Microsoft Defender for Cloud Reviews

We have deployed Microsoft Defender for Cloud to identify vulnerabilities across various log sources for our client.

We implemented Defender to improve the security posture of our client's landscape.

The single pane of glass that Microsoft offers is highly crucial for several reasons. First, aggregating multiple log sources into a single pane of glass is not achievable without Microsoft Defender for Cloud. Second, we also interact with other cloud environments.

We use Defender's free CSPM functionality for the Microsoft Cloud security benchmark. The benchmark recommendations show all the vulnerabilities that help us to create a remediation plan and to take action.

It is a necessity for us that the free CSPM functionality provides multi-cloud monitoring and posture management because most of our workloads are spread across multi-clouds.

The comprehensive range of workloads protected by Defender for Cloud is sufficient for our needs, as it encompasses all essential security pillars.

We have enabled Defender for Cloud's native support for GCP. A key requirement for us before selecting Defender for Cloud was that it supported other clouds.

Defender for Cloud has aided in reducing the number of vulnerabilities and expediting the resolution process, thanks to its helpful suggestions. Consequently, we have achieved remarkable time savings of approximately 30 to 40 percent each week in comprehending and addressing vulnerabilities.

By integrating Defender for Cloud with the firewall and Defender for Endpoints, we have gained comprehensive security insights through these Microsoft integrations. This unified approach provides a single pane of glass for viewing all security information, eliminating the need to navigate between multiple portals.

Defender for Cloud has improved our security posture.

The unified monitoring has saved us around 30 percent of our time.

Defender for Cloud has increased our security team's efficiency by 30 percent.

Defender for Cloud is a plug-and-play solution that provides continuous posture management once enabled.

The multi-cloud capability is an important feature of Microsoft Defender for Cloud.

The remediation process could be improved. I have seen that Google has a similar Security Center, where they not only identify vulnerabilities but also provide the steps to fix them. If Microsoft Defender for Cloud could provide remediation steps for all vulnerabilities, it would be a significant enhancement. Currently, only some vulnerabilities have remediation steps available.

I have been using Microsoft Defender for Cloud for three years.

Microsoft Defender for Cloud is stable. We have not encountered any downtime.

Microsoft Defender for Cloud is scalable.

The technical support is good. We can raise tickets without any issues.

We previously utilized Google's Security Center. However, we transitioned to Microsoft Defender for Cloud following the client's preference for a native solution, as they are a Microsoft-centric organization. Additionally, Microsoft Defender for Cloud's multi-cloud capabilities, including its ability to integrate information from Google Cloud, were compelling factors in our decision.

We have achieved a return on investment in terms of time and efficiency, which translates to monetary savings. For instance, we have gained 30 percent more efficiency in remediation tasks. This means that what previously took ten days can now be completed in seven days, saving us time and, consequently, money.

I am not involved much with the pricing but the bundle offering is good.

We considered Prisma Cloud before ultimately selecting Microsoft Defender for Cloud. The fact that Defender for Cloud was a native solution for our client significantly simplified the integration process.

I would rate Microsoft Defender for Cloud nine out of ten.

We have Microsoft Defender for Cloud deployed across 2,000 locations and over 3,000 endpoints.

No maintenance is required from our end.

The primary use case for Microsoft Defender for Cloud in our organization is investigating breach or security incidents.

Defender for Cloud has improved our security posture by 20 to 30 percent. With everybody moving to hybrid, it's challenging to maintain a good security posture with so many people working from home. I'm impressed with the solution's coordinated detection and responses across devices, identities, apps, emails, data, and cloud workloads. That's why we're considering using Defender in more areas and integrating it more.

I find Microsoft Defender for Cloud's KQL very flexible and powerful. It's really easy to search through with KQL queries to find the security breaches and incidents and to track down the breach itself. Microsoft Defender for Cloud presents a prioritized list of remediation for security issues, giving us a starting point to begin locking things down and tightening security.

I can't think of anything that needs improvement. It's a pretty good product.

I have been using Microsoft Defender for Cloud for the last year.

Defender's stability has been flawless for us. I haven't noticed any issues.

It's great. It seems perfectly scalable.

