TrendAI Vision One Reviews

Our use cases for Trend Vision One are monitoring and alerts.

The biggest challenges we wanted to address with Trend Vision One were securing endpoints and enabling us to quickly respond to incidents or threats. This is the main goal for using this solution.

Trend Vision One has improved the way our organization functions by acting as both a monitoring tool and an antivirus, giving us insight on potential threats and enhancing our response time to security incidents. It is hard to measure the time savings but we save a significant amount of time in responding to potential threats. For example, we don't expect employees to respond to emails, chat, or calls outside of working hours. Trend Vision One has a feature where we can block all access to the laptop or endpoints. It allows us to take immediate action without waiting for the user to respond.

In terms of reducing noise from false positives, unfortunately, some behaviors can be mistaken for bad behaviors, but that isn't the fault of the software itself. It largely depends on how the developers of other applications implement their software and how it is run. We encountered an issue with another software called Rapid7, which periodically runs a command on MacBooks or Apple operating systems. This command, which is quite lengthy, searches for any unsecured credentials or API keys related to GitHub on the laptop. The way the application triggers is significant: it runs under root privileges, executing that command in the terminal for the user. Trend Vision One picks this up as a suspicious command, interpreting it as an attempt to find unsecured credentials. Despite having whitelisted the entire command in Rapid7, Trend Vision One still flagged it. We went back and forth on this issue, but ultimately we decided that it wasn't worth further troubleshooting to silence this alert due to the potential for actual malicious use of such commands. While we could whitelist it, we did not want to risk it being exploited maliciously. In the end, we chose to ignore the alert. They helped us reduce some other noise, but there was some noise that we weren't able to reduce.

Vision One AI has been very useful. All IT people stay up to date with security risks, exposures, alerts, or attacks. Vision One AI helps us explain or understand the alerts and what actions are recommended.

The workbench alerts are something we find very useful, as they help us stay informed about various activities. Not all alerts are positive, but they provide valuable insights into the detection methods and help us understand how certain issues arise. For example, if someone attempts to run a piece of software that encrypts a file, one of our tools, which is used for evidence gathering in surveillance systems, may encrypt the file too quickly. As a result, Trend Vision One may trigger an alert. Although this is a false positive, it still gives us insight into the behavior involved. This allows us to investigate the alert further and provide feedback to the user or development team, letting them know that similar triggers are likely to occur with other security systems or software.

Other useful features include intrusion and mailbox alerts, suspicious unauthorized access, tracing logs, website clicks, and email filtering for bad attachments.

The improvement I have been asking for is an easier way to create MDR requests. Not all alerts that come through Trend Vision One receive an investigation, and we would like the ability to easily request an investigation on lower-scored alerts without logging into the support portal to create a ticket.

I would like to see Trend Vision One and OfficeScan consolidated into one platform. Currently, it is the same space but two different layers. It would be nice to have both combined instead of having two clients.

There is room for improvement when it comes to support.

I've been working with Trend Vision One for three years.

Trend Vision One is stable enough. We don't see many performance impacts on our endpoints, except for when our weekly scheduled scans happen. Our developers express that it limits how freely they can develop, but I personally appreciate the insight it gives us and the actions that allow us to take on our devices.

I would rate their support a six out of ten. We encountered an issue with one of our tools—specifically, Visual Studio. One of our developers faced difficulties debugging code because Trend Vision One was blocking the debugging application or causing it to crash. This problem stemmed from a Windows update, and it took us a month and a half to identify the root cause. After we opened a ticket either at the end of March or early April, we waited several more weeks for a solution. Although the Windows update occurred back in February, we didn’t receive the fix until the end of May. The interaction between Windows and the application played a significant role in the issue, as the debugging application starts the code and injects itself into the running application, which Trend Micro flagged as problematic after the latest Windows update. Fortunately, this issue has now been resolved, but it was indeed a painful experience. Our developers were understandably frustrated that they couldn’t debug code for a month and a half, which impacted our project timelines.

