IT Consultant at a tech services company with 11-50 employees
Consultant
Top 20
Sep 2, 2025
I have not experienced integrated threat intelligence benefits with Symantec Endpoint Security Enterprise. Many customers are seeking modern protection features such as MDR (managed detection and response). As a result, they are exploring ThreatDown as an alternative or using it in combination with Symantec Endpoint Security Enterprise. The managed detection and response capabilities need to be more clearly defined. Customers are uncertain about the modern protection features compared to competitors such as ThreatDown, CrowdStrike, and SentinelOne. This represents a significant disadvantage for Symantec Endpoint Security Enterprise.
Information Technology Infrastructure Consultant Associate at a financial services firm with 10,001+ employees
Consultant
Top 20
Aug 28, 2025
I have a note about the integrated threat intelligence in Symantec Endpoint Security Enterprise, though I am unsure how much it is incorporated into my daily work. We receive occasional letters about threat intelligence, and I check with my working environment about incoming threats, but they are not significantly incorporated into the endpoint protection process. Regarding the centralized management console, it is intuitive, but the threat intelligence aspect could be more incorporated and developed, especially with AI integration and news directly in the platform. It shouldn't be overwhelming with news but could integrate important threat detection information that becomes visible minutes after Broadcom publishes it. Since implementation, there haven't been significant improvements. The threat intelligence was incorporated from the beginning, but we subscribed to the platform shortly after starting. The dashboard and system haven't changed substantially, which could be a feature that needs improvement to provide a clear vision of changes and new features in the cloud security platform. The platform could be improved for beginners as it wasn't intuitive to manage initially. Additional guidance through video environments would be helpful for navigation. The learning curve in the first three months was challenging with limited resources. The six or seven dashboards could be consolidated, as switching between them isn't intuitive when the workflow demands it.
Global Lead IT Security Analyst at Hoerbiger Company
Real User
Top 5
Feb 15, 2024
The solution could improve its speed, threat coverage, and the tool's functionality. There are concerns regarding the tool's usability, particularly its dashboard and managing user data such as cache memory. For instance, it encounters difficulties when users switch between different Wi-Fi networks, leading to disruptions in connectivity. These issues need to be addressed to ensure better scalability and user experience. There are performance issues during full or manual scans, which negatively impact system performance. It should be integrated with AI and machine learning because many threats are becoming increasingly sophisticated, necessitating advanced detection capabilities. Additionally, it should include features for IoT security to safeguard IoT devices. This would enable us to implement security measures tailored to IoT hosts. A setup with agent-based scanning specifically designed for IoT devices would be advantageous for optimal protection.
Though the product is good, it is not very easy to use. There are so many internal problems with the tool, and one needs to have time to resolve them. Sometimes, the tool is not fast when you want to scan certain areas. My company has many in-house applications that we need to install manually after the tool completes the scanning process. When our company's in-house application is installed manually, the solution detects such an application as a virus, after which it gets deleted. My company faces the same problem with the product for every machine.
IT Infrastructure Lead at iConnect IT Business Solutions DMCC
Real User
Top 5
Feb 7, 2024
The scanning area of the product should be made a little faster as it is the only area of concern in the tool where improvements are required. The product offers its own database. It would be great if Symantec Endpoint Security Enterprise's database could be integrated with the databases from other vendors since it can help provide more visibility to users on the day-to-day or zero-day attacks. From an improvement perspective, the support offered by the product should be made faster.
Learn what your peers think about Symantec Endpoint Security Enterprise. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
I don't see any specific areas for improvement. They are knowledgeable about advanced solutions, so no suggestions from my end. Maybe there are minor enhancements, like improving UI features or dashboards, but overall, the product is well-designed. As for additional features, I hope they incorporate Kipops, specifically AI functionality, in the next release of Symantec Endpoint Security Enterprise.
I believe an improvement could be made in Symantec Endpoint Security Enterprise by incorporating a URL blocking feature within the same product. Currently, it requires a separate subscription and agent installation, which I think could be more streamlined for unified management from a single agent.
