Forcepoint Data Loss Prevention Reviews

The most valuable feature of this solution is that it captures where the data is being moved.

Forcepoint is the one I see most frequently mentioned in a lot of webinars or insider threat discussions. 

It is a product that is commonly referenced.

Everything takes a long time, as it does in every software company, especially since COVID. That is something I notice with every product I use.

I have been working with Forcepoint Data Loss Prevention for three years.

We are working with the most up-to-date version.

Forcepoint Data Loss Prevention is a stable solution.

Forcepoint Data Loss Prevention is scalable.

It is widely used throughout the business.

Response time is slow.

The initial setup is typically straightforward. 

It is unique to every environment. Some things break when you set up a new network or system. It's trial and error.  

Compared to other products, it wasn't overly complicated, It is the same or standard.

I would rate Forcepoint Data Loss Prevention a seven out of ten.

It is a good product. 

I am not overly excited about it, but I believe that all of the software has the same issues that I do.

It is the same problems I have had with other software, such as the customer service being slow, something breaking, or there's a patching issue. 

We are customers of Forcepoint and I'm a senior information security engineer.

I like the encryption feature of this solution as well as the proxy aspect of it. 

The deployment and troubleshooting aspects of Forcepoint are very difficult. Implementation is complex and not user-friendly. In addition, we have a problem because our Mac systems are not able to support Forcepoint which requires us to have two softwares to make it work. 

I've been using this solution for one year. 

The solution could be more stable. 

The solution is somewhat scalable but could be more so. Our whole organization uses the product, we have over 20,000 users. We have at least 10 staff involved in maintenance.

Technical support is good but lacking in troubleshooting skills when it comes to Forcepoint. 

The initial setup is straightforward. 

Licensing costs could be cheaper. 

I rate the solution five out of 10.

We are a solution provider and Forcepoint DLP is one of the products that we implement for our clients. We have Forcepoint DLP at one of the telcos and one of the things that we are trying to discover is information, across the organization, that is of a personal nature. We are using it to comply with POPI, which is the equivalent of GDPR in South Africa. We are also using it for PCI-DSS requirements. This discovery component works quite well with respect to the search.

When we deployed it for a bank, it proved highly efficient in terms of PCI compliance. It was very quick to pick up where people were divulging personal information regarding credit card holders. We then deployed very simple rules that we had customized, without the need for data classification.

Initially, if you were just doing PCI-DSS, because it's very limited information that you needed to protect, you could do it without data classification. This was good for an organization that had data to protect and wanted to comply with PCI-DSS, but had not done the data classification at that point.

The rules that we put into place were simple. For example, if more than two credit card numbers are being pushed out then block it, or first put it into monitoring mode and then block it.

One thing that I really like is that you can customize the rules. 

The challenges that we've had are related to deployment, especially around the discovery component, and with the local support that we receive in South Africa.

With respect to the discovery component, the reports are very hard to interpret because they come out in an illogical format. We forwarded the reports to our local support team, who were also unable to help me. Eventually, the problem went to the UK for that team to interpret the report.

Ultimately, my biggest challenge is the discovery component with respect to the reports, as good as it is in terms of the integrity, or the search. It is a question of how you translate technical reports into business language. We tried the cloud version, which is Forcepoint CASB, and we found the same thing.

The local support team is made up more of salespeople than engineers and as such, the support in South Africa can be improved.

My experience with Forcepoint Data Loss Prevention goes back to 2005 when it was still called PortAuthority. The product has evolved massively since that time. I have deployed it and worked with it for different organizations at different locations.

Initially, it takes a little bit of processing but nothing to be too concerned about. Stability-wise, nothing has really annoyed us. 

The scalability is fantastic. One of the things that I like about Forcepoint is that I can customize the solution to suit my objectives. For example, if I only wanted to prevent PCI then I could just go in and do that.

One of my clients has quite a large deployment, with approximately 30,000 users. They have plans to roll it out to the rest of Africa.

Technical support from the UK is good. However, the experience of local support in South Africa is not at the level it should be. Most of the local staff are salespeople, as opposed to engineers. Support for the deployment of the product is seriously lacking.