The company previously had SentinelOne before my time, and I can say that SentinelOne was not effective. 

We currently use Rapid7 as our Managed Detection and Response (MDR) service. In my experience, both Rapid7 and Trend Vision One serve similar purposes, but they have distinct differences. There are times when Rapid7 provides us with more detailed information, while at other times, Trend Vision One offers greater insights. This is partly because Trend Vision One collects more data from the devices, allowing it to better identify the root causes of alerts compared to Rapid7. 

Additionally, I find that the MDR team at Trend is generally more responsive than that of Rapid7. However, there are some disadvantages as well. For instance, we haven't yet set up cloud monitoring capabilities with Trend Vision One. Rapid7 currently handles our cloud infrastructure monitoring and manages services like Office and Okta. While Rapid7 is equipped to monitor these services, Trend Vision One is not yet at that level. We are exploring ways to enhance its capabilities, and if it can provide the same level of service as Rapid7, we might consider discontinuing our use of Rapid7 altogether.

We use the SaaS solution. I was not involved in the initial setup and deployment process, which occurred prior to my time here, but I have readjusted some policies.

Previously, it was difficult to understand some alerts. However, as time goes by, we differentiate better between them, and the AI feature is an extremely good tool that explains things that are gibberish to the regular user. The learning curve is quite steep.

It has helped us understand some of the alerts that we did not comprehend.

It is an all-around solution that includes various modules for comprehensive security monitoring and alerting. This solution is particularly effective when integrated with other hardware or on-premises solutions, such as Deep Discovery Inspector, which monitors your network.

The interface is adequate, but it is constantly changing. New features are being added, and items are being rearranged almost daily. We might have missed some announcements regarding these frequent updates. As it is an evolving solution, such changes are to be expected. However, there are still features that are buried within menus, which previously required extensive searching to locate. For instance, until last year, isolating endpoints was only possible through the search function. Now, they have added a feature within the endpoint inventory that allows you to select devices and isolate them immediately, rather than having to jump through multiple hoops to access that option.

The application has also become slightly more responsive. Regarding its functionality, the insights it provides are quite useful. The application displays various actions, and you can drill down into alerts to view the execution path associated with them. For example, if an application triggers an alert, you can right-click on that alert and select "Check Execution Profile." This feature shows you where the process started, what actions it took, and where it ended. This improvement is beneficial for understanding how tasks are executed.

I would rate Trend Vision One an eight out of ten.

My main use case for TrendAI Vision One is for ransomware protection, user behavior analysis, and protection. I use TrendAI Vision One for threat detection and response, which helps me with investigation and response. It helps to integrate with the existing infrastructure as my main use case for TrendAI Vision One. Data loss prevention has been a valuable use case with the endpoint security as a feature that stands out to me. The top security challenges in my industry include improving the cyber risk posture and ransomware protection, and TrendAI Vision One is helping me address them, especially for ransomware protection.

I find threat detection and response and remediation using playbooks the most useful features TrendAI Vision One offers me.

In a case of a ransomware incident, the playbook in TrendAI Vision One immediately contained the infection by isolating the endpoint, demonstrating how those playbooks and the detection and response features help me in my day-to-day work.

TrendAI Vision One has positively impacted my organization by specifically helping improve security posture and response time for threat handling, as well as improving our cyber risk score.

TrendAI Vision One has made managing security easier for me compared to earlier by providing centralized visibility and management across protection layers.

The area where I think TrendAI Vision One can improve is the technical support. TrendAI Vision One should speed up the response time for the support tickets that have been opened regarding needed improvements.

I have been using TrendAI Vision One for almost one year now.

