TrendAI Vision One Reviews

My company is Kyndryl, and we work for a UK-based financial institution. That client, the financial institution, has TrendAI Vision One. By using TrendAI Vision One, we are monitoring and doing day-to-day tasks.

In this project, it is related to XDR, but there are many modules. Currently, they are using only HIDS and HIPS. There are many other modules available, but all the modules are based on the license, so they are using only a few of them.

Compared to my previous experience where I worked on some other EDR tools, TrendAI Vision One has many interesting features. There is one module called Cyber Risk Exposure. Inside Cyber Risk Exposure, there are multiple features such as risk overview, exposure overview, and attack overview. In these different overviews, we can easily monitor the overall cyber risk score at an organization level, identify where the loopholes are, and determine where we need to improve security. It monitors the device level, internet-facing assets, accounts, application level, and the cloud. It will show the overall risk based on the different components of the organization. This is a very cool feature for me.

Basically, each endpoint device has an agent called the TrendAI agent, similar to a CrowdStrike agent. The agent is monitoring two things: system events and security events. Based on the events, they are pulling the data at the console for the security team. We monitor if any unusual things happen, and then we have to react. The agent installed on endpoint devices is helping us monitor and do the work.

In a previous company, I used CrowdStrike. Compared to CrowdStrike, TrendAI Vision One is more advanced, I think. I have not used CrowdStrike for more than one year, and maybe they have updated some more features, but I do not remember. However, it has a very good feature, as I mentioned, Cyber Risk Exposure.

Actually, in Cyber Risk, if I want to see the device level and how many devices have some vulnerability, if I click the device, it will show the count. For example, it is showing that two, three, or four devices are detected with this kind of vulnerability. If the devices have Apache Log4j vulnerability or OGNL, then based on the operating system, if the device has Linux, I have to reach the platform team and say "Okay, this system has this kind of vulnerability, and you have to patch the thing" or update the software. From here, I cannot update anything or upgrade the agents. There is some dependency, you could say.

For deployment, I think it is easy and does not require much effort. I have not done the deployment myself, but for some point in time, for a few of the servers, we have done it, and it is easy and does not require much.

For this, it depends on two or three factors. First, we have to confirm why this alert got triggered and what is the IOC. For example, if it is some private IP, then I have to reach out to the different teams. In my case, I have to reach the vulnerability management team because they have Nessus and Qualys tools, which are vulnerability scanner tools. What they mostly do is they try to scan the particular server and devices, targeting the server. When the IP, let us say the Nessus IP, leads to a server, TrendAI Vision One tries to understand "Okay, I think someone is trying to recon this particular server. This is not a usual thing," so they generate the alert. I have to go through each and every alert, and based on whether the IP is private, I have to reach out to the VM team and other teams and try to confirm whether the IP is genuine or from somewhere else. After that, I have to fine-tune inside TrendAI Vision One, and then they will automatically reduce the false positives.

In my case, I can say that earlier we received many alerts related to recon alerts. If I closed and whitelisted two, three, or five IP addresses, the total has been reduced by approximately 40 percent. Earlier, we received more than 400 or 500 false positive alerts, but nowadays we receive hardly 10 or 15 alerts.

My client is not a small bank. I think it is one of the big banks in the UK, but I do not want to tell you the name. It is very big.

In TrendAI Vision One, there are many interesting features. There is one module called Cyber Risk Exposure. Inside Cyber Risk Exposure, there are multiple features such as risk overview, exposure overview, and attack overview. In these different overviews, we can easily monitor the overall cyber risk score at an organization level, identify where the loopholes are, and determine where we need to improve security. It monitors the device level, internet-facing assets, accounts, application level, and the cloud. It will show the overall risk based on the different components of the organization. This is a very cool feature for me.

They have another feature called Workbench inside the XDR. What Workbench does is that if you receive 100 alerts one day, the Workbench correlates all the alerts and tries to find similar ones. Then it generates one ID. Inside one ID, if 10 alerts are similar, it will consolidate all 10 alerts as one Workbench ID. Inside the Workbench ID, if I investigate and close the Workbench ID, on behalf of that Workbench ID, all 10 alerts will be closed automatically. There is no need to go through each and every alert one by one. This is also a very good feature inside TrendAI Vision One.

In terms of centralized visibility, I can say that it saves much more time. If for one thing I have to go through different tools, obviously I have to invest much more time for a single alert. But here, if one alert triggers, I can correlate with the help of different modules, which is nothing but easy for me.

There is also an inbuilt AI tool inside TrendAI Vision One. Sometimes if I get stuck somewhere during the investigation, I use this AI chatbot, which is known as a companion inside TrendAI Vision One. If I put a use case or ask "Okay, I am here, what do I have to do?" That companion, which is nothing but a chatbot, will go through whatever I put inside the chat, analyze it, and mention some steps. It will say "Okay, from here you can go" and "You can do these things." It is also a very good feature and it makes it easy for me.

As I mentioned, because of that one feature, Workbench ID inside the XDR module, it reduced much more time compared to other tools. But I cannot say a specific number. It is very difficult for me. However, it saves a lot of time. As I mentioned, if 10 alerts are received, in another tool, I have to go through each and every alert one by one. But here, they correlate the alerts based on whatever the IOCs are and why this alert got triggered. Based on the alert, they consolidate the alert. If all 10 alerts have a similar property, they consolidate and generate one ID, a Workbench ID, and they consider it as one. So if I investigate one and close it, all 10 will be closed automatically.

It is very nice and very helpful. It reduces the overall response time. It is very helpful. It is known as a companion, and that one chatbot is known as a companion inside TrendAI Vision One.

In TrendAI Vision One, a few days ago, there was one issue related to resource utilization at some servers. It was not clear whether the reason was the Trend agent or some other security agents such as Sentinel or something else. In this kind of situation, we get stuck. Then we have to reinstall and do all those things.

In Tanium, we have an advantage where even the security team from their end can update the patch. But in TrendAI Vision One, there are no features such as this. We have to depend on the platform team.