In the UK, they were much more knowledgeable about the product, as well as the outputs and how to actually read them to make business sense out of them. It was much better than what we had in South Africa. Locally, they simply said that they didn't understand it. Most customers will shy away from products when the support is like this.

Because they answer the phone, I would rate the local support a two out of ten. The European support was better, so I would rate them a five out of ten. There were delays in their response but I'm not sure if it was related to the difference in time, or it was part of the ticket escalation process.

One of our clients was using the Symantec solution prior to Forcepoint. We convinced them to switch because Symantec does not have a great presence in South Africa and support was an issue.

They had been using it for quite a long time and had not seen the necessary return on investment. With the new legislation, it was time for them to change to something that was more practical, and more user-friendly. The product works great now.

The implementation is not as easy as people make it out to be. Once you get it right, the product is fine, but this requires understanding it and getting the proper training. A novice that has begun to work with the tool can find it quite difficult to implement if they don't have a good understanding of the product, and do not have the right support.

For example, in one organization it took us about three months to implement it, whereas it should have taken about a month.

Our clients have hybrid deployments, where they are part on-premises and part cloud. The choice of cloud provider is made by the client but they either choose Microsoft Azure or AWS.

The implementation strategy that we use varies depending on the client. For example, at the bank, we wanted to prevent data breaches, especially with credit card information, and ensure compliance. Therefore, our strategy was focused on just the PCI requirements so that we could take reasonable measures to protect the organization. Essentially, we wanted to go from zero to hero quite quickly. That was possible because of the flexibility and agility of the product.

When it came to the telco, it was a completely different strategy. It was a long-term strategy in terms of protection of personal information and preventing it from being divulged without authority to would-be criminals.

When we deployed it, we literally had to look at the requirements and configure it from a POPI perspective. In this regard, the deployment was skewed toward personal information breaches.

We worked with a local reseller, Performanta.

Their skills were meant to be the best in the country but it left a lot to be desired. We had to use the UK offices and that's a challenge with most of the organizations in South Africa. With big vendors, South Africa is a small market, so the investment in South Africa is not what it should be. Understanding, managing, and integrating products needs to be improved, in general.

For deployment, there were eight of us in total. Two were engineers, there were four analysts because we had to write the business rules and document them, there was a project manager and a few others.

Maintenance is being done by the client, in-house. They have two engineers that are responsible for it, and they have purchased support from the local providers.

My clients are seeing ROI because the privacy office is quite comfortable now that they've done everything reasonable to meet the compliance requirements. There is a level of assurance provided by the DLP solution.

In terms of pricing, it is good for a corporation but they do not cater to small to medium businesses. They have to look at a different pricing structure for small to medium-sized enterprises because the cost is too high.

This is compounded for the African market because of the exchange rate. One dollar is equal to approximately 15 rands and if you were to multiply that by the price of the product, it becomes quite costly.

There are no costs in addition to the standard licensing feed, although you still need to understand the operational impact that it has on an organization from a resource perspective. That needs to be factored into the total cost of ownership.

We compared Forcepoint with NetSkope to assess its reporting capabilities and we found that the NetSkope report was very easy to translate, understand, and explain to a business. Forcepoint was instead very cumbersome, unstructured, and illogical. It required an expert to actually interpret the report, which is something that you don't want.

We have also looked at the McAfee product, as well as the one from Microsoft. At that stage, the solution from Microsoft was a little immature and I have not looked at it since. Forcepoint was the leader when we implemented it for our clients.

Comparing Forcepoint to the other products in general, the data discovery capability was great, except for the interpretation of the report. The OCR capabilities were also good for us because it's a telco and they have a lot of paper going through. 

The tool works great but they don't talk about the operationalization of the tool from a process perspective. When people sell DLP solutions, they talk about the efficiency of the tool, but they don't talk about the impact that it has on an organization from a resource perspective.

You would need a team to analyze all of the exceptions that you have, like the way they do in a SOC, where you have analysts looking at the incident. They analyze and investigate it, and then determine whether it is positive or negative and something that we have to be worried about. For example, our organization had approximately 70,000 end-users, who were employees. There is quite a large amount of data that is transferred across our network.