TrendAI Vision One should speed up the response time for the support tickets that have been opened regarding needed improvements. I rate TrendAI Vision One a nine out of ten because TrendAI Vision One can improve the technical support. I am using TrendAI Vision One sensors on the endpoint, as well as on the endpoint and workloads. Covering the endpoint is very critical for my organization's network because the endpoint is one of the most important areas to be protected. TrendAI Vision One has helped reduce my time to detect and respond to threats; in my previous studies, I found the detection and response has come down from weeks to only days. My overall review rating for TrendAI Vision One is nine.

Our infrastructure utilizes Trend Vision One for endpoint and cloud-based security. While all our endpoints are cloud-based, allowing us to deploy Trend Vision One in the cloud, we also maintain endpoint-specific protection. Currently, our network infrastructure is not fully integrated with Trend Vision One. The platform primarily monitors our backend infrastructure and provides initial response capabilities.

I implemented Trend Vision One to consolidate log inspection, integrity monitoring, intrusion prevention, and application control into a single platform, eliminating the need to switch between multiple applications.

Trend Vision One provides centralized visibility and management across protection layers, which is crucial for compliance. It allows us to show audits of what’s going on and keep all evidence in one place. This centralized visibility has improved our efficiency, as it means just one login is needed to complete all necessary tasks, maintaining focus and reducing distractions resulting from multiple sources.

The Vision One executive dashboards effectively communicate our company's overall security posture by providing a clear risk overview. Executives appreciate the simple visual cues, with green indicating low risk and yellow signaling high risk, allowing for quick and easy understanding of our current security status.

I immediately recognized the benefits of Trend Vision One because, unlike our other security applications, it provides comprehensive visibility.

I utilize Vision One's risk index feature to assess our organization's risk level and benchmark it against our peers. This comprehensive evaluation allows us to understand our current risk profile, identify areas for mitigation, and determine acceptable risk thresholds. The risk index feature is essential to our business operations.

Attack surface risk management helped us identify blind spots in our environment and provided detailed remediation strategies. This works as a second pair of eyes that helps look for vulnerabilities, which in turn improves our security posture.

Trend Vision One improves our detection and response times by identifying vulnerabilities and summarizing mitigation strategies.

Trend Vision One helps reduce the amount of time we spend investigating false positive alerts by 80 percent.

I love Trend Vision One for its robustness, allowing us to deep dive into a lot of information. The Trend hunting feature is beneficial, providing the opportunity to investigate and see what's happening, using frameworks such as MITRE ATT&CK to analyze logs. Its risk index feature allows us to see risk status quickly and provides valuable insights into our security posture.

The only issue I have with Trend Vision One is the credit structure, which is confusing. An easier way to understand the credit structure would be helpful.

I have been using Trend Vision One for over five years.

Trend Vision One is stable and does not crash. In my experience, it has not shown any instability issues.

Trend Vision One is scalable. We can increase or decrease according to needs, although pricing changes when scaling.

Trend Micro's support response time can be slow. The quality of assistance varies depending on the issue. However, reaching qualified technical engineers can be challenging due to lengthy escalation processes.

Neutral

I've used many alternatives before, like Avast, SonicWall, and Mimecast. These alternatives don't have all the integrated features of Trend Vision One, particularly the server and workload capabilities.

The initial setup required deep diving and using resources such as help centers. Despite not being straightforward, it was manageable.

The deployment took three days.

I implemented Trend Vision One in-house with the support of team members, using resources like software guides and videos.

Trend Vision One is an expensive product.

I would rate Trend Vision One eight out of ten.

The most significant security challenge we face is zero-day attacks, which exploit vulnerabilities unknown to us. While Trend Vision One provides some protection, it cannot catch all zero-day threats, leaving us potentially exposed. This inherent vulnerability in our security poses the greatest risk.

Trend Micro handles most maintenance, but we are responsible for installing agent patches on our servers.

New users should understand that Trend Vision One is different from other solutions they might have used. Reading and fact-finding are crucial. They must ask the right questions.