Presales Enterprise Systems Engineer at Headington Technology Solutions Pvt Ltd
Real User
Oct 13, 2023
There could be a pop-up notification at the users' end whenever the software expires. At the moment, even after it expires, the machine shows it is up-to-date. It becomes challenging to explain to the customers that the licenses need to be renewed.
Unlike traditional tools, Symantec Endpoint Security Enterprise does not provide trigger alerts based on user behavior-based traffic. Most organizations panic about the latest threats like ransomware in the IT industry. There should be some special mechanism to find out these threats, and the correlation engine should be very strong to give us complete visibility of what happens. Like other latest products, Symantec Endpoint Security Enterprise must give us end-to-end visibility of what's happening. It should give us some insight into malicious activities and tell us what needs to be done quickly.
Technical operations manager at a consultancy with 11-50 employees
Real User
Jan 10, 2023
It could be more responsive and have fewer delays. We don't spend a lot of time in the platform, but it's working well. It seems like the console was written a long time ago, and sometimes the browsers have problems with updating the console because there are heavy Java issues. Maybe they'll rewrite it eventually to make it more suitable.
Information Technology Manager at a consultancy with 1-10 employees
Real User
Oct 9, 2022
The solution's browser protection in Chrome needs to be improved, as it's the most troublesome aspect of the tool. I have two devices where the browser protection failed, an issue that has yet to be fixed for two months. When updates occur, the client restarts, and the browser protection for Chrome malfunctions. Broadcom needs to improve its ability to hijack a browser session to filter web traffic because that's important, as well as site blocking. This element is missing in the product; most companies have firewalls with web content filtering to prevent employees from accessing specific sites. The customer support could be better; Broadcom EU support isn't the best, and they don't seem overly interested in helping smaller companies. The reseller/partner network is another area for improvement; it was tough for us to find a reseller, as there is only one in Ireland. This may be an issue in other parts of Europe too.
Service Systems Engineer at a tech services company with 10,001+ employees
Real User
Jul 11, 2022
It would be really awesome to have configurability of the canned reports. Those things are built in and there are no options for configuration of any kind. It gives you the information that you're looking for, but it also gives you a set amount of information and you can't specify what you want or drill it down to the signal to get past the extra noise that comes through. This means you have to do a lot of analysis on the canned reporting. There's also only one output option and that's CML, which is kind of useless for analysis. You need a spreadsheet option and that's not available. It would be tremendous to have a spreadsheet option because then you could import the report instantly into an Excel template where all of the noise is automatically filtered out and you just have the signal. The way it stands right now, the conversion process is ugly and kind of useless. That's why I resorted to going to the back end and pulling out information that we need for every set up. I've done that for 150 days now because I need specific information. We are currently looking at CrowdStrike as a replacement option because on-prem support is going away under Symantec. CrowdStrike is also a cloud offering, but it has a proxy option whereby all the traffic routes through our data center so we can throw up all kinds of protections that we need to have in place since all of our stations are on dark networks. The primary determinant for us is the fact that CrowdStrike offers that proxy routing, and we've been asking Symantec for that since before Broadcom came on the scene. Ever since we went to version 14 we wanted to try to go with the cloud. Just the sonar option, for example, includes all of the reputation look ups, all of the AI, the machine learning capabilities and so forth, and having all of those features would have been awesome, but we couldn't implement it because it required a direct connection to the cloud from the workstation. In our line of work, that's crazy, and we can't do that. It's a straightforward networking operation to allow for tunneling through the cloud, as opposed to direct connection to the cloud. That would be my number one feature that I would like to see added.
As an end-user, I can't really speak to anything that may be missing from a technical standpoint. It works for me and it is secure and that's enough. The solution could always be more stable and more user-friendly.
IT Infrastructure Lead at iConnect IT Business Solutions DMCC
Real User
Top 5
Mar 2, 2022
An area for improvement for Symantec Endpoint Security Enterprise would be its firewall features, in particular, this solution needs to provide more control over the firewall.