In our case, if a person is sending more than one credit card credential out of the bank, it was flagged. If it was more than one, you had to have a whole backend process where the analyst had to look at it, then perhaps ask the person why they were sending out this information.

When we were first looking at this product, there was nobody who informed the customer as to the complete ecosystem that would be required to have an effective DLP solution in play.

My advice for anybody who is looking at Forcepoint is that they need to understand what it is that they are trying to prevent. You cannot be totally dependent on the tool to do everything. This is not a criticism of Forcepoint but rather, a criticism of the way it's sold. The product will do what it's built to do. But, if you're expecting it to automatically manage the incident, then it cannot do everything. It can block, it can monitor, and it can create alerts, but you still need your analysts. For most CSOs or IT managers that are looking to deploy, they must factor in the practical implications of operationalizing it. They need to have a process in place. They need to have an escalation process in place, and they need to have resources like analysts to actually look at the exception reports.

This is an effective data leakage solution, it does what it's meant to be doing, and the interfaces are great. The biggest lesson that I have learned from using it is to understand the total cost of ownership.

I would rate this solution an eight out of ten.

It's for DLP and to monitor and make sure that no key files are being sent out of the organization. It also helps in terms of tracking any abnormal behavior.

We have about 700 users and it's endpoint-based. We add an agent to the endpoints and it coordinates with the server.

With Forcepoint we found that one employee who left had taken some files, and we were able to stop it. And if somebody is under a notice period, we now monitor whether any files are about to go out. When they take something with them, we can see that. We can also identify any abnormal behaviors that are happening. A lot of times it happens that if somebody is about to leave, they try to take some information away with them. We catch that fast.

It also helps in terms of HR stuff because file movement can indicate people who are looking for jobs. We can see CV movements and it helps as an indicator of a dissatisfied employee. We can at least see the behavior and see if we can do something about it.

Before Forcepoint, we had data in terms of how many terabytes go in and out, but now we can specifically see what goes where.

One of the most valuable features is being able to see file movement, where files are going. Every week we review the files. It can identify software codes, so we code files and we know where they're going and who's doing what. It gives us visibility. It shows any key files, any strange behaviors, such as if somebody is taking too many screenshots, and alerts us about that.

I would like to see improvement in the reporting. We can only get one week's worth of data; we can't get more than that. Also, the reporting console is very slow, making it very frustrating to use. There are times when I open it up on a Monday and take a download, but it takes so much time. You can get busy with other things and come back and it's still hanging and you can almost forget about it. 

Also, the server goes down and we have raised tickets to resolve that. In the past two weeks, we've had to deal with that two or three times. It's been a little annoying lately.

I have been using Forcepoint Data Loss Prevention for one year.

The system is stable, but as I mentioned, the reporting portion is very unstable. If I want to get reports out, it takes a long time. Sometimes the server is down, and I have to raise tickets. I have had problems there.

The scalability is okay, there are no problems with that. We can add on more agents as we expand with more people. We haven't had any issues there.

I would rate customer service at 8.5 out of 10. When we have problems with the system, they respond and they generally resolve things within half a day.

This is our first solution of this kind.

The initial setup was straightforward but setting up the rules was very complex. It is something where things don't actually work as we think they will work. It generated a lot of false positives in the beginning.

Our deployment took about a month.

Our strategy was to start with auditing first. We haven't actually moved to blocking yet. When we tried to move to blocking critical files, it ended up blocking some other people at work. There are some issues around that and we have had to be careful.

We let it run on its own. I look at the data in Forcepoint on a weekly basis, but we don't have any administration of it, per se. My IT team handles the deployment of new employees coming in, meaning the deployment of the Forcepoint agent on their laptop. That's about it in terms of admin.

An integrator helped us, somebody who deals with Forcepoint products. There were no problems with that, although they were billing by time and the system is a little complex.

We have seen return on our investment because we're able to track our data. It's not so much an active return on investment, but more like an insurance policy. It prevents bad things from happening.

The pricing is reasonable. That's why we went with Forcepoint. They were pretty competitive.

There are no additional costs, other than the cost for additional licenses that we have to pay for ad hoc.

It's not as easy as Zscaler to connect. To be very honest, I think Zscaler has a better product with a better interface, but the cost of Forcepoint is more attractive. That's why we went for it. We looked at McAfee as well. McAfee is a bit resource-heavy. 