I would rate Microsoft customer service and technical support 10 out of 10. They seem quick to respond and get us the answers we need, taking a hands-off approach to helping us integrate.

Positive

I previously used other antivirus products like Kaspersky. Microsoft Defender for Cloud is preferred because it offers cloud ability and is a more trusted partner in the industry.

We used a consultant for the implementation, and the experience was good. No complaints.

Our return on investment is seen through increased productivity. I'm able to get more done with less time.

I evaluated other antivirus products like Kaspersky before switching.

I would rate Microsoft Defender for Cloud a ten. Having this solution alleviates the need to worry about other antivirus products, offering a one-stop solution.

For example, the customer wants to restrict USB connections or any output device, or they want to verify any link they open before opening it in their real environment. Mostly, they replace the current security tool they are using, such as Kaspersky, with Defender for Cloud because it integrates well with Office 365.

The biggest advantage is it centralizes management. Customers do not have to manage different vendor products. They feel confident using Microsoft because of the long-recognized technology and detailed technical documentation available online.

The valuable features include the ability to manage devices and the fact that Defender can replace other security tools like SCCM. Since they use Office 365, they need tools that work better in their organization, such as M365 Defender for Cloud.

There are challenges with the licensing policies, which are quite complicated. The documentation is difficult to understand and resellers need proper training to support customers effectively. Microsoft should provide better training for resellers.

I have been working with Defender for Cloud for more than five years.

It is quite stable. It doesn’t have significant stability issues. I would rate it an eight for stability.

I am not the one using it directly yet I haven't heard any complaints, so I would rate it a five.

Working with Microsoft technical support can be challenging. The problem-solving process can be delayed, and not all issues get resolved promptly. If there are ten tickets, maybe only five or six get resolved satisfactorily.

Neutral

Customers are replacing security tools like Kaspersky, Symantec, or Broadcom to use Defender for Cloud because it integrates seamlessly with Office 365.

The initial setup is not very easy yet it is manageable. It is not too difficult for those familiar with the product. It is a medium-complexity setup.

The implementation should be handled by the reseller. Resellers need proper training from Microsoft as the documentation is complicated.

In Vietnam, the cost structure makes it expensive. The licensing is priced publicly on the Microsoft website and it adds up based on the number of users.

The cost is expensive for the Vietnamese market. It is publicly available on the Microsoft website, and the pricing depends on the number of users.

Organizations should ensure resellers are well-trained to support the new technologies. Proper documentation and support are crucial.

I'd rate the solution seven out of ten.

Mostly, it's related to the vulnerability management.

Earlier, we used to do the vulnerability assessment manually, scheduling it based on our timeline, maybe every six months or once a year. Now, it helps us a lot because we can get the vulnerabilities updated and get recommendations.

The MDVM part is very good. While we were doing the POC, Microsoft Defender was using Qualys for the vulnerability. Now, they have switched to their own MDVM, which is Microsoft Defender Vulnerability Management.

The vulnerabilities are duplicated many times. If it reports that the findings are around 30 or 40, or let's say, 100, it is not the exact number as it is possible that there are multiple findings which are duplicated in nature, and actually, the number is only 62 or 67. 

Another issue after Microsoft Defender upgraded and left Qualys is that whenever the load for the report data is too high, we cannot export the report in one go, so we have to do it in batches.

I have been using the solution for two years.

The quality of the MDVM feature, one of the keys which we are getting, is many times duplicated with the same IDs.

I have contacted Microsoft for the quality issue, and they are working with us.

Positive

I did work with something similar, however, not in the same organization. In my earlier organization, I was working with Check Point and Tenable.

The pricing is good. It is license-based, and we are not utilizing all of the features, like API and other functionalities, so the cost is not that high.

I would definitely recommend Microsoft Defender for Cloud, provided they make some improvements in the MDVM part.

I'd rate the solution eight out of ten. 

My role is more on the FinOps side. My customers use it.

In specific contexts like finance or healthcare area, there are regulations requiring compliance. At this stage, we need to be able to prove we have state-of-the-art endpoint protection and the ability to show that all these tools are up-to-date with the latest updates and identified threats. This is very useful for my customers to be able to prove compliance.