Sr. Consultant, Cyber Security at a tech services company with 501-1,000 employees
Real User
Feb 7, 2022
Symantec is selling Endpoint Detection Response as a different solution. If it was incorporated in this solution it would be a good thing. This is what the other vendors are doing, such as CrowdStrike. They offer Endpoint Protection(EPP) and Endpoint Detection and Response(EDR) in the same product. If Symantec had something similar, it would be good for customers, they would not need to purchase two different products and then integrate them. They can have a single agent doing two tasks.
Endpoint Security Enterprise focuses on advanced prevention for traditional endpoints and modern mobile devices. To include attack surface reduction capabilities and detection and response technologies, check out Endpoint Security Complete.
I have not experienced integrated threat intelligence benefits with Symantec Endpoint Security Enterprise. Many customers are seeking modern protection features such as MDR (managed detection and response). As a result, they are exploring ThreatDown as an alternative or using it in combination with Symantec Endpoint Security Enterprise. The managed detection and response capabilities need to be more clearly defined. Customers are uncertain about the modern protection features compared to competitors such as ThreatDown, CrowdStrike, and SentinelOne. This represents a significant disadvantage for Symantec Endpoint Security Enterprise.
I have a note about the integrated threat intelligence in Symantec Endpoint Security Enterprise, though I am unsure how much it is incorporated into my daily work. We receive occasional letters about threat intelligence, and I check with my working environment about incoming threats, but they are not significantly incorporated into the endpoint protection process. Regarding the centralized management console, it is intuitive, but the threat intelligence aspect could be more incorporated and developed, especially with AI integration and news directly in the platform. It shouldn't be overwhelming with news but could integrate important threat detection information that becomes visible minutes after Broadcom publishes it. Since implementation, there haven't been significant improvements. The threat intelligence was incorporated from the beginning, but we subscribed to the platform shortly after starting. The dashboard and system haven't changed substantially, which could be a feature that needs improvement to provide a clear vision of changes and new features in the cloud security platform. The platform could be improved for beginners as it wasn't intuitive to manage initially. Additional guidance through video environments would be helpful for navigation. The learning curve in the first three months was challenging with limited resources. The six or seven dashboards could be consolidated, as switching between them isn't intuitive when the workflow demands it.
The tool needs to improve its dashboard.
The solution could improve its speed, threat coverage, and the tool's functionality. There are concerns regarding the tool's usability, particularly its dashboard and managing user data such as cache memory. For instance, it encounters difficulties when users switch between different Wi-Fi networks, leading to disruptions in connectivity. These issues need to be addressed to ensure better scalability and user experience. There are performance issues during full or manual scans, which negatively impact system performance. It should be integrated with AI and machine learning because many threats are becoming increasingly sophisticated, necessitating advanced detection capabilities. Additionally, it should include features for IoT security to safeguard IoT devices. This would enable us to implement security measures tailored to IoT hosts. A setup with agent-based scanning specifically designed for IoT devices would be advantageous for optimal protection.
Though the product is good, it is not very easy to use. There are so many internal problems with the tool, and one needs to have time to resolve them. Sometimes, the tool is not fast when you want to scan certain areas. My company has many in-house applications that we need to install manually after the tool completes the scanning process. When our company's in-house application is installed manually, the solution detects such an application as a virus, after which it gets deleted. My company faces the same problem with the product for every machine.
The scanning area of the product should be made a little faster as it is the only area of concern in the tool where improvements are required. The product offers its own database. It would be great if Symantec Endpoint Security Enterprise's database could be integrated with the databases from other vendors since it can help provide more visibility to users on the day-to-day or zero-day attacks. From an improvement perspective, the support offered by the product should be made faster.
I don't see any specific areas for improvement. They are knowledgeable about advanced solutions, so no suggestions from my end. Maybe there are minor enhancements, like improving UI features or dashboards, but overall, the product is well-designed. As for additional features, I hope they incorporate Kipops, specifically AI functionality, in the next release of Symantec Endpoint Security Enterprise.
Symantec Endpoint Security Enterprise needs to improve its manageability. It is not easy to manage.
I believe an improvement could be made in Symantec Endpoint Security Enterprise by incorporating a URL blocking feature within the same product. Currently, it requires a separate subscription and agent installation, which I think could be more streamlined for unified management from a single agent.