Zscaler was very good. The interface was really good and it's easy to set up. Forcepoint is okay. I spoke to some other customers who used Forcepoint and they said, "Look, the interface is a bit complex, but it has everything in place."

You need to put a lot of time and effort into Forcepoint, you need a dedicated team for it. You also need to have a data classification strategy firmly in place. You should classify your data before you get it. You also need to test your rules thoroughly before you implement them.

We are using it for PCI compliance.

One of the most valuable features is the set of built-in policies that Forcepoint has for PCI compliance. We just need to activate them and start working. Without them, it would be a big task to do a data transformation. Another advantage is that Forcepoint also updates these policies. If there is a new control for PCI compliance, Forcepoint updates it in its system and it can be downloaded.

Forcepoint is also easy to use and manage.

The reporting features, the real-time reporting, can be improved in Forcepoint. On the dashboard, we don't have a feature that shows real-time incidents. We have to schedule a report in the environment.

I have been using Forcepoint Data Loss Prevention for two years. I am a partner for Forcepoint and Symantec. I suggest DLP solutions to my customers.

Forcepoint is very stable. Symantec is also very stable.

Forcepoint is quite scalable. If we have more network traffic, we can add an appliance and it will be enough for that increased traffic. It scales up.

The number of users in environments where we have deployed Forcepoint is between 5,000 and 7,000.

I would rate Forcepoint's technical support at eight to nine out of 10. The support has separate sections, including essential support and basic support.

The initial setup of Forcepoint is straightforward. It uses a Microsoft SQL database and the solution is implemented on Microsoft Windows Servers. When it's based on Microsoft, the solution is very integratable. Optimization of the installation is not complex. It is just like installing other software on Windows. We just need to learn the setup process and click some tabs and the solution is installed.

In general, the initial setup of the different components of Forcepoint takes only two to three days.

Our process is that we first install the database and then we install the Forcepoint Security Manager, which is the centralized location for policy management and reporting for all the solutions' components. Then, if required, we install the additional Security Manager. It is straightforward. Next, we implement the DLP on the endpoints, and then we work through the network side.

One of our recent deployments of Forcepoint was for a bank that has requirements for PCI compliance. In terms of what they invested in the solution, they got the value back within a quarter.

The licensing of Forcepoint is quite straightforward. It's based on the number of users. The support fees are a separate cost.

The main functionality of both Forcepoint and Symantec is actually the same. But when it comes to deployment, Symantec's solution is difficult to deploy. To deploy Forcepoint I only need three Windows servers, but to deploy Symantec DLP I need eight Windows Servers.

With Forcepoint, we can take backups automatically from the appliance itself, using the Security Manager, in case of disaster. We just schedule a backup job and it takes the backup from there. But with Symantec DLP there is no feature for backing up and we have to do the backup manually.

But for larger enterprises, Symantec provides an Oracle Database where there are no limitations for keeping incident data in the database. Forcepoint uses a SQL database that can't hold as much data. Large enterprises often use the Linux operating system for their core applications. Symantec fully supports a Linux implementation of the core architecture of PLP in a Linux environment, but Forcepoint is only installed on Microsoft. This is one of the biggest factors for larger organizations, given that they often require a PLP solution.

If an organization is small or medium in size, I would deploy Forcepoint for it. The price and the architecture requirements, and the equipment required for small and medium businesses, is reasonable. For large enterprises, with more than 20,000 users, I would deploy Symantec.

The primary use case is to protect sensitive data going out of the organization and helping the team to manage the incidents to create few to no false-positive incidents. 

Mac users can use Forcepoint DLP without any problem. They can create user-defined policies rather than using pre-defined ones. Using the fingerprinting policy can safeguard any data kept on a particular drive. We're using OCR to protect data being sent out through images implementing discovery policies to check if any particular file is been shared.  

The Forcepoint DLP is such a useful tool for organizations as it protects sensitive data with multiple kinds of functionality such as OCR and an analytics engine (which helps determine if any sensitive data is in danger of policy violations). It's easy to determine the incidents that have been triggered. This has helped to identify what sensitive data has been shared. The only part where it didn't work so well is during agent upgrading. If we automatically try to upgrade the agent it causes a lot of problems.