Mainly, the ability to identify threats using signatures, analyze threat behavior, and integrate with other cloud services, specifically Azure Log Analytics and other logging projects. These are the features I like. 

Customers generally find it satisfactory for their needs. Most organizations struggle with the ability to handle this type of product. Sometimes, it's a lack of knowledge or expertise on Microsoft Defender, which leads to issues with certain tasks. That can be a bit difficult to figure out.

Most customer teams need more training on this type of product.

Due to the lack of expertise or hands-on experience with the product, it's sometimes difficult to determine whether the issue lies with Microsoft Defender or another related project. In the cloud, everything is tightly connected, making it challenging to pinpoint which part is failing. So, the lack of a deep understanding of the product leads to some difficulties.

In future releases, I would like to see integration of artificial intelligence to ease the administrative burden would help a lot, especially when it comes to deploying the product to fit specific contexts, architectures, or infrastructures. That would fill the gap caused by the lack of expertise or knowledge.

There are some promises that Microsoft has made, but I'm not aware if they've been fully implemented.

I have been using it for three years. 

I worked with Cybereason and other standard antivirus programs, but nothing as full-fledged as Microsoft Defender.

Overall, I would rate the solution as eight out of ten.

My recommendation heavily depends on the context, the customer's IT landscape, the maturity of the team working there, and many other factors that need to be taken into account when selecting a product. 

Microsoft Defender by itself is a good choice, but ultimately, the best option depends on the specific context.

We use the solution as a VPN and for endpoint security. 

I've seen benefits since implementing Microsoft Defender for Cloud. It's easy to manage for our large organization as an endpoint security solution. It integrates well with Office 365 and Windows 11, which is better than before. Patching, updates, and threat protection are all handled together now. Its AI features help predict threats. 

We've automated some processes, like batch updating and vulnerability detection, using AI. Our dashboard tracks every machine's IP and identifies vulnerable software. Using AI, we can gather this information and provide it to users. We also use chatbots to provide solution steps.

Microsoft Defender for Cloud is not compatible with Linux machines. 

I have been working with the product for three to four years. 

I rate the tool's stability a ten out of ten.

I rate Microsoft Defender for Cloud's scalability as nine out of ten. My company has more than 300 users. In our environment, we're using it on over 130,000 machines.

The solution's deployment process is not complex and is completed in 20 minutes. 

The solution helps to reduce costs by 20 percent. 

The solution is expensive, and I rate it a five to six out of ten. 

I would recommend the solution to others and rate it a nine out of ten. 

I use the solution for threat hunting. We've installed it on a lot of devices. I look for specific version numbers or threats within the environment.

The product has given us more insight into potential avenues for attack paths.

I like that the solution shows me recent log-ins for certain servers and devices. It's pretty helpful to track down activities and identify or tie them to specific users.

The product must improve its UI. Looking at multiple devices for the same issue or vulnerability is very cumbersome.

The solution should provide built-in features related to trending and graphing over time. If it’s already present, we haven’t found it. It doesn't seem intuitive to find it quite as easily as some other tools with ready-to-go dashboards.

I have been using the solution for two years.

The tool’s stability seems to be pretty good. I'm sure Microsoft takes care of its backend structure since it is a cloud solution.

Scalability, in general, is fine. We can deploy it on as many devices as we want. However, getting meaningful results and data out of that is not easy, especially when some of the things you're looking for might be across your entire enterprise. For example, if we want to know whether a DLL version is installed on any device, trying to get that information by going one by one through the devices is ridiculously cumbersome.

We used LogRhythm for a little bit. We switched to Microsoft Defender for Cloud because we wanted to do a cloud homogenization. We wanted to bring things away from on-premise and into the cloud because we had cloud assets. It just made more sense to have a cloud solution to manage the tools instead of pulling back into our network and opening the tunnel paths to our on-premise LogRhythm server.

The solution is deployed on-premise as well as on the public cloud. Our cloud providers are Azure and AWS. We also have some GCP assets. We have around 20,000 total devices. They don’t always correspond to an end user. Of those, maybe 12,000 to 13,000 are enrolled in Microsoft Defender for Cloud.