We primarily use Trend Vision One for its XDR capabilities, email security features, and MDR services offered through ServiceOne. Leveraging these Trend Vision One products allows us to provide robust security solutions to our customers.

My customers range from small non-profits with 40 endpoints to large enterprises with over 2,000 endpoints across diverse sectors, including energy, manufacturing, finance, and software.

Vision One possesses machine learning predictive capabilities that have already proven effective. In the past week alone, it detected and blocked two scans for unknown threats. This capability is crucial, especially since our predominantly Canadian customer base faces an elevated risk of cyberattacks from China due to the recent government-level ban on TikTok. Consequently, we anticipate an increase in attacks. Trend Vision One boasts the largest zero-day initiative, renowned for its proficiency in detecting such threats.

The single console in Vision One streamlines cross-layer detection, threat hunting, and investigation, incorporating sandbox analysis and log search capabilities. It allows for endpoint isolation, remote shell establishment, and integration with tools like Active Directory and Microsoft Entra ID. Automated playbooks enable actions such as endpoint isolation, custom script execution, forensic investigations, user lockouts, and password resets, all of which are customizable. This automation is crucial for containing threats outside of working hours, as playbooks can be configured to automatically execute actions based on specific criteria, mitigating damage before staff return.

The single console provides comprehensive visibility across the entire IT security environment, including endpoints, cloud activity, workflow protection, email protection, and mobile device management, all within a single, unified platform.

Trend Vision One integrates with a range of security products, including various SIEM solutions, vulnerability management tools, and select firewalls. A comprehensive list of compatible products is available on Trend Micro's website.

Trend Vision One is relatively easy to learn for those with some security background. While first-time users may find it initially confusing, abundant learning resources such as YouTube videos and comprehensive documentation are available to help users quickly familiarize themselves with the platform.

Some of my customers maintain hybrid environments, and Trend Vision One enhances visibility by consolidating all systems into a single platform.

Trend Vision One has malware scanning capabilities, allowing it to detect, quarantine, and block malware effectively.

Trend's Managed Detection and Response service provides continuous 24/7 monitoring, effectively reducing staff workloads by eliminating the need for in-house security monitoring.

Trend Vision One improves my organization's visibility by consolidating security functions into a single console. These capabilities enhance our security operations, making it easier to manage threats.

Trend Vision One's most valuable feature is its centralized console, which provides comprehensive security features, including attack surface risk management. This allows for benchmarking our risk score against similar organizations based on size, industry, and location. Additionally, it offers endpoint vulnerability assessment, user behavior analytics, and standard XDR detection capabilities.

An area for improvement is integrating more tools with Trend Micro's SIEM. Expanding compatibility to include currently unsupported security tools, such as firewalls, would be beneficial.

I have been using Trend Vision One for approximately four months.

Trend Vision One is scalable.

To improve support, the company should streamline communication and reduce response times. Specifically, support tickets often require customers to provide redundant information, creating unnecessary extra steps in the process.

Positive

Overall, I rate Trend Vision One a ten out of ten as I am extremely happy with Trend Micro's capabilities and their platform's strength.

Trend Vision One is easy to maintain.

A common use case for TrendAI Vision One is ransomware detection and response, and we also use it for business email compromise. Our SOC team uses it for advanced threat hunting and insider threat detections.

Recently, my team used TrendAI Vision One for ransomware detection and response when a user executed a malicious attachment, leading to the detection of suspicious process executions. TrendAI Vision One helps us by correlating emails with endpoints, identifying host details, network activity, user device activity, and infected sources, allowing for quick resolution of threats in the organization.

We have also been using TrendAI Vision One for identifying suspicious or compromised emails and insider threat detections, which aids us in quickly identifying and investigating malicious emails.

TrendAI Vision One offers excellent extended detection and response capabilities through EDR and XDR solutions, as it is a complete package for organizational threat protection across email, endpoints, cloud networks, servers, and data centers. It helps us quickly identify attacks and provides deep insights into attacker movements as well as a centralized investigation workbench from a single dashboard.

