Forcepoint Data Loss Prevention Reviews

For our clients, the use of Forcepoint Data Loss Prevention is to protect their data through web endpoints.

Endpoint security and DLP are the features I have found to be the most valuable ones in the solution.

The solution's interface is still not user-friendly for some customers. So, its interface can be better.

We have a partnership with Forcepoint. Also, we are selling Forcepoint Data Loss Prevention. Basically, we are resellers. I have been working with this solution for the last two to three years. I have been using the latest version of the solution. Currently, my colleagues are using the solution.

Stability-wise, I rate this solution an eight out of ten.

Scalability-wise, I rate this solution a nine out of ten. We serve enterprise-level customers.

I rate the technical support of the solution to be an eight out of ten.

I rate the initial setup of the solution nine out of ten. The solution's deployment time depends on the customers' requirements. It also depends on the environment of the customers. If the customers have a deployment tool, the deployment will be done quickly. Else, it will take some time. To deploy the solution, we provide the customers with a technician to assist them. After that, the customer is responsible for taking care of the people they need for any additional assistance.

We do not handle pricing ourselves. Our pre-sales and sales teams are responsible for pricing. After deployment, the engineer involved in the deployment also assists with pricing.

From one to ten, where one is low, and ten is high, I rate the solution's pricing to be an eight.

Also, there are some costs in addition to the standard licensing fees.

Its availability as an on-premises solution is something that I like most about the product. Overall, I rate this solution a nine out of ten.

The solution has a lot of use cases. 

In our case, it was to protect content based on keywords and typical actions like copying to external devices, printing, or taking snapshots, et cetera. 

It has helped us protect our internal data from external threats. It ensures no data reaches the outside via intentional or unintentional sharing of data. 

The email-sharing capabilities are good. We can watch email sharing based on content, keywords, key phrases, et cetera.

The initial setup process went well. 

It is stable.

The solution is scalable. 

I'd like the data classification to be better.

I worked with the solution previously and only just started to use the product again. I've used it for about a year and a half.

It's a stable product. I'd rate it eight out of ten. This is a highly reliable solution. We haven't had performance issues. 

The scalability is pretty good. I'd rate it eight out of ten in terms of growth capabilities. 

We have more than 7,000 people on the solution right now. 

I'm currently not using it, although I have been. I'm not sure if there is a plan to increase usage.

We have used McAfee DLP also.

It is straightforward to set up. It's not difficult at all. I'd rate the ease of setup eight out of ten.

The deployment process took us about two months.

We only needed two people to handle the deployment and maintenance tasks. 

The deployment was on a third-party server. We handled the deployment itself in-house using our own personnel. 

I have not seen an ROI. However, it is worth the money we've invested in it so far.

I'd rate the pricing seven out of ten. It's moderately priced and not too expensive. We pay an annual subscription. There are no hidden costs. You just pay one flat fee.

I did look for various advanced switches and other advanced features and chose this product.

I am a partner. 

I'm not sure which version of the solution we're using.

I'd recommend the solution to others. 

Overall, I would rate the solution eight out of ten.

We primarily use the solution for data loss prevention.

The good side of the Forcepoint DLP is integrating with the end user behavior dynamically. 

The formation level defining a DLP has become a very static form. In the case of Forcepoint, if it is possible to implement it, they integrate with the end user behavior analytics and then dynamically can run which documents should go to home. This is the most fascinating part.

The integration is great. It's good for dynamically assigning the volume and dynamically blocking some points based on the behavior change.

The most challenging part of DLP is the categorization of documents. Most organizations take the parts and the products, and then finally, the phase is difficult to categorize their product, and these are all very static.

The deployment can be difficult. 

It could be priced a bit lower.

I've been using the solution for two or three years. 

It is very stable. There are no bugs or glitches. It doesn't crash or freeze. 

I can't speak to the scalability. It's not an aspect that I've extensively tested.

Technical support was fine. They were well trained and knowledgable. 

I started with Forcepoint only. I have never used any other solution.

The deployment may be a bit difficult. 

We only need one or two people for maintenance and deployment tasks. 

We implemented the solution ourselves with the help of technical support. They had people that were trained in the prcoess.