With OCR and Risk Analysis, we are able to determine if anything sensitive is been shared. OCR helps us to safeguard those things and with risk ranking, we can determine which user is trying to violate policies multiple times even though they have been blocked to him or her. It does require additional servers, as the processing and result of the incident is high, however, it's worth using to see all the use cases being met with these two features as well. They are the best features provided by Forcepoint.

The feature which needs improvement is the Forcepoint agent upgrading. When you automatically try to upgrade the agent it causes problems. For example, the system starts to behave abnormally or the agent is unable to communicate with the policy engine. If we try to upgrade to new version with the old version running, sometimes it works without any issue, but sometimes it causes a lot of issues and it gets disconnected from the DLP servers. 

You can see incidents via delays on the console even if the agent is properly installed and connected with the proper policy updates.

I've used the solution for two years.

We use it mostly for endpoint protection of PCI information, as well as PII, such as social security numbers.

We have a hybrid system, in that we utilize the cloud as well as our on-premises appliances. Depending on where the customer is, if they're on-premises or if they're working from home or elsewhere, we have that covered with the hybrid solution. Forcepoint has its product available in the cloud and we use the on-premises side when the data is going through the appliances.

The greatest benefit is the detection, detecting either accidental or unauthorized transmission of certain kinds of PCI or PII data that we prohibit. It's very useful to get that from alerts. We can also block them outright, depending on what threshold we have set. That's the most useful thing about DLP, that it prevents unauthorized usage of that kind of data.

Some of the built-in rules, templates, and content classifiers are among the most valuable features. Some of the built-in patterns are good places to get started with. Along with the phrases, they are helpful in putting together policies and fine-tuning our policies. A good example of that would be certain kinds of credit card data. They have a lot of algorithms available to fine-tune what exactly you're looking for, whether it be credit cards from Mexico, or US credit cards, et cetera. They have a good database of those types of predefined algorithms, ways to detect things, and the specific information you're looking for.

These features are valuable because they work and seem to be picking up the right data. They seem accurate. It's also convenient to be able to choose them and not have to figure it out myself or create my own. That goes a long way toward fine-tuning our policies.

The user-friendliness of the interface in formulating DLP policies could be improved. An example would be managing policies. It's a little daunting at first, and can be confusing, at times, when it comes to how to set things up and how to add policies. They could improve on that.

Overall, I would like to see them modernize. I'm on version 8.5, so there are newer versions out. They may have done that already. I'd have to demo the newer versions.

We're planning on upgrading this year to 8.6. I believe that in going to 8.6, we will be gaining some additional features. The newer versions will have better detection capabilities with improvement to their algorithms.

I have been using Forcepoint Data Loss Prevention for about five years or six years.

The on-premises solution has high availability. The appliances that we've used are very stable. They just keep running. We have had very few issues with the appliances in terms of failure. In those situations, they were more on the hardware side. They just needed a reboot and that fixed things. Overall, the stability is good for on-premises. 

In terms of the cloud side, availability doesn't come into play as much because we don't change policies that often. We don't modify the policies on a day-to-day basis. We might modify a policy once a week or once every month, at the most. The client or endpoint really just needs to receive that update once, and it's pretty much good to go. So we're not relying too much on the cloud availability, except for that initial update for each endpoint. The cloud availability is going to be more relevant on the web side of the product, where you're going to want continual web access, filtering, et cetera.

One feature that I'm getting ready to take advantage of more is the ability to add more data crawlers to the DLP on-prem environment, without any extra Forcepoint costs or licensing needed for that additional data server. That will help in reducing the stress on the data server that we're using now. It will help manage all the policies, the clients that connect to it, and all of the network discovery tasks, especially. They will all be handled much more efficiently when we spread the load. We're looking to add an extra one or two Windows Servers for that, so the additional cost would just be related to the Windows setup.

Forcepoint's technical support for the solution is excellent. The technicians that I have dealt with have been with their company for a long time and they know their product inside and out.

There has been no other similar solution here, as long as I have been with the company. I started off with a sister company, and they actually used a very early version of Websense, which is what Forcepoint used to be called before it became Forcepoint. That means we have never used a competing vendor.