Having everything in one dashboard allows our SOC team to quickly identify details across the network or organization level, such as the number of created tickets, false positives, true positives, actions taken, SLAs, threat metrics, and attack path details. It reduces alert fatigue for SOC analysts by providing a consolidated view of all details across the organization.

TrendAI Vision One has positively impacted our organization by identifying real-time threats and proactively isolating threats while alerting the SOC team for further investigations and remediation actions.

Since implementing TrendAI Vision One, it has reduced noise from false positive alerts by 80% and enabled the SOC team to focus on true positives, thus improving incident response and operational efficiency. TrendAI Vision One is highly reliable; it provides centralized visibility across protection layers and is stable and scalable, making it a suitable solution for organizations looking for thorough threat detection and response capabilities.

I believe that if the reporting features of TrendAI Vision One could be improved, it would help SOC analysts retrieve comprehensive reports detailing true positive incidents, top email threats, quarantined emails, and common malware, enhancing our analytics capabilities.

The TrendAI Vision One support system is not very good. They charge extra for premium support, while basic support does not adequately assist with investigations and troubleshooting. Improvements in this area are needed, and there should also be enhancements in third-party integrations to reduce alert noise and false positives.

TrendAI Vision One's governance and security capabilities are excellent, and while the security is always very good, they can still improve on compliance and regulations.

If they fix automated root cause analysis reports and AI-generated incident summaries, it can enhance capabilities further and reduce investigation times.

I have been using TrendAI Vision One for more than two years.

TrendAI Vision One is stable.

TrendAI Vision One is highly scalable as per our requirements, as user licenses can be improved if we have a greater number of users.

The customer support is not very good, and they need to improve their premium license support.

Previously we were using a different endpoint solution due to setup cost and support issues, so we switched to TrendAI Vision One for better SOC capabilities for threat detection.

My experience with pricing, setup cost, and licensing was very good. The top leadership is engaged in identifying pricing and licensing features, although licensing renewal is challenging and the setup cost can be high, but it remains manageable for quality solutions.

We evaluated other options such as FireEye Helix, Symantec, and Microsoft Sentinel during our assessment process.

My advice to others looking into using TrendAI Vision One is to definitely proceed with this solution as it is a complete package for SOC teams regarding threat identification and remediation, although there is room for improvement in support. This review has a rating of 9.

The primary use of Trend Vision One is for its Endpoint Detection and Response and Extended Detection and Response solutions.

To address challenges with our attack surface management, we implemented Trend Vision One.

Trend Vision One's most valuable feature is its endpoint firewall rules.

The centralized visibility and management have been very important to us, as it allows for an effective EDR or XDR solution with central management. Without such solutions, I cannot imagine dealing with problems efficiently. The executive dashboards are used for main reporting and central management, improving readability.

Trend Vision One's attack surface management capabilities are a critical feature that we utilize.

Integration with other tools and deploying in hybrid environments need improvement. The deployment can be complex, and we'd like an easier process, especially when integrating with on-prem and cloud environments.

The high number of false positives in Trend Vision One presents a challenge. Reducing these requires extensive exclusion and allow lists, which are difficult to manage effectively.

I have been using Trend Micro Vision One for one year.

Trend Vision One is scalable.

The technical support is not good. We have to purchase support separately and the engineers are not readily available.

Neutral

We previously used Sophos and Microsoft Defender. For hybrid, we switched to Microsoft Defender due to easier integration with on-prem and cloud. I would recommend Trend Micro for Linux and mixed environments.

The standard deployment of Trend Vision One was straightforward and took approximately 24 hours to complete with two people involved.

Trend Vision One offers a competitive price-to-value ratio.

We evaluated Microsoft Defender and Sophos before switching. Microsoft offers more options for attack surface reduction rules compared to Trend Vision One.