They could improve the support case experience because whenever we reach out to the support team, in response, they first put what I think are some ready-made templates, and they just put it as a reply. If I raise a case, they have some ready-made templates. This is my opinion and thought from following some different cases. They can improve here because they just simply reply with whatever they have. Then again, we have to mention more things, and after that, they reply with some genuine points. But initially, they just put some ready-made templates, I think. They can improve here.

I have been using this product for more than a year. In this project, it has been more than a year.

It is stable. I think it rates 9 or 10.

Regarding scalability, if we are talking about it, and if we currently have a thousand servers and increase the count, then we can test the scalability. As of now, I have not gone through it, so it is very hard for me to say much about the scalability.

I do not have that much level of access to other parts due to policy, and they are not using all other modules due to licensing limitations. I cannot say much more about other things because TrendAI Vision One has many modules.

In a previous company, I used CrowdStrike. Compared to CrowdStrike, TrendAI Vision One is more advanced, I think. I have not used CrowdStrike for more than one year, and maybe they have updated some more features.

For deployment, I think it is easy and does not require much effort.

You could say 5+. I started my career as a SOC analyst.

I have not used other products, but there is another product called Tanium, which I learned about. In Tanium, we have an advantage.

I need to note that the overall rating I would give this product is 7. It is not bad, but initially, they put some ready-made templates, which I do not like.

I do not know about other projects because here they segregate the team based on the project. I am working for the UK-based project, and some other people are working for the AU-based project. Different people worked in different countries. I do not have any other idea about other projects or whether they are using TrendAI Vision One or not. I cannot say anything.

Definitely, it requires maintenance. If agents are not compatible with particular devices, we have to reach the support team and take help from there, and then we have to upgrade and update based on the risk and compliance policy.

There are many other modules available, but all the modules are based on the license, and they are using only a few of them.

I am currently dealing with Trend Micro and TrendAI Vision One. I started working on an on-premises option for Trend Micro called the Deep Security Manager in 2014. After changing companies, I continued working on the Deep Security Manager for approximately a year or one and a half years. Later, we moved to Cloud One, and after that transition, we had customers interested in the XDR solution, so we migrated those customers to TrendAI Vision One. Altogether, starting from 2014, I have extensive experience with Trend Micro.

We use TrendAI Vision One platform for consolidated security across hybrid environments. We have onboarded one AWS customer recently and have also onboarded multiple on-premises servers, though we have not onboarded Google Cloud. Our solutions include AWS and on-premises deployments.

I am the point of contact in my company, dealing with the customer and with the Trend Micro seller and partner.

The IPS module is the best module in Trend Micro and helps us address the top security challenges. We have many ways to modify it, including enabling detection only mode or using it after a month or two of monitoring to move to prevent mode. When we come across any CVEs and submit them to Trend Micro, they immediately create an IPS rule, and detection happens within the next moment. IPS is one of the greatest parts of Trend Micro, followed by Anti-Malware and then Web Reputation. These three modules are my favorites in Trend Micro, and they are seamless with very frequent detection. Mostly malicious or suspicious detections occur, and I have rarely seen negative detections with Web Reputation or Anti-Malware.

TrendAI Vision One provides centralized visibility and management across protection layers. TrendAI Vision One is quite simple when compared to CrowdStrike, and Microsoft is simpler, but when we compare it with CrowdStrike, it is much simpler. I do not feel any complexity in that. TrendAI Vision One was a bit new for us, but after working on it for a couple of years and exploring all the options, it seems to provide quite a seamless feature. The navigations are easy and help us understand exactly what we need to do. We have run around the playbook and workflow, which makes it better. When it comes to CrowdStrike, TrendAI Vision One is quite simpler in terms of complexity.

TrendAI Vision One has helped reduce our time to detect and respond to threats. The important aspect is that we can customize the playbook and workflow, which makes our SOC workload easier. TrendAI Vision One has helped consolidate our use of security vendors and reduce silos to an extent. There are some inputs that we have to gather and enforce based on our experience. No product has given us 100% satisfaction so far, but unless we experience it and put in our experience and talk to Trend Micro and make some changes, it will not help.

I do not find TrendAI Vision One difficult because I have been working with Trend Micro since 2014. When it comes to CrowdStrike, it is a bit complicated. They do have documentation, but if we miss a small single point, we might end up not connecting our resources to CrowdStrike. That is not the case with Trend Micro; it is quite simple. I feel more comfortable with Trend Micro rather than CrowdStrike.

TrendAI Vision One has AI built into its platform. It is not only Trend Micro; even when we talk about CrowdStrike, the SALET AI is also awesome. The AI narrows down the time. If I receive an incident, I can ask the AI to give a description or a client-facing email template, which is quite helpful. This has reduced our response time by more than 70%.

Approximately 30 to 40% of false positives have been reduced. This all depends on how long we have been working with TrendAI Vision One. As we gain more experience, we learn what exactly it is. I am actually an intermediate between the TrendAI Vision One console and the SOC team. The SOC team comes to us stating there is a lot of noise around certain alerts and asking what can be done about it. Then we go ahead and do some workflow automation and exclusions. Exclusions are quite simpler when it comes to TrendAI Vision One, and even the workflow automation and playbooks are quite easier. I have deep knowledge of the playbook when it comes to Microsoft, so I know how to build those playbooks within TrendAI Vision One. I would say there is a 30% to 40% reduction of false positives, and we are still working to reduce it further.

When we talk about improvements in TrendAI Vision One, the first thing I consider is to bring the pricing down, considering there are many competitors in the market. The second thing is that once CrowdStrike came into the market, it became the biggest competitor for Trend Micro. The way CrowdStrike exposes themselves or makes themselves public, Trend Micro is not doing. That is one concern where they lag in the market as of now.

Previously, there were some issues navigating between Cloud One and TrendAI Vision One, but now they have migrated completely to TrendAI Vision One and we can use it for everything. We are not even logging into Cloud One anymore. If they remove Cloud One completely and bring all its options into TrendAI Vision One, that would be a great option. They are working on it and I believe the migration should be completed by this year, so we will no longer see Cloud One.