There could be a pop-up notification at the users' end whenever the software expires. At the moment, even after it expires, the machine shows it is up-to-date. It becomes challenging to explain to the customers that the licenses need to be renewed.
The product must develop some virus definition features.
Unlike traditional tools, Symantec Endpoint Security Enterprise does not provide trigger alerts based on user behavior-based traffic. Most organizations panic about the latest threats like ransomware in the IT industry. There should be some special mechanism to find out these threats, and the correlation engine should be very strong to give us complete visibility of what happens. Like other latest products, Symantec Endpoint Security Enterprise must give us end-to-end visibility of what's happening. It should give us some insight into malicious activities and tell us what needs to be done quickly.
Symantec should revamp its graphical user interface.
It could be more responsive and have fewer delays. We don't spend a lot of time in the platform, but it's working well. It seems like the console was written a long time ago, and sometimes the browsers have problems with updating the console because there are heavy Java issues. Maybe they'll rewrite it eventually to make it more suitable.
The solution's browser protection in Chrome needs to be improved, as it's the most troublesome aspect of the tool. I have two devices where the browser protection failed, an issue that has yet to be fixed for two months. When updates occur, the client restarts, and the browser protection for Chrome malfunctions. Broadcom needs to improve its ability to hijack a browser session to filter web traffic because that's important, as well as site blocking. This element is missing in the product; most companies have firewalls with web content filtering to prevent employees from accessing specific sites. The customer support could be better; Broadcom EU support isn't the best, and they don't seem overly interested in helping smaller companies. The reseller/partner network is another area for improvement; it was tough for us to find a reseller, as there is only one in Ireland. This may be an issue in other parts of Europe too.
It would be really awesome to have configurability of the canned reports. Those things are built in and there are no options for configuration of any kind. It gives you the information that you're looking for, but it also gives you a set amount of information and you can't specify what you want or drill it down to the signal to get past the extra noise that comes through. This means you have to do a lot of analysis on the canned reporting. There's also only one output option and that's CML, which is kind of useless for analysis. You need a spreadsheet option and that's not available. It would be tremendous to have a spreadsheet option because then you could import the report instantly into an Excel template where all of the noise is automatically filtered out and you just have the signal. The way it stands right now, the conversion process is ugly and kind of useless. That's why I resorted to going to the back end and pulling out information that we need for every set up. I've done that for 150 days now because I need specific information. We are currently looking at CrowdStrike as a replacement option because on-prem support is going away under Symantec. CrowdStrike is also a cloud offering, but it has a proxy option whereby all the traffic routes through our data center so we can throw up all kinds of protections that we need to have in place since all of our stations are on dark networks. The primary determinant for us is the fact that CrowdStrike offers that proxy routing, and we've been asking Symantec for that since before Broadcom came on the scene. Ever since we went to version 14 we wanted to try to go with the cloud. Just the sonar option, for example, includes all of the reputation look ups, all of the AI, the machine learning capabilities and so forth, and having all of those features would have been awesome, but we couldn't implement it because it required a direct connection to the cloud from the workstation. In our line of work, that's crazy, and we can't do that. It's a straightforward networking operation to allow for tunneling through the cloud, as opposed to direct connection to the cloud. That would be my number one feature that I would like to see added.
Symantec Endpoint Security Enterprise should focus on cloud security with Microsoft Azure or Amazon AWS rather than having their standard solution.
As an end-user, I can't really speak to anything that may be missing from a technical standpoint. It works for me and it is secure and that's enough. The solution could always be more stable and more user-friendly.
In the future, Symantec Endpoint Security Enterprise should improve the firewall and documentation.
An area for improvement for Symantec Endpoint Security Enterprise would be its firewall features, in particular, this solution needs to provide more control over the firewall.
Symantec is selling Endpoint Detection Response as a different solution. If it was incorporated in this solution it would be a good thing. This is what the other vendors are doing, such as CrowdStrike. They offer Endpoint Protection(EPP) and Endpoint Detection and Response(EDR) in the same product. If Symantec had something similar, it would be good for customers, they would not need to purchase two different products and then integrate them. They can have a single agent doing two tasks.