I would rate Trend Vision One eight out of ten.

We have 400 users of Trend Vision One in our organization.

Two administrators are required to manage Vision One.

Which deployment model are you using for this solution?

As a security architect, I design solutions for our end customers. In previous projects, we've successfully implemented Trend Vision One for customers with cloud-based assets and email servers, enabling them to extend security coverage to their remote clients.

The current market trend in email security solutions focuses on mitigating threats like phishing attacks. These widespread attacks occur across various points in the cyber kill chain process. Whether initiated from the perimeter or targeting cloud-based assets, monitoring all north-south and east-west traffic is challenging. Trend Vision One helps by providing a comprehensive analysis of these email phishing attacks, identifying the attack origin, parameters, and information extracted from attack patterns.

Trend Vision One offers centralized visibility and management across all protection layers. This comprehensive view provides valuable information for CISO/CIO presentations, including attack patterns, threat actors, and areas for predictive analysis. Such insights are crucial for informing policy changes and other security enhancements. The visibility also helps with efficiency.

We can summarize any technical information we receive using widgets and then present it to executives in a dashboard format.

Our customers adapt the risk index feature to align with the specific needs and conditions of their individual environments.

We have used Trend Vision One in several projects where our customers consolidated security across hybrid environments. The consolidation effort, particularly utilizing Vision One's AI-driven features, streamlined investigative analytics. Furthermore, merging multiple solutions into Vision One provided comprehensive insights, which proved invaluable for policy development.

The ability to manage risk and maintain visibility has improved by approximately 20 to 30 percent, significantly simplifying our tasks. Operationally, this has led to a 20 percent reduction in effort.

Trend Vision One has helped reduce detection and response times by 30 and 40 percent, respectively.

Trend Vision One has saved more than a week's worth of effort in investigating false positives.

Trend Vision One's automation capabilities have helped us save between 60 and 100 hours monthly. 

The most important features of Vision One include visibility, AI integration, attack pattern analysis, predictive analytics, and centralized visibility and management across protection layers. These features are very important to us. 

There should be improvements in risk quantification, where the risk is displayed in a quantified manner, showing the dollar value loss. The integration with third-party OEM solutions also needs enhancement, particularly in UEBA integration with Trend. Sometimes, there are blind spot discoveries that are not completely successful. Improving automation to avoid manual triaging and providing more insights on dashboards is desirable.

While Trend Vision One's attack surface risk management helped identify some vulnerabilities in our environment, the feature needs improvement. Specifically, the blind spot discovery is unreliable; for example, a missed blind spot in one environment led to an attack and subsequent investigation.

Automation should be improved to eliminate the need for manual effort in initial L1 triaging. Additionally, dashboards should provide more insightful analysis, including various mappings to the MITRE ATT&CK framework and Tactics, Techniques, and Procedures.

I have been working with Vision One for almost almost two years.

The support in Trend Micro is good.

Positive

I have worked on Exchange servers, and we are using Palo Alto to a certain extent. These were not from the XDR or EDR point of view.

The analysis shows that Trend Vision One has improved our ROI by 30 percent.

Competitors offer comparable solutions at slightly lower prices, so Vision One has room to reduce its pricing by 15 percent, given that Trend Vision One charges approximately $10 per endpoint.

We evaluated other options but not to the same extent as Trend Micro because I was more familiar with Trend Micro solutions.

I would rate Trend Vision One nine out of ten.

In terms of the VDR, we are doing the Sophos entire solutions. We are doing the firewall, as well as endpoint, as well as email security.

When it comes to SophosLabs Intelix or Sophos Cloud Optix, basically, we are working with Sophos XDR and MDR right now.

As a partner, we have so many clients who are serving the Extended Detection and Response, and some users are just selling the Sophos Managed Detection and Response services. Basically, it's XDR, it's a tool, and MDR is managed by the Sophos security team 24/7. So, we are selling the Sophos MDR.