The updates are quite frequent when it comes to Trend Micro. As of now, I know there are six cycles of security updates happening. If they could break down this process, that would be beneficial because we have recently seen that there were some security updates missed. Based on our feedback, we found there are actually six security updates available per day. We have gone ahead and configured the security update scanning. That could also be a point we can discuss with Trend Micro, and the discussion is in place.

An additional feature I would like to see in the future is for the dashboard they present to be made more interactive, more visual, or more attractive. That would be a gaining point for me.

I joined the security field in 2020. I was an endpoint solution engineer since 2014, but I came to the SOC team in 2020, so I have been in this field for six years.

I have no problem with the technical support of TrendAI Vision One. I would rate them an eight, ten being the highest.

We have a customer now who is interested in the Cyber Risk Exposure Management capabilities, and we are exploring around it. We have been using exposure for Microsoft and CrowdStrike, but we have not used it for TrendAI Vision One so far. We have a customer now who is interested and we are preparing a draft for them.

We are both a partner and a reseller of Trend Micro, purchasing and selling licenses. We have also been a partner with CrowdStrike. We are a partner and reseller for both CrowdStrike and Trend Micro.

The pricing of Trend Micro is a bit high, but when we compare it with Microsoft products, the pricing is a bit high. When we compare it with CrowdStrike, it is competitive, both providing a similar kind of solution. When it comes to pricing, both are a bit higher. Considering the security that they provide, it is acceptable to go ahead with that price.

There are two options for purchasing TrendAI products. Some old customers still rely on AWS Marketplace, whereas for new customers, we directly engage with Trend Micro to buy and resell licenses. There are legacy customers who have the license through AWS Marketplace, but any new customer that comes in, we directly have a word with Trend Micro and we purchase and sell the license or we do an MSSP for them.

My overall rating for this review is eight out of ten.

TrendAI Vision One provides a platform where everything is consolidated. I started with the proxy and then moved on to the XDR, which TrendAI Vision One provided. We collaborated with them, had POCs for the customer, and they liked it, going ahead with it. The main scenario was to integrate with the cloud security platform since the customer had a hybrid platform and needed one-point access to view the whole infrastructure in one place rather than having different solutions for each cloud and device.

The best feature of TrendAI Vision One that I like the most is the investigation graph, which was the main point demonstrated during the POC. If an attack happens and data is exfiltrated or an attacker finds a backdoor into the system, I need a graph of it rather than going to third-party sources. TrendAI Vision One XDR provides this graph, which helps visualize and make RCA and incident understanding easier, especially when presenting the findings to management.

TrendAI Vision One has greatly reduced my time to detect and respond to threats. After the implementation, I see how it integrates with the SOC team, and the XDR is so consolidated, making it easier for the SOC team to analyze tickets since it does not export logs from different components. The logs from TrendAI Vision One are easy to understand, which has helped me reduce false positives and determine whether they are true or not without checking each system individually, which made my job much easier.

The ability of TrendAI Vision One to provide centralized visibility and management across various protection layers is the best part for me. Many may not appreciate everything under one roof because it creates confusion, but once you get familiar with the dashboard, it becomes easy to navigate. However, it can create confusion because everything is under one roof, showcasing both pros and cons.

Aside from the investigation graph, I find that sometimes when we collect data, the UI seems a bit laggish and is not that interactive during that process. When we extract logs, it can be a bit slow, but everything else is acceptable.

The UI does lag a bit.

The implementation of TrendAI Vision One was not easy; it is not a one-click process. I prefer it for larger organizations that can allocate team resources because the implementation can be complex. Resource utilization is quite high, and there is a scarcity of resources focused on TrendAI Vision One. The availability of troubleshooting guides is not as high as with some other vendors, creating some difficulties, but it is manageable because their support is good. When I open a ticket, they respond quickly.

I have been using TrendAI Vision One for two years in my previous organization, and right now, I am implementing it as a system integrator at our customer location.

Stability-wise, I feel there are times when it is not a stable solution, but I also had another client where it worked smoothly, and I did not have to revisit it often. However, in hybrid setups, I do face multiple issues, but the on-premises platform works quite well.

TrendAI Vision One is scalable. We have deployed it for the maximum users, around two hundred to two hundred fifty, and it handles that well.

For TrendAI Vision One's technical support, I would rate it around seven point five to eight, so let us give it an eight.

Positive

I have worked with SentinelOne and multiple other solutions, and from a user experience perspective, I find SentinelOne to be more convenient compared to TrendAI Vision One. However, for consolidation, the fact that I can find everything under one roof is a plus for TrendAI Vision One, despite my preference for ease of user experience in other products such as SentinelOne.

The implementation of TrendAI Vision One was not easy; it is not a one-click process. I prefer it for larger organizations that can allocate team resources because the implementation can be complex.

In my organization, there are only four TrendAI Vision One specialists, including me.

I would estimate that overall, I have seen approximately a twenty percent return on investment.

I would not say TrendAI Vision One is cheap; I always recommend it for mid-size to large-sized enterprises, not for SMBs, as I have other solutions suited for them. I have never pitched TrendAI Vision One to SMBs because I believe it fits mid-sized to large-sized businesses better.

I have worked with SentinelOne and multiple other solutions, and from a user experience perspective, I find SentinelOne to be more convenient compared to TrendAI Vision One.

I actually believe that it has reduced false positives by more than fifteen to twenty percent.

The switch to TrendAI Vision One did reduce risks significantly. Deploying XDR created a spiderweb effect, monitoring every endpoint and node, which mitigated many attacks and helped prevent some.

The built-in AI is important, and I am currently working on certifications from TrendAI Vision One to better pitch it to AI development companies to demonstrate its benefits. I need hands-on experience with it before I pitch to those companies.

Overall, from implementation to operations, I would rate it a seven.

I do recommend this product; it depends on the case-to-case scenario. If a customer wants everything in a single platform, I recommend TrendAI Vision One without hesitation. Its good support and lack of major issues influence my decision to pitch it to customers looking for a consolidated platform. My overall review rating for TrendAI Vision One is seven.