I was not involved in the initial deployment, but we've had it ever since I've been on the team here. I've been managing it ever since. I was there for the initial deployment in one of our sister companies. It wasn't anything unusually difficult. It just required installing some hardware and getting all the firewall rules worked out. Once you get all that in place, everything usually works pretty well. That's been my experience, even with upgrades. Most of the time our issues have been firewall blocks within our own company. That's usually the biggest hurdle, overcoming our firewall-related issues.

We use it on about 5,000 endpoints and we have two people who administer  it. They're both information security analysts.

I don't have ROI numbers. I base everything on: "Am I getting the support that I need?" And the answer is "yes."

We have never looked at other solutions at a PoC level.

What I can recommend is getting the highest tier of support that you can afford, because it's absolutely critical. I don't know how I would do everything if I had to submit a request and wait several days for it. I don't know how I would keep things going in that situation. With a higher level of support you can call someone and you also have someone who is managing your account. That's also really nice, because you get some extra benefits out of that.

I'm very satisfied and would rate it at nine out of 10.

We use the solution for processing our sensitive data which is strategic data and strategic information exchanged between our top management personnel. 

The purpose was to acquire the solution to protect us from incidents involving the sensitive data from our group getting taken. This happened previously, where data was taken from us and given to another competitor. There was another leak as well and since then we've tried to carefully guard our data and implemented, for example, Apple Mail to protect our mail from third parties.

The product is interesting. It meets our needs very well. It's the best solution when compared to Symantec, for example. We have both ForcePoint and Gartner as well and it's a leader among similar solutions.

The solution offers very good sensitive data protection.

The solution is excellent at protecting strategic information. I deployed it when I was working in the petrol industry for an oil and gas group. It was the biggest one in Morocco. We held important information about critical activities, including providing gas and oxygen for the hospital. We were considered critical IT and we had to comply with the operative elective and the law. DLP helped us to protect our data and we improved our safety in order to comply with the law and existing regulations.

It would be wonderful if the solution could develop more AI and machine learning capabilities. It would also be good if the solution was able to integrate with other ML and AI solutions. Right now, this is lacking.

We started working with Forcepoint DLP three years ago. 

The solution is stable enough.

The solution easily scales. We are able to expand it as needed.

Technical support was good. 

The is the first type of solution in this category that we have used.

In terms of implementing the solution, it's not easy and not complex. It's average. The deployment's level of difficulty is average as well. You just need to have the prerequisites satisfied. 

I appreciate their support because their support was with us to assist us until we deployed the two instances in our infrastructure.

I was the CISO, the Chief Information Security Officer of the company, at the time. My scope was to assist and to manage the project from the start to the close. I worked with the operational security to deploy it.

My scope was to cover governance. For example, elaborating on the policy for classification. It was a prerequisite to define the policy target in the DLP and to organize or to plan for the workshop with the strategic and sensitive entities in our group. I made sure they tried the solution and integrated the entities into the pilot side as well. 

The solution's support assisted us throughout the deployment process.

We were on Office 365 on the cloud. It wasn't enough. Since then, we've described our policy to Apple Mail and have elaborated out information classification. Afterward, we invited the business and the strategic entity to workshops to classify the data effectively and try the solution after implementing the DLP.

We use a hybrid deployment model and acquired the solution with the hybrid functionality to help protect our sensitive data in the inter-managed hybrid space.

The solution has been good, and it has responded to our needs. As a group, we were afraid of the safety around our sensitive data which was exchanged in our mail. We had an obligation to protect the data classified as confidential or restricted. The solution, since implementation, has helped us to protect our data and mitigate risk effectively.

ForcePoint also offers a bundle that includes modules that cover URL filtering and app data for other DLPs. It's very good.

Based on my experience, I advise any other organizations to test, try, and to be convinced by the solution before fully implementing it. Users will need to define exactly what it is they need from it and what their exact needs are to effectively deploy it. I think every user will appreciate that solution. 

We've experienced a lot of cyberattacks, so the DLP is necessary for us and would be beneficial to any company that has critical activities or has staff that exchanges sensitive data.

I'd rate the solution nine out of ten.