Check Point Harmony Endpoint Reviews

The solution should be able to provide next-generation security for endpoints and should be able to monitor, detect, mitigate, and block attacks, as well as provide complete visibility in terms of the chain of events so that forensics can be performed accordingly.

All of the security features should be provided on a single agent and it should be lightweight and should not have a performance impact on the endpoint.

Provide required/relevant logs on the console and also should be able to forward to the SIEM solution. So accordingly, a use case can be created. 

The agent should be tamperproof and the admin should not be able to shut down or stop services without the security team concerned, or by using a password.

We should be able to integrate and share IOC with other security devices.

The Check Point SandBlast solution, also known as Harmony Endpoint, is able to detect, block, monitor, and respond to any malicious activity that happens on the endpoint. With a single agent deployed on the endpoint, it's able to provide complete EDPR functionality, with help of multiple security features and modules.

This agent can be pushed either from the Check Point management console or by using other patch management solutions such as SCCM.

It is able to provide a consolidated security posture for all Windows endpoints on a single dashboard and also provide threat hunter visibility for any security threat on the endpoint, and able to mitigate the same. 

Provide capability of reproducing any security threat and also provide RCA/attack tree. 

File/hash can be swiped across the network using the security console, which provides visibility on the endpoint according to its priority.  

Harmony Endpoint provides complete EDPR functionality using multiple modules and features that are available with the solution. These include Compliance, Anti-Malware, Media Encryption, Port Protection, Firewall, Application Control, Full Disk Encryption, Remote access VPN, Capsule DOC, URL Filtering, Anti-Bot, Anti-Ransomware, Behaviour Guard, Forensics, Threat Emulation, and Anit-Exploit. This group of features is able to protect the endpoint from any next-generation attack. Any of the modules can be enabled or disabled based on the organization's requirements.

Harmony Endpoint is able to detect, monitor, block, and mitigate attacks on the endpoint and it builds and maintains relevant logs for later inspection. The agent sends telemetry/metadata to the centralized console for forensic purposes.

Policies for endpoints can be created based on the username or endpoint.

Integration with the Threat intel platform is helpful for blocking any attack at an early stage.

The complete solution can be hosted on-premises or SaaS on the cloud.

Remote access VPN is provided as default in the base license.

A different Policy Server can be configured and hosted at each location so that the agent does not have to reach a central location to receive policy updates. Policy servers are created using an OVF file, which can be installed on any Virtual Platform such as VMware.

It has secure communication between the Policy Server and the Management Console using Certificate/SIC communication.

The agent footprint is small on the endpoint.

It supports integration with other security solutions for sharing threat intel within an organization or over the cloud.

The anti-ransomware module is very strong; it's able to detect any ransomware attack at a very early stage.

Host-based firewall policy configuration is simple, which helps to access an endpoint if the machine is not in the organization's network.

The Threat Hunting module is not available for on-premises deployment.

The user has to connect using the VPN to take Policy Server updates when the solution is hosted on-premises. This adds overhead, as the user has to connect to the corporate network to get the policy.

In the case of a hybrid setup where the Policy and Management Server is on the cloud, the Sandbox appliance has to be on-premises.

Policy configuration and deployment are complex.

The application control and URL filtering features are not very strong.

Application Control databases are generated locally and it does not provide any visibility to the admin on which applications are installed on the endpoint.

The solution is supported only on Windows and MAC and not any other platform.

So far, the solution is stable.

The solution is scalable we can add multiple policy servers based on requirement and it will be integrated with the central management server (Primary/Secondary). 

In the case of the SaaS offering, it is managed by Check Point. 

Technical support is excellent.

We used McAfee AV but it was not able to provide the next-generation capability that we were looking for.

The solution required the Management Console and Policy server for initial setup and it can be increased based on the requirements.

We had assistance from the vendor during deployment and the service is excellent.

There are three different licensing models including basic, advanced, and complete, and it needs to be selected according to the endpoint. For example, it matters whether it is only required for a Windows endpoint as opposed to providing support for BYOD/Mobile devices.

We evaluated Windows ATP and CrowdStrike.

In case you want to set up the solution on-premises and you want to deploy multiple policy servers, it is complicated. You will need an OVF to be deployed at each location and sometimes, organizations don't have the compute or supporting platform for deployment.