The pricing is moderate. I'd rate it three out of five in terms of affordability.

We are Forcepoint partners.

I'd rate the solution eight out of ten. It's a pretty decent product in general. 

The most valuable feature of this solution is that it captures where the data is being moved.

Forcepoint is the one I see most frequently mentioned in a lot of webinars or insider threat discussions. 

It is a product that is commonly referenced.

Everything takes a long time, as it does in every software company, especially since COVID. That is something I notice with every product I use.

I have been working with Forcepoint Data Loss Prevention for three years.

We are working with the most up-to-date version.

Forcepoint Data Loss Prevention is a stable solution.

Forcepoint Data Loss Prevention is scalable.

It is widely used throughout the business.

Response time is slow.

The initial setup is typically straightforward. 

It is unique to every environment. Some things break when you set up a new network or system. It's trial and error.  

Compared to other products, it wasn't overly complicated, It is the same or standard.

I would rate Forcepoint Data Loss Prevention a seven out of ten.

It is a good product. 

I am not overly excited about it, but I believe that all of the software has the same issues that I do.

It is the same problems I have had with other software, such as the customer service being slow, something breaking, or there's a patching issue. 

Forcepoint DLP is a part of a data protection program. A customer will rely on a main DLP and use a complementary tool, in addition to the DLP, such as a data classification solution like Boldon James or Microsoft Information Protection. They will also complement the solution with a rights management solution like Microsoft Rights Management. Forcepoint is part of a big portfolio for data protection.

We deploy the solution at customer sites. Most of our customers are in two sectors, financial and telecom. All of our deployments are on-prem.

Among the most valuable features are the

• network DLP, which has two components 
• DLP agent installed on endpoints
• discovery, as it covers the endpoints and shared folders on servers. 

These features are important for control. A main part of DLP is its use as a tool that provides different layers of controls.

The Forcepoint tool is well developed. It is ranked in many evaluations at the top when it comes to enterprise DLP solutions. It has good artificial intelligence that enables our customers to focus on specific incidents, instead of having a complicated list of uncategorized incidents.

There is room for improvement regarding OCR. I would like to see it enhanced to handle multiple languages and it should be easier to manage.

There are also options that could be handled smartly in the tool, like the way a web data source is handled. It would be good if any downloaded document could have the same policy.

I've been using Forcepoint Data Loss Prevention for three years. We are not regular users, we are admin. We provide the solution for our customers.

The stability is good. Issues are generally related to the agent. Whenever the agent is stable, the solution is stable. Whenever there are issues, it is common for them to be connected to the agent, making the solution unstable. Based on our experience, the stability has not been very good, but it has also not been bad.

We have implemented the solution on anywhere between 1,000 and 10,000 endpoints.

We get good feedback regarding the support. They respond well and provide support whenever required. They are aware of their product in a professional way. And whenever we escalate to the highest level, we get to a suitable person who can provide us with what we require.

One thing that could be improved is that escalation could be done faster.

Neutral

I have seen Forcepoint replace Symantec or McAfee in some cases. I haven't seen any cases where a client wants to replace Forcepoint.

A mandatory process that should be done before implementing the tool is a data classification analysis and the setting of a policy for data classification. These processes are done through an analysis session with different departments. The session includes teaching them about data classification policies and getting information from them regarding the data that needs to be protected and the recommended classification level that data should have.

We then deploy the server-side in the data center and start installing a sample agent. We test this agent and we test sample policies to ensure everything is okay on the sample agent. Finally, we do a full deployment.

Maintenance, post-deployment, involves making sure the solution is updated to the latest version. It has different components, and each component should be updated to the appropriate version. The same goes for the agents on the computers. The configuration should be reviewed and maintained over time, as well. One person is enough to maintain a Forcepoint instance.

As a partner, we have seen ROI with Forcepoint. We cover our costs through licenses, implementation services, and SLAs in which we support our customers and help resolve their issues whenever they want to open cases or adjust configuration.

They are flexible regarding the pricing and they have a good model for an OEM data classification tool. This makes for good pricing. Forcepoint has been one of the most competitively priced products over the last few years.