TrendAI Vision One is a unified platform and single dashboard where all endpoints, email servers, clouds, and networks are in one place. It provides AI detection and AI-based threat detection. Any abnormality or abnormal behavior of any server or endpoint is caught, and it predicts security in a proactive mode. It correlates across all endpoints, email, network, and cloud to give the full attack story: how the attack happened, what is the location of the attack, and how we can prevent that attack.

I am using TrendAI Vision One on all our servers with three main components: servers, endpoints, and email security. The unified visibility where one dashboard provides access is one of the best features. The AI-based threat detection model is the best feature, and the attack surface visibility where it discovers external assets and shadow IT is the best part.

TrendAI Vision One sensors are basically the data collectors that capture different parts of the IT environment. If there are no sensors, there will be no visibility. Sensors are the eyes and ears of TrendAI Vision One. They are used to collect logs, abnormal behavior, email activity, and network activity. The system correlates everything, detects the attack, and sends alerts to the SOC so we can work effectively. We have endpoint sensors that are installed on laptops and servers.

One of the biggest challenges nowadays is ransomware attacks, which are the most common and damaging threat. Attackers encrypt data and steal it. With the help of TrendAI Vision One, it reduces the data leak risk from our environment. The second main challenge is phishing and social engineering attacks. Technology is growing fast, so phishing and social engineering attacks are more common. The third main challenge is identity and access compromise, where attacks target our active directory, which is the backbone of the industry. If any of the identities are compromised, an attacker can get full access. TrendAI Vision One is helping us prevent that attack. These are the three top challenges that every organization has to face, and TrendAI Vision One is resolving these kinds of issues on a daily basis.

The cyber risk management capability is used in our organization to identify and prioritize cybersecurity risks in a structured way. There are multiple capabilities under that. First, we need to identify the risk and understand what are all the possible risks we have, what are the vulnerabilities, misconfigurations, threats, and asset exposures. The second main thing is asset visibility, which is very important because we should know what type of asset visibility we have. The third main point is risk assessment, which evaluates the impact and likelihood. For example, if something is down and it is of high importance, it will be marked as a high impact. The fourth stage is risk prioritization, which prioritizes the risk and identifies what are the critical assets and what are the high-end critical vulnerabilities. Every risk has its own weightage. Some are critical, some are high, some are low. This helps us to prioritize risk. And then, of course, comes risk mitigation. Once we find the risk, for example, if something is high-end and critical, the last step is to mitigate it. This includes patching vulnerabilities, fixing misconfiguration things, strengthening our hardening controls, and applying security tools to that. And then, we go back to the first step, continuous monitoring. The next day we will start to find new zero-day attacks, new threats, and new external risks.

TrendAI Vision One, which we are using on all our servers, is the most valuable feature. We are using three things: servers, endpoints, and TrendAI Vision One's email security. The unified visibility where one dashboard is one of the best features. The AI-based threat detection model is the best feature, and the attack surface visibility where it discovers external assets and shadow IT is the best part.

My overall experience with TrendAI Vision One is very good. We discuss it every week in our leadership discussions. Overall, this platform is very mature. It is a unified XDR platform that improves the threat visibility part and the correlation part across the enterprise. The best part is it has strong XDR correlation. It has centralized visibility with one dashboard that contains all the information: all our risk posture, all our assets, and all our threats. The AI-driven technology, the AI-driven detection, and the scoring part are very good, as is the broad coverage they provide.

Alert noise and false positives are areas that should be improved. The initial deployment generates too many alerts, so we need better AI filtering and more accurate prioritization. Also, the integration complexity can be an issue. Sometimes, integrating TrendAI Vision One with our SIEM tool or other cloud platforms can be time-consuming. Some improvements should be made there. They need to make easier, plug-and-play integrations and provide better documentation.

One feature is SOAR (Security Orchestration, Automation and Response), which is an automated response engine. Currently, they have partial automation. If there is an auto-containment feature for endpoints, users, and the network, or if there are many pre-built playbooks for ransomware, phishing, and insider threats, it would be beneficial. For example, we just need to one-click and auto-remediation is done. That is the feature I am looking for. This would be used to help us detect, investigate, and respond automatically.

We have been using TrendAI Vision One for the last two years, and we recently renewed it as well.

We purchased TrendAI Vision One for all our servers. The basics are simple. We signed up, logged in, and provided access to our cloud console. Then, the step-by-step onboarding process started where we had an endpoint agent deployment for each machine. We downloaded the agent and installed it on each machine. Then the migration from the existing solution started. For the deployment part, we use one tool named ManageEngine's ITSM tool, from where we can write a script for that agent and have a mass deployment.

Regarding cost and licensing transparency, we are using a credit-based model. We have a certain number of credits that we are using. The pricing is mild. They could make simpler pricing for better usage visibility, but I am okay with the pricing because we are getting good quality. I would not say it is a high price because we are getting a good product.

TrendAI Vision One is a powerful XDR platform. However, it requires proper tuning and proper integration. If we have done proper tuning and proper integration with all our servers, endpoints, and cloud platforms, it will give very good, accurate results.

From false positive to true positive, the percentage is almost 60% to 70%, approximately 65%. However, it needs proper tuning every week. We have to tune the policies every week so that we can get better visibility and accuracy.

Regarding mean time to detect, TrendAI Vision One definitely helps. It reduces the mean time to detect compared to traditional tools. It basically detects threats in real time. Real-time detection means it uses AI analytics, global threat intelligence, and correlation signals across all endpoints. Threats are detected almost immediately once any suspicious or malicious activity is observed. It reduces the time to detect by almost 60%.

TrendAI Vision One is a powerful and mature XDR tool. Of course, every tool has room to improve. But for us right now, it is a good tool. There are a number of tools, and every tool has its own capability and its own visibility. This tool is a very good, powerful tool. My overall rating for this solution is nine out of ten.

I am from a partner firm and I deploy TrendAI Vision One at multiple customers. I implement the solution to multiple customers.

The main use cases which I have heard from customers are that, from the email point of view, email security is the first priority. They are searching for a solution which provides email security, which is able to block the files with an integrated DLP.

One of the best parts of TrendAI Vision One is its email security and the endpoint. Email security it provides at the API level, so it offers both MX Gateway and API, but usually we deploy it using API.

TrendAI Vision One has an investigation team and a support team. Whenever an alert is generated of a virus or malware, we usually have to deal with it ourselves, or the agent handles it. In this case, the agent will give you the logs.

TrendAI Vision One also has an XDR. This XDR helps you collect logs from multiple sources. It will correlate the logs of your databases, your endpoint, your servers, your mail, and using all these data silos, it will give you a report if any anomaly or any malicious file is detected or any virus pattern is detected.

Their support portal is quite good, quite on time, and gives you a detailed analysis. I personally have used it a lot and they are quite helpful.

It uses AI to check the logs, to find the malware or to find any phishing attack. It uses an AI and ML engine for that. There is also another AI agent inside the console. For example, if I want to find a policy or check a user, the AI agent can assist me.

They have recently launched a Zero Trust Secure Access, which is a version of SASE. Using their single agent, which is for endpoint, the same agent you can use for Zero Trust Secure Access. So you do not have to install multiple agents. One single agent can work for multiple things for SASE and for endpoint.

Its deployment is easy and fast. TrendAI Vision One console has all the features, like one single console provides email, email security, endpoint security, server and workload protection, XDR, cyber risk management, all the things in one console. It provides a good overview from a CISO and manager level. Whenever I have a meeting with the management, I show them that. Your cyber risk score is this much, from a comparison point of view.

It has another feature which can detect the unknown processes or malicious processes using its AI technology, which may be forming or in the initial stage of a ransomware attack. It is quite good in capturing that also.

From the functionalities perspective, the agent is quite heavy as it can scan different types of files.

None of my customers have faced any attack. We have detected many attacks using ransomware protection and phishing detection.

Although there is a point of improvement in the endpoint protection.

Email security sometimes may lead to some true positive attachments.

One thing I would say is not a good point is they do not have a specific licensing structure. If I bought licensing for 500 users, they convert the licenses to a credit system.

If I am a mid-level enterprise, it provides everything like an integrated DLP. I do not have to spend more money buying other solutions. One solution is enough to cover my DLP needs, endpoints, XDRs, and email security.

In endpoint also, if I have 500 customers, and if I want to change a policy, I have to make a new policy for them and add them to it and then change the policy. This is a complex process.

Management is a bit complex and it could have been easier.

The positive point is centralized management. If you are a mid-level enterprise looking for a solution for most of your cybersecurity products, TrendAI Vision One is a good centralized platform. You should go for it.

I have been working with TrendAI Vision One for almost one year.

Since TrendAI Vision One is a SaaS-based platform, I have never faced the issue of the platform going down or any issues on the console. It is hosted on the cloud, so it is good. I have never faced that issue.

TrendAI Vision One has an investigation team and a support team. Whenever an alert is generated of a virus or malware, we usually have to deal with it ourselves. But in this case, the agent will give you the logs. They have an investigation team that will give you an EXE to collect the log and EXE to clean your system, a diagnostic tool.

Their support portal is quite good, quite on time, and gives you a detailed analysis. I personally have used it a lot and they are quite helpful.

Positive

I have used other tools such as Check Point. In email security, the number of false positives is less in TrendAI Vision One in comparison to Check Point.

Within a day, you can deploy the whole solution in your whole company, maybe 500 users, 1000, or 2000. Within a day, you can deploy the solution of email security.

The first benefit is the ease of deployment using API. You simply have to link the Outlook or the Google Workspace API and within two minutes it is synced.

For endpoints, you have a script. You can simply run that script in your AD server and you can install multiple agents in a few minutes on most of your machines in the network.

My main use case of TrendAI Vision One is security monitoring and threat detection. On a day-to-day basis, I use it to monitor endpoint and server activity, investigate security alerts, and understand suspicious behavior. I also find the XDR capabilities useful because they correlate events from different security layers, giving the SOC team better context during incident investigation and response.

TrendAI Vision One's XDR capabilities help by correlating endpoint, email, and network events into a single incident view. For example, when a user received a suspicious email and their endpoint subsequently showed unusual activity, we could connect those events instead of investigating them separately. This gave the SOC better context around the timeline, reducing manual investigation and helping us determine the appropriate response more quickly.

TrendAI Vision One has helped improve our overall security visibility and made incident investigations more structured. The centralized view of security events gives the team better context and reduces the need to manually correlate information from different tools. We have also seen improvements in handling repetitive alerts through automation. Overall, it has helped the SOC team handle incidents more effectively and streamline day-to-day security operations.

One area I would like to see improved is the overall user experience and customization options, usually for dashboards and reporting and integrations. Some configurations can also require additional effort when working with a complex enterprise environment. I would also like more flexibility around automation and investigation workflows. Improvement in these areas could make the platform easier to tailor to different SOC teams and operational requirements.

I think the documentation could be more detailed for advanced configuration and integration, particularly for a larger enterprise environment. More practical examples and troubleshooting guides would make implementation easier for security teams. On the support side, faster resolution for complex technical issues would be helpful. As the environment scales, continued improvements in performance, reporting, and integration flexibility would also add value.

I have been using TrendAI Vision One for around six months.

Overall, TrendAI Vision One has been stable in our experience. We have not faced any major reliability issues during normal security monitoring and investigation activities. Performance has generally been consistent, although any enterprise security platform's resource requirements can become more noticeable as the number of protected endpoints and servers increases. Proper sizing and capacity planning are therefore important for maintaining smooth performance at scale.

TrendAI Vision One has scaled well with our environment so far. As we have increased the number of protected endpoints and servers, it has continued to provide centralized monitoring and security visibility without major operational issues. The main consideration is proper capacity planning and infrastructure sizing as the environment grows. Overall, it provides a practical foundation for expanding endpoint and server coverage in a timely manner.

We have had to contact support for configuration and troubleshooting-related questions. Overall, the support experience has been positive, especially when dealing with product-specific technical issues. The support team was helpful in understanding the problem and providing guidance, although the response times can vary depending on the complexity and priority of the issue. More detailed self-service documentation would also make solving common issues faster.

We previously used separate security solutions for endpoint protection and monitoring, which meant analysts had to work across multiple consoles during investigations. We moved toward TrendAI Vision One mainly to consolidate visibility and reduce those silos. Having XDR capabilities and centralized incident context in one platform made it easier to correlate events, investigate threats, and streamline the overall security operational workflows.

Our experience with pricing and licensing has been reasonable overall, although the total cost depends on the number of endpoints, servers, and security capabilities required. The initial setup also requires some planning, particularly when integrating it with an existing enterprise environment. I would recommend clearly mapping the required modules and expecting deployment scale beforehand to avoid unexpected licensing or infrastructure costs.

We have seen a practical return on investment, mainly through analyst time saved rather than direct headcount reduction. Centralized visibility and XDR correlation reduce the time spent collecting and correlating information across different tools. Automation also helps with repetitive investigation and response tasks. Although we cannot calculate an exact monetary saving, the reduction in manual effort and faster incident handling have provided clear operational value.

We have evaluated a few established endpoint and XDR solutions before choosing TrendAI Vision One. The comparison mainly focused on detection capabilities, XDR correlation, endpoint and server coverage, integration with our existing environment, ease of investigation, and overall licensing. TrendAI Vision One stood out because it provided broader centralized visibility and allowed us to bring multiple security capabilities within a single platform.

TrendAI Vision One is useful when you need centralized visibility across a diverse environment. It helps reduce the need to switch between multiple security consoles and gives the team more context during investigations. I also find the automated response and risk visibility capabilities useful for prioritizing incidents and reducing repetitive manual work from the SOC team.

The biggest improvement has been reducing the time spent switching between different security consoles during investigations. With correlated events and a centralized incident view, analysts can understand the timeline and context faster. Automated response and playbooks also help with repetitive tasks. Overall, it has made our investigation process more streamlined and helped the team respond to relevant alerts more efficiently.

The features that stand out most to me are the XDR correlation, centralized incident visibility, and endpoint protection. XDR helps connect activity across endpoints, email, networks, and other security layers, which makes the investigation easier. I also find the workbench useful for getting a consolidated view of incidents, while the automated response and playbook capabilities can help reduce repetitive manual tasks for the SOC team.

One of the main challenges is dealing with phishing, malware, and endpoint compromise while managing increasingly sophisticated attacks and a larger number of security events. TrendAI Vision One helps by providing centralized visibility across endpoints and servers, correlating related security events, and supporting faster investigations. Detection and response capabilities help the SOC prioritize higher-risk incidents and reduce manual investigation effort.

I would rate this review a ten out of ten.

We work for Tenable, AWS, Azure, GCP, and CrowdStrike, and we are also working on Trend Micro, though we are currently in a transition phase with a few Trend Micro products.

We work on TrendAI Vision One as a customer. We are using TrendAI Vision One for overall threat management, including endpoint XDR, Apex Central, and Trend Micro web proxy, which is now ZTNA. Overall, I would say we use it from an overall threat management perspective.

I like that TrendAI Vision One is a single pane of glass, which gives me near real-time security posture information of my environment, and it correlates everything. Since we have most of our items on Trend Micro, it correlates logs and gives me a real security posture of my environment.

TrendAI Vision One provides a single platform that gives me a deep dive of my environment. If I want to know something about any of my servers, I can go to the deepest level and see what software is installed and how it is working. The deep drill capability is something I really appreciate because I can exactly find out what I need. I also really like that it has more than 800 playbooks that are preventive.

Whenever any type of attack or malicious activity occurs, they preventively work and block malicious activity. When I mention playbooks, whenever any threat activity is activated or just starts, they prevent it at the beginning. This definitely prevents and reduces my mean time to detect and mean time to respond.

If something happens that I have not enabled any playbook, then it gives me an email and alert, and I have a SOC monitoring team that helps me respond to this. Overall, it helps a lot in both mean time to detect, mean time to prevent, and response.

It has helped me to reduce silos, as it gives me visibility into what is inside my environment. Sometimes we provide admin access to users to do their jobs, and during that time, they install other software and many other things. TrendAI Vision One also discovers across my cloud because it has integration with cloud environments.

Whenever I have some rules and configurations in place, if something is not discovered by IT and created by someone, it really helps me a lot to reduce the silos.

TrendAI Vision One is still struggling in some areas. There are a few false positives that are not actually false positives at all but have been reported multiple times to the Trend Micro team, and they have not been rectified, which is sometimes irritating.

I would say TrendAI Vision One is expensive as of now because the competitive market in India has some better solutions at a lower cost.

From the technical side, the innovation in TrendAI Vision One is less. When you configure it at the back end, for example, it says that it will run X and Y rules, but sometimes they do not work, and that happens across multiple places in the platform.

The major disadvantages of TrendAI Vision One would be the CREM feature, the price being slightly pricey, and the backend rules sometimes having problems. There is one more thing to mention: support is not good.

AI built into TrendAI Vision One is something that is a fancy feature, but they have not integrated it effectively.

We have been using TrendAI Vision One since 2020, and during this time, it has changed. It has been with platform TrendAI Vision One, and then it became TrendAI.

TrendAI Vision One is stable.

Scaling up and down with TrendAI Vision One is manageable.

Support for TrendAI Vision One does not respond adequately. They respond, but they do not understand, and when they do understand, they do not resolve the issues. The support experience is inadequate.

The installation of TrendAI Vision One is straightforward, and I have never faced any issues.

I would say that in the last four years since I joined this organization in 2021, as TrendAI Vision One has been innovated and matured, there is tremendous time savings, more than 50% saving of time when we conduct security activities.