Also, for connecting remote users there is a dependency on the VPN, hence it's again a challenge for users to connect to the policy server for updates.

With every new firewall that we're purchasing, we're deploying the SandBlast Agent. At the moment we're only running it on about 20 firewalls, just because the licensing isn't retroactive. What we need to do is produce a proof of concept to say, "This is the stuff we're getting." We're looking at it in a learning mode and then we can consider getting into a more aggressive mode of stopping everything. At the moment, we're trying to use it to give us information rather than to fully stop everything.

It's deployed on our physical firewalls, on-prem.

We have seen some attempted ransomware in our network. With the firewall we've already got IPS, but we wanted to integrate the endpoints into that as well. That's something we are seeing. Our IT risk team are getting those reports and seeing them and seeing fewer potential attacks.

It reduces potential downtime through ransomware by reducing risk. I don't think I would go to the CEO and say, "Hey, we've completely eradicated this and that," but it certainly complements other Check Point products that we have. It gives us some more information about what is happening and where it's happening on the network, on-prem, on the applicable firewalls. It's hard to say exactly what it has improved because it just works very well with what we've got. Certainly, with our Windows environment and our VPN, we do see a lot more. But I don't know if there's just more of a focus on the reporting, as a whole, that we're getting.

We have had previous ransomware attacks, and while we can't necessarily quantify any downtime or loss, there certainly was risk around that. This has reduced our risk in that environment. That's one of the big focal points. From a network operational point of view, could you ask, "Well, has it reduced things?" and the answer is "no," but from an IT-risk point of view, our IT risk team have certainly seen less impact from attacks. We're more proactive than reactive, compared to how we were doing things before.

We don't see it leading to a reduced number of security engineers. What we do envisage is information and empowerment. Rather than manually having to check this, that, and the other, we're looking at having these tools available and for them to produce actual results. We definitely see this tool helping us do that.

It's pretty complete for preventing threats to endpoints. Its capabilities are great.

The solution's automated detection and response capabilities are pretty good. It really depends on how aggressive we want to be with it. We've not deployed it in the most aggressive way you can, such as shutting down everything, because we've not deployed it in a greenfield site. It has not been deployed with that in mind. It has been deployed as an add-on service. As such, we don't want to be as aggressive as some top security firms would recommend we should be.

We do like the product, although there are quite a few things that we're asking our Check Point account team to enhance, where we think we probably could get more features from it.

We use a couple of Check Point products, like SmartEvent, and SandBlast Agent is not really integrated into that. We haven't gotten the reports working yet. We are working with the account team and trying. As I said, it's still relatively new in terms of what we're trying to achieve. We probably should have had more Professional Services come and help us. But, from our company's point of view, especially at this time in the market, the finances are just not there. But from what I've seen so far, I don't think there's enough integration into SmartEvent. That's something that I've asked our account team to try to focus on in the next versions or as an enhancement request.

Integration and deployment are probably the weakest points, and maybe service as well, although they are still at the high end. Would we go out to market and buy this on its own? Probably not, is the honest answer. But because it is a Check Point product and the licensing comes as part of it, it gives us this time to go and prove that, when it's together with all the other products that we have from Check Point, it certainly integrates very well. Would I go and buy this just as a standalone service if we didn't have Check Point firewalls? Probably not.

We're relatively new to Check Point SandBlast Agent, once they put it onto their firewall platform with the new environment. It comes built-in for the first year, including the cost. We've sampled it, starting about four months ago.

We had seen it work before. We had demos with it, but it was always something that seemed would be a nice feature to use, but not something the business wanted to buy into, per se. Now that it comes as part of the package for the first year, we thought we'd give it a go and see how it gets on.

I've had no problems from a stability point of view. It just seems to work.

It's definitely scalable. It's whether there is a business appetite. When we get a new firewall, we'll enable it and run it through the service. It's scalable to retrofit. We could do that and we could run that very easily, but that would involve a commercial spend, which at the moment, no one wants to do. We understand that, but the solution is certainly something that is of interest to various people.

If we get approval then it will move from a PoC to across-the-board. At that point, there would be between 100 and 200 people using it and thousands of agents. It could be scaled out to our whole organization. Again, it's funding-dependent.