Overall, Forcepoint has good strategy and development. It is stable and has not changed as a company for a long time. It is focused on a specific solution and that makes for a good portfolio.

We are a solution provider and Forcepoint DLP is one of the products that we implement for our clients. We have Forcepoint DLP at one of the telcos and one of the things that we are trying to discover is information, across the organization, that is of a personal nature. We are using it to comply with POPI, which is the equivalent of GDPR in South Africa. We are also using it for PCI-DSS requirements. This discovery component works quite well with respect to the search.

When we deployed it for a bank, it proved highly efficient in terms of PCI compliance. It was very quick to pick up where people were divulging personal information regarding credit card holders. We then deployed very simple rules that we had customized, without the need for data classification.

Initially, if you were just doing PCI-DSS, because it's very limited information that you needed to protect, you could do it without data classification. This was good for an organization that had data to protect and wanted to comply with PCI-DSS, but had not done the data classification at that point.

The rules that we put into place were simple. For example, if more than two credit card numbers are being pushed out then block it, or first put it into monitoring mode and then block it.

One thing that I really like is that you can customize the rules. 

The challenges that we've had are related to deployment, especially around the discovery component, and with the local support that we receive in South Africa.

With respect to the discovery component, the reports are very hard to interpret because they come out in an illogical format. We forwarded the reports to our local support team, who were also unable to help me. Eventually, the problem went to the UK for that team to interpret the report.

Ultimately, my biggest challenge is the discovery component with respect to the reports, as good as it is in terms of the integrity, or the search. It is a question of how you translate technical reports into business language. We tried the cloud version, which is Forcepoint CASB, and we found the same thing.

The local support team is made up more of salespeople than engineers and as such, the support in South Africa can be improved.

My experience with Forcepoint Data Loss Prevention goes back to 2005 when it was still called PortAuthority. The product has evolved massively since that time. I have deployed it and worked with it for different organizations at different locations.

Initially, it takes a little bit of processing but nothing to be too concerned about. Stability-wise, nothing has really annoyed us. 

The scalability is fantastic. One of the things that I like about Forcepoint is that I can customize the solution to suit my objectives. For example, if I only wanted to prevent PCI then I could just go in and do that.

One of my clients has quite a large deployment, with approximately 30,000 users. They have plans to roll it out to the rest of Africa.

Technical support from the UK is good. However, the experience of local support in South Africa is not at the level it should be. Most of the local staff are salespeople, as opposed to engineers. Support for the deployment of the product is seriously lacking.

In the UK, they were much more knowledgeable about the product, as well as the outputs and how to actually read them to make business sense out of them. It was much better than what we had in South Africa. Locally, they simply said that they didn't understand it. Most customers will shy away from products when the support is like this.

Because they answer the phone, I would rate the local support a two out of ten. The European support was better, so I would rate them a five out of ten. There were delays in their response but I'm not sure if it was related to the difference in time, or it was part of the ticket escalation process.

One of our clients was using the Symantec solution prior to Forcepoint. We convinced them to switch because Symantec does not have a great presence in South Africa and support was an issue.

They had been using it for quite a long time and had not seen the necessary return on investment. With the new legislation, it was time for them to change to something that was more practical, and more user-friendly. The product works great now.

The implementation is not as easy as people make it out to be. Once you get it right, the product is fine, but this requires understanding it and getting the proper training. A novice that has begun to work with the tool can find it quite difficult to implement if they don't have a good understanding of the product, and do not have the right support.

For example, in one organization it took us about three months to implement it, whereas it should have taken about a month.

Our clients have hybrid deployments, where they are part on-premises and part cloud. The choice of cloud provider is made by the client but they either choose Microsoft Azure or AWS.

The implementation strategy that we use varies depending on the client. For example, at the bank, we wanted to prevent data breaches, especially with credit card information, and ensure compliance. Therefore, our strategy was focused on just the PCI requirements so that we could take reasonable measures to protect the organization. Essentially, we wanted to go from zero to hero quite quickly. That was possible because of the flexibility and agility of the product.

When it came to the telco, it was a completely different strategy. It was a long-term strategy in terms of protection of personal information and preventing it from being divulged without authority to would-be criminals.