On the firewall side, we are doing the Sophos firewall, SonicWall firewall, and FortiGate.

We are dealing with Trend Micro for EDR and XDR.

We have been doing this product for the last 10 years, actually. Ten plus years we have been doing this product—Sophos entire solution and Trend Micro entire solution. Trend Micro has so many products, including anti-APT and IDS, IPS device.

For TrendAI Vision One, I have many corporate users who are using it for their servers' security, as well as the IDS, IPS device and TippingPoint, SMS gateway, and so on.

TrendAI Vision One has core features, such as endpoint, email, identity, servers, cloud workloads, and networks. When we talk about endpoint security, it includes anti-malware, anti-ransomware, behavioral analysis, exploit protections, device control, application control, post firewall, and EDR capabilities for the threat investigation and response. These are the TrendAI Vision One features.

Regarding TrendAI CReM capabilities, the threat hunting includes searching across telemetry data, IOC sweeping, root cause analysis, and advanced investigation tools. When we talk about the CReM features, they provide visibility into endpoints, server, cloud workloads, and identities. They help to identify unknown or exposed assets in the environment, then asset discovery, vulnerability management, and attack surface management.

My impressions of TrendAI Vision One include risk prioritization analysis, security posture, and assessment. Right now, I am working with Sophos in Sophos XDR.

I just appreciate the Sophos server protection and its lockdown features. When I whitelisted some applications, other executable files or any files do not run in the environment. I compare Sophos EDR with Sophos XDR, Endpoint Detection and Response, and Extended Detection and Response. When we're going with Sophos XDR, they have email, identity, firewall, cloud, and any third-party integrations.

I am focusing on the Sophos product, but as per the client requirement, I recommend Sophos because the clients are using a parameter gateway with a Sophos firewall. I pitch Sophos because they enable Heartbeat security, so the firewall and endpoint communicate effectively. It's a good bundle when combining Sophos firewall with Sophos endpoint.

Some users using Sophos require on-premises solutions and do not move to the cloud. So many reasons exist for this, which is why we pitch server solutions. Trend Micro server protection is a really good product, but my query always relates to support; I cannot get immediate support from Trend Micro.

For TrendAI Vision One, I have many corporate users who are using it for their servers' security, as well as the IDS, IPS device and TippingPoint, SMS gateway, and so on.

TrendAI Vision One has core features, such as endpoint, email, identity, servers, cloud workloads, and networks. When we talk about endpoint security, it includes anti-malware, anti-ransomware, behavioral analysis, exploit protections, device control, application control, post firewall, and EDR capabilities for the threat investigation and response. These are the TrendAI Vision One features.

Regarding TrendAI CReM capabilities, the threat hunting includes searching across telemetry data, IOC sweeping, root cause analysis, and advanced investigation tools. When we talk about the CReM features, they provide visibility into endpoints, server, cloud workloads, and identities. They help to identify unknown or exposed assets in the environment, then asset discovery, vulnerability management, and attack surface management.

I appreciate the Sophos server protection and its lockdown features. When I whitelisted some applications, other executable files or any files do not run in the environment. I compare Sophos EDR with Sophos XDR, Endpoint Detection and Response, and Extended Detection and Response. When we're going with Sophos XDR, they have email, identity, firewall, cloud, and any third-party integrations.

I am focusing on the Sophos product, but as per the client requirement, I recommend Sophos because the clients are using a parameter gateway with a Sophos firewall. I pitch Sophos because they enable Heartbeat security, so the firewall and endpoint communicate effectively. It's a good bundle when combining Sophos firewall with Sophos endpoint.

From my perspective, the only disadvantage in TrendAI Vision One is the support size.

The support takes too much time. When I email, I have to collect logs and submit them to the engineer, then wait for their reply. It takes too much time. The product is really good, but the support is not good in my perspective since it takes too long to receive help, especially when all the devices are in production.