We have Diamond Support, so it's very good, but we pay for the privilege. We have one engineer and a separate TAC team.

We had a solution but it wasn't really a similar solution. This is the first of its kind for us, for what it does. We do have antiviruses, so that the machines aren't just dead, and we do have our own hybrid package of something that, if you add four of them together, maybe adds up to half of this, but no similar package.

It's relatively easy to set up. There's plenty of documentation out there for how you do it. The way we've done it is probably the easiest way of doing it. We're not going all-out. We've gone with a small approach, mainly due to commercial reasons.

Our implementation strategy is just to switch it on in our new firewalls and see what happens, honestly. That's not always the best approach, but we switch it on in learning mode to give us information on what's out there and to see what we didn't know.

It took us about three weeks with the first two firewalls, and that doesn't include the firewall build time. That's just setting up everything else and the integration piece. There were two of us involved, me and a colleague. There were "dotted lines" into others, such as our IT risk team where we were asking, "Hey, is this what you want to see?" We're not really offering it as a full service, it's a PoC. If it goes live with a view to deploy it to all of our firewalls and all of our endpoints, I wouldn't say we would need any more people. It would be part of our operational team. The same is true for the risk team. I don't think we would need to get more people, although we see the IT risk team having more of an input.

We did it ourselves.  Potentially, if I had an open wallet and a blank cheque book, would we use a third-party? Yes, of course we would, but at the moment that option is just not there.

Return on investment would be not being attacked. Have we seen any? No. Has it identified certain things? Yes. The way we've got to look at return on investment is, all of a sudden we're less vulnerable to attacks. That's a hard measurement to define. Ultimately, not being attacked, and our reputation, is worth a lot more than just a dollar figure.

The cost-effectiveness of SandBlast is knowledge and understanding what is happening on our network. Do we have some infections? Are we seeing certain things which, without this tool, we would be exposed to? Yes, we are seeing that.

Licensing comes free in that first year or is included in the base package. From a commercial point of view, it really just is the renewal cost, rather than a one-time fixed cost or buy-in. That's for new firewalls. For existing firewalls, we haven't even gotten to that point yet. They don't even want us to look at the pricing. First, we need to think about what the product does. Does it do what it says on the tin? And if it does, then it's a commercial thing. We have quite a good commercial model with Check Point, so we don't really need to worry about that too much. The pricing should be good.

The licensing, the way they've changed it, is a positive and a negative. Ultimately, Check Point has changed how it operates and now we have to go back and retrofit.

If this does everything it says it does, I don't see any reason that we would use a different product, because this integrates so well with existing Check Point products.

What we've gained is more of an understanding of what's on our network. If I were to go and do this again from scratch, I probably would have looked to integrate more with our Check Point sales team and would have gotten more help from them.

My advice would be to involve your SE. He can help you through a lot more of the options when you deploy.

We don't use the solution’s Management Platform for the creation of virtual endpoint management services in the cloud. We haven't got to that cloud point yet. It's something we could do, potentially. We're going to work with our account team about that. But that's the one of the lessons learned: We did it by just playing around with it rather than doing a full deployment.

I would rate it at nine out of 10. What comes to mind is its effectiveness. Normally, I don't get involved in the costing too much. Is it doing everything that it said it was going to do? Yes it is, at the moment. Could it be enhanced more? Sure. But we have a relationship with Check Point and they do deliver on the RFEs for us. If we say we want it to do this, they'll get their engineering team looking at that.

My primary use case for Check Point Harmony EDR would be to get broader visibility in the environment. For instance, a pre-detection was done by Check Point Harmony when there was an attack happening. It pre-detected and remediated immediately before it got spread in the environment. The best part is the system was not in the office network but still got detected and remediated automatically.                                                                                                     

The insight and visibility of the detection is good.  

As such there is nothing I can think of additional features.

The services of EDR consumption should be reduced and the support needs to be improved.

I have using Harmony for the past two years.

Stability is impressive.

Scalability is good.

Support is good.

Positive

The setup was straightforward.

The implementation happened in-house team.

The licensing and costs are good. 

Our company uses Harmony Endpoint for encryption and encapsulation. Our clients use it for data encryption.

