix, Sophos, and Kaspersky.
What other advice do I have?
Trend Micro Apex One has some good benefits, and CrowdStrike also has some benefits. I would recommend Apex One depending on the scenario. I have to check it with my customer first. I have to identify their basic needs and what they want to do. Sometimes, it just matches the requirements, and sometimes, it does not, so it depends.
If you are looking for the productivity of employees, go for a signatureless solution.
For an SMB, I would rate it an eight out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner