What is our primary use case?
Deepwatch provides continuous rest monitoring, detection, and response to protect our organization from cyberattacks.
In our organization, Deepwatch's continuous monitoring and detection help us monitor logs from applications and infrastructure whenever there is suspicious activity. Unusual login attempts or malware are detected, which generates alerts and helps our team respond accordingly, ensuring security even outside business hours.
For our organization, Deepwatch continuously monitors our application whenever we deploy our application in the European regions, especially for another application in V4, which is a payment application gateway similar to PhonePe. Deepwatch improves the security posture by enabling faster threat detection and response, reducing the chances of any breaches that can happen.
What is most valuable?
Deepwatch offers continuous security watching, even when we are outside our business hours. We work here from 11 to 9, but after that, our application still needs to be monitored. Deepwatch functions as a 24/7 managed detection and response (MDR) with human-led SOC support. It provides continuous monitoring of systems, not just during business hours. The combination of human plus AI, with automated threat detection backed by security expert SOC analysts, leads to faster incident response, immediate alerts, and guided responses. The real impact is not just detecting threats; Deepwatch actively helps investigate and respond, significantly reducing the response time and risk.
Deepwatch has automation and human intelligence for real-time threat detection and response.
Deepwatch positively impacts our organization by reducing incident response time because previously, there was no mechanism to follow up on incidents, such as any security breach in the payment gateway. It has reduced response time by 40 to 60 percent. Threat detection accuracy has also improved significantly, with 24/7 monitoring even after business hours.
What needs improvement?
There are specific details that can be improved in Deepwatch. After implementing it, we tracked both response time and threat detection accuracy using the SIEM dashboard. We measured response time using MTTD and MTTR. There are areas that can be improved, such as every alert having a timestamp for detection time and acknowledgment. We observed the MTTR dropping from a few hours to under one hour after using Deepwatch, so baseline metrics can be enhanced.
Deepwatch can reduce alert fatigue since sometimes it generates a high volume of alerts that overwhelm our team. This can create too many alerts in a short amount of time, making it hard for our team to understand what to do. Additionally, the dashboard can be improved for better user-friendliness for end-users, requiring better visualization of MTTR, threat trends, and risk scoring. Improvements can also be made in more automated playbooks for automated response to common threats, and there is room for deeper integration capabilities, as integration with some internal tools may require additional effort.
For how long have I used the solution?
I have been currently working in my current field for the last three years.
What do I think about the stability of the solution?
Deepwatch is quite stable in my case.
What do I think about the scalability of the solution?
Scalability-wise, Deepwatch is excellent. We have grown from 10,000 users to 10 lakh users, and Deepwatch is still working fine for our payment gateway applications.
How are customer service and support?
Deepwatch customer support is excellent. We haven't used customer support extensively, but they do have a 24/7 helpline number and a feedback mechanism for paying customers, which is commendable.
What was our ROI?
I have seen a return on investment because, as I mentioned previously, our downtime due to security issues used to be two to three hours, but now it is reduced to under one hour. The MTTR is reduced by 40 to 60 percent. Incidents that previously took two to three hours are now resolved in under one hour. The impact includes faster containment of threats, reduced damage and downtime, and a lower need for a large security team due to not having to build a full 24/7 in-house SOC team. Additionally, detection efficiency has improved, with false positives reduced by 30 to 40 percent, alongside risk avoidance and hidden ROI from preventing potential data breaches, compliance penalties, and reputation loss.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup costs, and licensing was mostly positive. Pricing was subscription-based, with costs dependent on logs, data volume, number of assets, endpoint monitoring, and the level of MDR services. Pricing was somewhat on the higher side compared to basic tools but justified due to the inclusion of 24/7 SOC support. Setup costs involved moderate initial effort, which was manageable.
What other advice do I have?
My advice for others considering using Deepwatch is that if someone has an application where security threats are common, especially in regions with strict security compliance requirements in Europe, then Deepwatch is an excellent application to use. I would rate this review an eight out of ten.