The price is high when compared to the features. After installing the product, support is always required. Whenever we deploy any product, we need support, especially if an issue arises, support is a must.

We face lots of challenges, but the product itself is good. The main issues arise from support.

Some users using Sophos require on-premises solutions and do not move to the cloud. So many reasons exist for this, which is why we pitch server solutions. Trend Micro server protection is a really good product, but my query always relates to support; I cannot get immediate support from Trend Micro.

Trend Micro is a really good product, but I face challenges when not getting proper support; hence I feel helpless at times. The product itself is really good; I have no doubts about that.

We have been doing this product for the last 10 years. Ten plus years we have been doing this product—Sophos entire solution and Trend Micro entire solution.

The support takes too much time. When I email, I have to collect logs and submit them to the engineer, then wait for their reply. It takes too much time. The product is really good, but the support is not good in my perspective since it takes too long to receive help, especially when all the devices are in production.

From my perspective, the only disadvantage in TrendAI Vision One is the support size. Sophos support is really good, but when I require immediate support from Trend Micro, it is a challenge.

TrendAI Vision One is easy; deployment is not a problem.

We are dealing with Trend Micro for EDR and XDR.

My impressions of TrendAI Vision One include risk prioritization analysis, security posture, and assessment. Right now, I am working with Sophos in Sophos XDR.

When we talk about the CReM features, they provide visibility into endpoints.

I would rate Trend Micro support a six to seven, possibly seven to eight.

The interface and everything are good; my only query is on the support, which is not good from my perspective.

Some limited corporate users and some government users choose Trend Micro instead of Sophos.

Trend Micro is a really good product, but I face challenges when not getting proper support; hence I feel helpless at times. The product itself is really good; I have no doubts about that.

I would rate this review an eight overall.

We use it for analytics. We check all the maps and communications when there is an incident or an issue. It is very helpful for analytics.

Trend Vision gives a lot of visibility. If you have a big environment, you can use it to see logs or events. It gives more visibility into what is going on in your infrastructure.

Last year, we experienced an attack attempt, and it gave us a lot of visibility. We were able to track the source and all the processes that were involved during the attack. For security, it is very good.

Trend Vision One has helped reduce our time to detect and respond to threats by 30% to 40%.

I find the maps particularly helpful. The object list, specifically the suspicious object list, is also quite valuable. You can simply add one object to that list to manage it from another solution.

It gives comprehensive visibility. It is very good. It gives a lot of visibility into all layers such as layer three or layer seven. It helps with monitoring the endpoints, including all the desktops and processes or communication between servers.

I believe that the interface could be more user-friendly. At times, it is challenging to locate certain features, and they need to reorganize the user interfaces.

I have been using the solution for one year.

I would rate their customer support a five out of ten. They sometimes do not give enough attention to the tickets. Even when I update a ticket or a case, they ask the same questions that I have already answered. I explain my problem, and they respond as if not paying enough attention.

Neutral

Previously, we used another solution. We observed that Trend is trying to move all the solutions to Vision One. That is why we decided to transition, and it is working very well. 

It gives more visibility. The other solution was focused only on the server or endpoint protection. It did not provide any tracks, just the basics. With Vision One, we can see all the information correlated in one place, which I find very helpful.

The initial setup is very easy. It is not very complicated. Sometimes, the documentation is not updated, but the processes are very intuitive, so it is not that hard.

In terms of the implementation strategy, we first focus on non-critical servers or appliances, and then we move on to critical ones.

It is being used in an enterprise environment at a data center.

The implementation may require two people, depending on the infrastructure and scale. You might need an engineer or an administrator.

For maintenance, there are two people. One person scans and reviews all the information and the other one is from the backup. It requires minimal maintenance.

Overall, the visibility and security that it provides are our returns on the investments.

I feel that Vision One is a bit expensive. As for the pricing or licensing, I would rate it a seven out of ten.

I would rate Vision One an eight out of ten.