I would say the risk reduction from switching to TrendAI Vision One is quite good because we have everything integrated here. It is difficult to say in percentage, but the incidents have reduced significantly, achieving a coverage of about 7 to 8 out of 10.

TrendAI Vision One is more expensive than its competitors.

There are a few false positives that are not actually false positives at all but have been reported multiple times to the Trend Micro team, and they have not been rectified. Sometimes these false positives are irritating and cause disruptions in the workflow. We are working with AWS and GCP. I have not purchased any TrendAI Vision One products from the AWS marketplace, as I think they have discontinued one product I purchased from AWS, which was Trend Micro Cloud Conformity. My overall review rating for TrendAI Vision One is 7 out of 10.

As a reseller for the Trend Micro solution, I also consult for the product, as we are a reseller cum consultant. TrendAI Vision One is a platform that supports multiple solutions, including endpoint security solution, identity security solution, email security solution, and network security solution.

In the past few months, I have worked on around twelve to fifteen use cases for Trend Micro's solutions, including endpoint security with web security and zero-trust secure access. I have also provided a cloud security module as a separate use case for a customer, and I have predominantly worked on other use cases such as IPS, TippingPoint, and intrusion prevention systems within the TrendAI Vision One console.

The major advantages of TrendAI Vision One are its good visibility across our infrastructure, providing detailed visibility on emails within TrendAI Vision One Email Security, including how many emails are received by mail servers on a daily, weekly, and hourly basis.

The second advantage is that since TrendAI Vision One is a single platform, it offers surface attack surface monitoring, allowing me to monitor different types of end nodes, such as servers, mailboxes, and users, which enhances incident response and investigation activities.

Cyber Risk Exposure Management (CREM) in TrendAI Vision One is one of the best functionalities, as it helps identify blind spots by discovering resources in multiple environments, such as on-premises data centers and various cloud platforms including Google Cloud Platform and Azure.

Switching to TrendAI Vision One has improved the security posture and endpoint security deployments by around twenty percent compared to the previous vendor.

The ability of TrendAI Vision One to reduce time to detect and respond to threats can be improved. To identify and detect sophisticated attacks effectively, I need a better detection rate and minimal time to respond.

While the major area for improvement in TrendAI Vision One is the time to detect and respond, apart from that, it is actually good, with great visibility and functionalities.

I have not yet examined whether TrendAI Vision One helps to consolidate the use of security vendors and reduce silos, but I believe it may have a partial silos working model as there are certain isolations that happen.

At this stage, we are not utilizing the full potential of AI in TrendAI Vision One, as we have not gathered sufficient feedback on its performance.

I have been working with Trend Micro for the past six to seven years, and the whole company actually evolved from Trend Micro to TrendAI. TrendAI Vision One has evolved in recent months.

Stability and reliability in TrendAI Vision One can be improved, but I would rate it as good, around a seven out of ten. I have faced issues, especially regarding stability, and while improvements have been made, I cannot say it is perfectly stable.

In terms of scalability, TrendAI Vision One is scalable based on license purchases, but it does have some limitations, as it is credit-based licensing to an extent.

I find that customer support from TrendAI has improved, and I would rate it around seven out of ten. Technical support is improving, but there is still potential to be better, particularly in their level of expertise.

TrendAI Vision One differs from Trend Micro Vision One in that key components have been integrated, but more or less, all other functionalities remain very similar.

The installation procedure for TrendAI Vision One is easy, but understanding the console can be quite complex.

In terms of ROI, TrendAI Vision One provides a better return on investment compared to Trend Micro, as it offers multiple solutions that yield more security and a better security posture compared to third-party solutions. I would say the ROI is around fifty to sixty percent better compared to other products.

Regarding the price, setup cost, and licensing, it is quite affordable and the pricing model has improved, making it better than before and not as expensive compared to other brands.

Comparing TrendAI Vision One to competitive vendors including SentinelOne, the detection rate is not that bad, and while there are other vendors with better detection rates, the key selling point of Trend Micro is that it is a platform offering multiple solutions, including third-party integrations, which is unique compared to other vendors.

According to the MITRE framework, the detection rate of TrendAI Vision One is around eighty-four percent.

Regarding false positives, they are common with every other solution, but the generation of false positives heavily depends on the configuration. The purpose of the product is to alert the admin team whenever a suspicious process is triggered, and whether it is generating too much noise is based on how it is configured.

TrendAI Vision One sensors are indeed critical for coverage in our organization's network, but some customers have complained about bandwidth usage; however, I believe it does not consume excessive bandwidth when configured properly.

I would rate TrendAI Vision One around eight to eight point five, possibly even nine, in overall satisfaction.

In my daily work, I administrate or support one client specifically in Colombia, managing an area in service security, and I help this area by supporting email and ensuring Zero Trust Secure Access.

TrendAI Vision One is a very useful tool for unifying the various applications that a company might have.

We use TrendAI Vision One sensors in two deployments, one in emails and the other in specific servers.

The top security challenge in my industry is related to spam or email Business Email Compromise (BEC), and TrendAI Vision One addresses this effectively.

Last month, we processed 2,000 spam emails, and we successfully reduced this number to just two.

TrendAI Vision One has helped consolidate our use of security vendors and reduce silos because we now have a connecting report for Indicators of Compromise (IOC) and can integrate this information into one Security Information and Event Management (SIEM) to send data to a firewall.

TrendAI Vision One has helped us reduce the time to detect and respond to threats; we can find an attack that previously took one week in a maximum of four hours because the console can identify the specific origin of the attack.

You can add a SIEM, create a playbook, and implement automatic responses for different attacks with TrendAI Vision One, which is notably easy when you want to conduct threat hunting. The console is easy to use and very good overall.

Regarding TrendAI Vision One's artificial intelligence capabilities, it provides good governance because it includes metrics related to IST two and ANS, which are beneficial for governance.

The accuracy of TrendAI Vision One is very precise, though it can still change depending on how we configure the console.

This coverage is very critical for our organization's network because the sensor is special; when other products or applications do not provide good results or information, this product or sensor gives us another perspective to detect attacks.