When we deployed it, we literally had to look at the requirements and configure it from a POPI perspective. In this regard, the deployment was skewed toward personal information breaches.

We worked with a local reseller, Performanta.

Their skills were meant to be the best in the country but it left a lot to be desired. We had to use the UK offices and that's a challenge with most of the organizations in South Africa. With big vendors, South Africa is a small market, so the investment in South Africa is not what it should be. Understanding, managing, and integrating products needs to be improved, in general.

For deployment, there were eight of us in total. Two were engineers, there were four analysts because we had to write the business rules and document them, there was a project manager and a few others.

Maintenance is being done by the client, in-house. They have two engineers that are responsible for it, and they have purchased support from the local providers.

My clients are seeing ROI because the privacy office is quite comfortable now that they've done everything reasonable to meet the compliance requirements. There is a level of assurance provided by the DLP solution.

In terms of pricing, it is good for a corporation but they do not cater to small to medium businesses. They have to look at a different pricing structure for small to medium-sized enterprises because the cost is too high.

This is compounded for the African market because of the exchange rate. One dollar is equal to approximately 15 rands and if you were to multiply that by the price of the product, it becomes quite costly.

There are no costs in addition to the standard licensing feed, although you still need to understand the operational impact that it has on an organization from a resource perspective. That needs to be factored into the total cost of ownership.

We compared Forcepoint with NetSkope to assess its reporting capabilities and we found that the NetSkope report was very easy to translate, understand, and explain to a business. Forcepoint was instead very cumbersome, unstructured, and illogical. It required an expert to actually interpret the report, which is something that you don't want.

We have also looked at the McAfee product, as well as the one from Microsoft. At that stage, the solution from Microsoft was a little immature and I have not looked at it since. Forcepoint was the leader when we implemented it for our clients.

Comparing Forcepoint to the other products in general, the data discovery capability was great, except for the interpretation of the report. The OCR capabilities were also good for us because it's a telco and they have a lot of paper going through. 

The tool works great but they don't talk about the operationalization of the tool from a process perspective. When people sell DLP solutions, they talk about the efficiency of the tool, but they don't talk about the impact that it has on an organization from a resource perspective.

You would need a team to analyze all of the exceptions that you have, like the way they do in a SOC, where you have analysts looking at the incident. They analyze and investigate it, and then determine whether it is positive or negative and something that we have to be worried about. For example, our organization had approximately 70,000 end-users, who were employees. There is quite a large amount of data that is transferred across our network.

In our case, if a person is sending more than one credit card credential out of the bank, it was flagged. If it was more than one, you had to have a whole backend process where the analyst had to look at it, then perhaps ask the person why they were sending out this information.

When we were first looking at this product, there was nobody who informed the customer as to the complete ecosystem that would be required to have an effective DLP solution in play.

My advice for anybody who is looking at Forcepoint is that they need to understand what it is that they are trying to prevent. You cannot be totally dependent on the tool to do everything. This is not a criticism of Forcepoint but rather, a criticism of the way it's sold. The product will do what it's built to do. But, if you're expecting it to automatically manage the incident, then it cannot do everything. It can block, it can monitor, and it can create alerts, but you still need your analysts. For most CSOs or IT managers that are looking to deploy, they must factor in the practical implications of operationalizing it. They need to have a process in place. They need to have an escalation process in place, and they need to have resources like analysts to actually look at the exception reports.

This is an effective data leakage solution, it does what it's meant to be doing, and the interfaces are great. The biggest lesson that I have learned from using it is to understand the total cost of ownership.

I would rate this solution an eight out of ten.

We are using it for PCI compliance.

One of the most valuable features is the set of built-in policies that Forcepoint has for PCI compliance. We just need to activate them and start working. Without them, it would be a big task to do a data transformation. Another advantage is that Forcepoint also updates these policies. If there is a new control for PCI compliance, Forcepoint updates it in its system and it can be downloaded.

Forcepoint is also easy to use and manage.

The reporting features, the real-time reporting, can be improved in Forcepoint. On the dashboard, we don't have a feature that shows real-time incidents. We have to schedule a report in the environment.