The most valuable feature is Harmony Endpoint's encapsulation system which captures the whole system and protects it against other functions. It is really good for the Check Point Harmony specialists.

In terms of improvement, the ticketing system could be better.

I have been using Check Point Harmony Endpoint for about three months. 

In terms of stability, I would rate it an eight out of ten.

I would rate the scalability of the solution a solid eight out of ten. It could be slightly improved. Approximately 1000 people use Harmony Endpoint at our company. The maintenance is done once a week by a team of three engineers.

In the Harmony series, the products are linked to each other. It is a little tricky when you try to open a case and give it to an engineer because, in our custom environment, we have to access it from their devices. For example, in Harmony Mobile, their Android or iPhone devices have to be used. All of that takes time and it would be good if Check Point could find a better solution to this and create a feature to help us collect logs for the cases. I would rate the support a six out of ten.

Neutral

I'm currently working with Cisco Secure Endpoint and Palo Alto Cortex XDR. 

We use both the cloud and on-premise solutions. The initial setup is simple and creating a profile with the agents is easy. We only create agents and direct them to versions of the agents while we integrate them with the process. It only takes about five minutes to deploy one mission.

We have seen good results with the solution. If it is used with Linux or Mac, it provides better performance.

Check Point Harmony Endpoint is a subscription-based solution and the pricing is quite reasonable when compared to other solutions on the market. I would give it a nine out of ten in terms of affordability.

My advice to people who are considering using Check Point Harmony Endpoint is to be careful of which version you choose while deploying the solution. You should get the recommended versions for the agents. Otherwise, there will be a lot of problems and soft ticketing. Overall, I would rate Harmony Endpoint a seven out of ten.

We continue to offer our support solutions to other companies as requested. I focus on cyber security, specifically specializing in detecting malware in text and searching for remote access or reverse channels on computers.

This software incorporates security AI features and effectively manages bandwidth with its DRS capabilities. However, there's still room for improvement and the addition of more features. Nevertheless, in the broader market landscape, it's considered one of the leading products. While there might be some competition from others like Cisco, it remains a strong choice. The feature lies in mapping and providing top-notch malware protection.

Perhaps the software could be made more resource-efficient. While many improvements come to mind, I don't have them readily available. Essentially, I aim to enhance the software's efficiency so that it places fewer demands on computer resources.

I have been working with Check Point Harmony Endpoint for the past two years.

It is a stable solution and I would rate it seven out of ten.

It isn’t very scalable since I wasn't able to bypass the security a couple of times. I would rate it a six out of ten. 

I would rate it a six out of ten because it could have been easier. It might be somewhat challenging due to the numerous policies in place. For instance, it's more straightforward for me when users can easily set up policies because they come built-in. However, with Check Point, you do have the option to create custom policies. I'm not entirely certain if it's a strict either/or situation, as there might be some flexibility. Nonetheless, having a predefined "zero one" option can make it easier for users, as they don't necessarily have to customize policies themselves.

The deployment takes long enough.

Currently, this software stands out as one of the top choices in the field. It's undoubtedly a strong contender for enhancing computer security, and while there are various other products available, this one ranks among the best.

I recommend the solution, but I would rate it a six out of ten, mainly because the software requires considerable resources and can strain less powerful computers. It tends to impact system efficiency, especially on computers with weaker hardware, causing frequent restarts and putting a significant load on the CPU and memory.

We use Check Point for ransomware protection. It provides standard endpoint protection. 

We need ransomware protection and that's what we get. It's a very good and robust antivirus solution.

As with most antivirus products, the reporting and management could be improved. 

I've been using this solution for one year. 

The solution is stable. 

The solution is scalable, we have a few thousand users. 

We haven't had any issues with the technical support. 

I previously used Symantec and McAfee depending on the requirements at the time. There's not much difference between all the solutions in this area. It comes down to how manageable they are and how frequently false positives exist in that environment and whether they slow down the transactions or the processing of the machine. 

The initial setup is fairly straightforward, deployment takes a few minutes. It's just a matter of setting up the server, your policies, and pushing out the agents. 

Our ROI has been from an operational perspective. If you're not fighting with a product every day, it saves you time and money. 

Licensing costs are usually paid annually or every three years. This is not a particularly expensive solution. 

I rate this solution eight out of 10. 

The implementation was really easy. We were able to activate the antivirus blade and install it on the computers we required. In this way, we were able to provide security for malware protection - all represented by Check Point Security Management.

It was required to expand or have the license to use the antivirus security utility. A point that cost us at the beginning was implementing the licenses in the management server however, once up and running, it was easy.

It is an old brand that has all the anti-malware protection, signatures, and revisions to avoid vulnerabilities.

Our organization teams used a Microsoft-based antivirus. However, we already had Check Point gateways in use. We wanted to unify the protection more, and we tried the use of Check Point Antivirus. We really have no complaints. It offers good anti-malware protection and ransomware, among other modern threat protection features. The installation of the equipment was easy, and we achieved the main objective of unifying the protected environment.

We currently use Check Point Management R81, which is one of the most complete versions.

The logs and monitoring are valuable features. It generates enough visibility in terms of what happens on our equipment.

The sandboxing validates some files that have threat qualities. 

We like this security tool.

Check Point is one of the best security brands according to the Gartner quadrant. However, it needs improvement in some areas.

We would like to see better guides in the future with more concrete examples of the best practices.

The support is somewhat complicated. Sometimes they take a long time to solve problems. The language barrier is an issue for Spanish-speaking people. 

Support hours are generally contrary to the hours in Latin America. They could expand the support more and have more trained and effective technical personnel to help customers.

For at least eight months, we have used this solution, which greatly facilitates our security. It is an antivirus implemented through Check Point Gateway R81.

Previously, we used a Microsoft Antivirus. It's not bad. However, we wanted a tool integrated with our Check Point technologies, and therefore, we validated the options to make the required changes.

It is important to assess and verify the costs of Check Point technologies with an expert vendor to help determine the technology and tool that can meet the specific business needs of each company.

The documentation is outdated. However, if it is validated well, it is possible to obtain what is required for the implementations.

At the level of antivirus, we looked at Sophos and McAfee. However, the implementation most adopted in our environment was Check Point. We are convinced that it was the best option.

The product is an easy-to-implement and centralized antivirus solution. I recommend it.

Check Point Harmony Mobile was provided through an installed agent which has very light protection against malware and ransomware, among others. 

In our country, many ransomware threats have been generated at the country level, for which it was worrying that we had kidnapping or encryption of our data. At the management level, the request was given to provide additional security to protect us. The tool has been very good.

We tested this Check Point tool to assess the performance of our endpoints, and shield them safely while increasing the protection of our platforms.

Our company wanted to provide an additional layer of security for our endpoints. We already manage Check Point with different tools, We have done very well with them and we have validated how Check Point Harmony Endpoint works to protect our endpoint equipment. So far, it works quite well.

We have seen the reports of attempted attacks and we have been able to provide a solution to these vulnerabilities. There is less malware in our infrastructure.

Its characteristics are quite good.

The characteristic that most attracts our attention is the administration portal. It doesn't require a management server since its licensing and management are through the Check Point Infinity Portal. It is very intuitive and easy to implement.

The way in which the agent is installed on the computers is very easy, it does not consume almost any performance of the server or final computers, in this way there is no need to worry about increasing resources to be able to protect them with Check Point Harmony Endpoint.

We love the reports and monitoring they provide. It helps us quickly see what vulnerabilities we have on our endpoints.

We have few disadvantages or improvement points. However, the Infinity Portal sometimes requires more performance. It is a small detail. However, it could be improved.

On the other hand, it is also essential that the manufacturer improves the public documentation so that users can better understand how it can be implemented with best practices.

Finally, at the support level, we believe that Check Point can improve. Sometimes the answers are provided at dawn, which makes it more challenging to solve.

The solution is a very good security tool. It was used this year at a test level and everything works very well.

Previously we only had or used Microsoft's antivirus or endpoint, however, we had all non-centralized security. Through this tool, we can centralize everything in the Infinity Check Point Portal.

Licensing is per endpoint, which is why we think is good. The cost is competitive, and its features are very good.

We validated several manufacturers, however, we did not want to have separate solutions. It seems to us a better option to have only Check Point.

I recommend this security tool, it is always important to test the tool at the test level to decide if it is what you are looking for.