TrendAI Vision One's ability to provide centralized visibility and management across all protection layers is very helpful because I can see how it complements email with one attack, one endpoint, one sensor, and one specific asset in the company.

I use the Cyber Risk Exposure Management (CREM) capabilities and I update this information every month to inform my client and provide them with the score, which allows us to identify vulnerabilities, configurations, and workbench items.

TrendAI Vision One can improve in customization options and provide us with customizable reporting.

I would advise others looking into using TrendAI Vision One to give this console a try. I chose the rating of nine for TrendAI Vision One because it is my main platform to administrate, and I appreciate it very much as I have learned about all the applications in this console, which has been very easy for me.

TrendAI Vision One serves as my use case starting simply with its sensor agent as a basic Endpoint Detection and Response solution. After that, we started using its endpoint protection, and now we are integrated with its NDR solution, which is Network Detection and Response. We are moving forward towards its complete suite.

The best features of TrendAI Vision One that I prefer most are two main ones. One of them is its Attack Surface Discovery, which gives us the overall security posture of our network. The second is its Observed Attack Techniques section, which is mapped on MITRE ATT&CK and gives us an overall view of what is happening in our system and provides us with automatic detections based on the telemetry data.

One area that has room for improvement is the interface of TrendAI Vision One, which is very slow due to its data center being based in America. If the data center were in a nearby location, its response would be very quick. I think just the interface because everything else we can find in TrendAI Vision One such as endpoint protection, D-SIM security, DLP solution, and FIM, so there is nothing left behind.

I have been using TrendAI Vision One for almost two years.

I would rate the stability of TrendAI Vision One as nine because in the last two years, we have never had downtime except for one recent incident when Azure cloud was down, which was from Azure's side, not from Trend Micro. Overall, we have not received any downtime from Trend Micro's end.

TrendAI Vision One is very scalable. We can integrate different solutions with it and perform some type of automation with this solution, so it is very scalable. I would rate it nine.

I would rate the technical support that Trend Micro provides as seven point five. It depends on the functionality we are using. In most cases, the support quickly resolves the issue, and in some cases, they take some time.

Positive

The deployment of TrendAI Vision One is very handy. There are not any complex issues I faced during the deployment, and it is a very quick deployment. The different guides they provide during deployment and for other configurations help us a lot in the overall deployment of the solution. The deployment process took approximately one point five to two months overall. We are working on an enterprise solution, so for each step, we have to do some testing on the configuration and then we do a full deployment. We are still testing its new features and enhancing it, so it is an ongoing process for us.

We are using the sensors of TrendAI Vision One to cover almost seven thousand endpoints. It is covering our enterprise endpoints, and it is very critical to get overall telemetry data from all of the endpoints. It gives us better visibility into what is actually happening on these systems.

The top security challenges I faced in my industry before using TrendAI Vision One were about getting the whole telemetry data, meaning what is actually happening on the system. SIEM solutions only get limited logs, and secondly, we could not calculate our attack surface, which means what is our proper security posture and where we are standing according to our security level.

My impressions of TrendAI Vision One's ability to provide centralized visibility and management across protection layers is that it provides overall very good visibility in the network. It gets integrated with other security solutions, and we can centrally manage it. It can be integrated with our Active Directory, our firewalls, and security solutions for automatic IOCs blocking. In that respect, it is very much better.

Regarding the Cyber Risk Exposure Management, it helps my organization identify blind spots by calculating based on the vulnerabilities identified on our endpoints, the configuration settings on different endpoints, and on the Active Directory level, the number of alerts we are getting from different points. By calculating all of these, it gives us an overall percentage. Based on that, we assess how we are actually standing in terms of our security posture.

The solution has helped consolidate the use of security vendors because we are also using its MDR service for critical and high-level alerts, and it is cloud-based, so we do not usually need any type of vendor support to solve daily issues. If we get anyone, we can directly open a case with TrendAI Vision One, and the issue can be solved within one or two days.

Almost fifty people use the solution. They are all in Pakistan and working on-site.

The Service Gateway Management machine we use in our network requires maintenance on a monthly basis or every one to two months when we get a new update from them. To manage the different types of functionalities it provides, its license is credit-based, so we have to carefully use all of the functionalities provided by TrendAI Vision One. So it requires some type of maintenance as well.

Maintaining TrendAI Vision One is very easy and very handy.

I do not know the exact pricing of TrendAI Vision One, but the type of structure licenses they provide is very useful for us. We purchase overall credits and can use these credits according to our needs. So the structure of licensing is very much better than other vendors.

I chose TrendAI Vision One here in Pakistan because we have their principal support here in Pakistan, and we can directly connect with them and reach out to them. So the main purpose of purchasing TrendAI Vision One was its principal support.

TrendAI Vision One has reduced our time to detect and respond to threats almost sixty-five to seventy percent. We get alerts in real-time on the Observed Attack Techniques section, and for the higher critical alerts, our MDR service from Trend Micro sends us an email alert within approximately thirty minutes, and they also give us a call reminder to respond to that alert. Then it depends on us how we respond to that alert with different teams and come to the solution.

I cannot quantify by how much TrendAI Vision One has reduced our false positives, as we get false positive alerts on a daily basis. But in the high and critical section, we only get the most relevant alerts. In the medium and low sections, there are very false positive alerts and we are working with Trend Micro and our vendor to reduce these observed attack techniques.

I would recommend TrendAI Vision One because it provides many services in a single console, such as Attack Surface Discovery, awareness session, vulnerability, attack simulation, DLP, and many other EDR services, NDR services, and email security gateway. I would recommend this suite as one console can be used for many solutions.

It is very important for us that TrendAI Vision One has AI built into the platform as we are doing a proof of concept for its new technology, which is called ZTSA. The industry is evolving with respect to artificial intelligence, and we have to secure that area from both data leakage and data protection. So it is very important, and we are doing a proof of concept of ZTSA, which is its new feature of TrendAI Vision One.

I rate this review nine overall.