I have been using Forcepoint Data Loss Prevention for two years. I am a partner for Forcepoint and Symantec. I suggest DLP solutions to my customers.

Forcepoint is very stable. Symantec is also very stable.

Forcepoint is quite scalable. If we have more network traffic, we can add an appliance and it will be enough for that increased traffic. It scales up.

The number of users in environments where we have deployed Forcepoint is between 5,000 and 7,000.

I would rate Forcepoint's technical support at eight to nine out of 10. The support has separate sections, including essential support and basic support.

The initial setup of Forcepoint is straightforward. It uses a Microsoft SQL database and the solution is implemented on Microsoft Windows Servers. When it's based on Microsoft, the solution is very integratable. Optimization of the installation is not complex. It is just like installing other software on Windows. We just need to learn the setup process and click some tabs and the solution is installed.

In general, the initial setup of the different components of Forcepoint takes only two to three days.

Our process is that we first install the database and then we install the Forcepoint Security Manager, which is the centralized location for policy management and reporting for all the solutions' components. Then, if required, we install the additional Security Manager. It is straightforward. Next, we implement the DLP on the endpoints, and then we work through the network side.

One of our recent deployments of Forcepoint was for a bank that has requirements for PCI compliance. In terms of what they invested in the solution, they got the value back within a quarter.

The licensing of Forcepoint is quite straightforward. It's based on the number of users. The support fees are a separate cost.

The main functionality of both Forcepoint and Symantec is actually the same. But when it comes to deployment, Symantec's solution is difficult to deploy. To deploy Forcepoint I only need three Windows servers, but to deploy Symantec DLP I need eight Windows Servers.

With Forcepoint, we can take backups automatically from the appliance itself, using the Security Manager, in case of disaster. We just schedule a backup job and it takes the backup from there. But with Symantec DLP there is no feature for backing up and we have to do the backup manually.

But for larger enterprises, Symantec provides an Oracle Database where there are no limitations for keeping incident data in the database. Forcepoint uses a SQL database that can't hold as much data. Large enterprises often use the Linux operating system for their core applications. Symantec fully supports a Linux implementation of the core architecture of PLP in a Linux environment, but Forcepoint is only installed on Microsoft. This is one of the biggest factors for larger organizations, given that they often require a PLP solution.

If an organization is small or medium in size, I would deploy Forcepoint for it. The price and the architecture requirements, and the equipment required for small and medium businesses, is reasonable. For large enterprises, with more than 20,000 users, I would deploy Symantec.

The primary use case is to protect sensitive data going out of the organization and helping the team to manage the incidents to create few to no false-positive incidents. 

Mac users can use Forcepoint DLP without any problem. They can create user-defined policies rather than using pre-defined ones. Using the fingerprinting policy can safeguard any data kept on a particular drive. We're using OCR to protect data being sent out through images implementing discovery policies to check if any particular file is been shared.  

The Forcepoint DLP is such a useful tool for organizations as it protects sensitive data with multiple kinds of functionality such as OCR and an analytics engine (which helps determine if any sensitive data is in danger of policy violations). It's easy to determine the incidents that have been triggered. This has helped to identify what sensitive data has been shared. The only part where it didn't work so well is during agent upgrading. If we automatically try to upgrade the agent it causes a lot of problems.

With OCR and Risk Analysis, we are able to determine if anything sensitive is been shared. OCR helps us to safeguard those things and with risk ranking, we can determine which user is trying to violate policies multiple times even though they have been blocked to him or her. It does require additional servers, as the processing and result of the incident is high, however, it's worth using to see all the use cases being met with these two features as well. They are the best features provided by Forcepoint.

The feature which needs improvement is the Forcepoint agent upgrading. When you automatically try to upgrade the agent it causes problems. For example, the system starts to behave abnormally or the agent is unable to communicate with the policy engine. If we try to upgrade to new version with the old version running, sometimes it works without any issue, but sometimes it causes a lot of issues and it gets disconnected from the DLP servers. 

You can see incidents via delays on the console even if the agent is properly installed and connected with the proper policy updates.

I've used the solution for two years.