Other devices we have are either outdated Linux or outdated Windows. We’re trying to migrate all the ones we can, and then some of them will be those narrow use-case devices where it wouldn't really make sense or be feasible for them to have a definitive cloud. They're limited processing power devices, like iPads and tablets.

The product certainly requires maintenance.

Just based on costs, I do not see an ROI. However, evaluating a return on investment for something that provides insight into risks and vulnerabilities is not my area of expertise. In my opinion, a lot of it can't be quantified.

We have the full E5 license. The tool is pretty expensive.

We evaluated Splunk. Splunk's really expensive. It would also have been an on-premise solution. We needed a cloud solution.

We use Microsoft Defender for Cloud to support Azure natively. The solution’s ability to protect hybrid and multi-cloud environments is pretty important for us. Just as much as anyone else.

The unified portal for managing and providing visibility across hybrid and multi-cloud environments could be better with some of the ways things are displayed. Overall, it’s all right.

We have had the solution since we started cloud. I cannot provide a comparison for it. I don't pay too much attention to Microsoft Secure Score. However, I’m sure the product has affected it. We use the product to track down vulnerabilities and missing patches. When those get passed, I'm sure that it changes the score.

We have integrated Microsoft 365 and Microsoft Defender for Cloud with Microsoft Sentinel. However, I don't deal with it specifically. The tool’s UI could be better. As it is right now, we can only view information from one device at a time. It is extremely limiting.

The solution is pretty good at keeping our multi-cloud infrastructure and cloud resources secure. We use AWS, and we also have some Windows devices in AWS. We have Microsoft Defender on those.

Microsoft Defender for Cloud has helped save some of our SOC time. The reporting features, being able to search multiple devices for a specific vulnerability or incident and tying it back, are very difficult to do in the UI. There's some scripting that can be done, but that doesn't make it easier for a lot of people.

We have set up alerts in the tool. That, combined with other industry scanners like Tenable Nessus, Invicti, and a couple of others that we utilize in our environment, sends updates and alerts to us so that we can quickly respond to issues. We were not measuring TTR. So, the effect on the overall TTR is negligible.

It is hard to quantify whether the product has saved us money. We haven't seen any attacks from ransomware gangs. Possibly, those are being prevented, and we don't get alerts for some of these attacks. It has not saved us money. It's expensive. However, it is not expensive compared to all our computers being locked up, and someone demanded two million dollars.

People evaluating the product must look at other options to determine what works best for their environment and organization. It may not necessarily be the best option, but it might be. It certainly works well in a wholly Microsoft Windows environment, especially with other Microsoft software as a primary. If they’re using OfficeSuite, like Microsoft Word and Microsoft Excel, it works well. If they have other things within their environment, they must do their homework and research to see if it works.

Overall, I rate the tool a seven out of ten.

I use Microsoft Defender for Cloud mainly for cybersecurity, threat prevention and detection, and implementing zero trust principles. It serves as an endpoint security tool for securing our cloud services.

The tool's most valuable feature is its support for cloud-native services like Kubernetes, containers, managed storage, and databases. Protecting these without Microsoft Defender for Cloud would be extremely challenging. For threat protection specifically, I find the signature-based detection and heuristic detection features very effective.

The compliance management features integrate well with Cloud Security Posture Management (CSPM), giving a full view of infrastructure compliance with regulations like HIPAA, PCI DSS, and ISO 27001.

For improvements, I'd like to see more use cases integrated with Microsoft Sentinel and support for multi-cloud environments beyond just Azure.

I have been working with the product for a year. 

Regarding the stability of Microsoft Defender for Cloud, I would rate it lower due to some issues. Sometimes, the portal is not easy to access as it's Internet-based. We face delays while accessing the portal, which can be challenging. This could be due to Internet latency or other issues. However, from the solution perspective, it is quite stable.

I rate the solution's scalability an eight out of ten. My company has 4000 users. 

The initial setup was somewhat challenging - I'd rate it a three out of ten in ease of setup. Understanding the solution and ensuring all use cases work with Microsoft Defender for Cloud was challenging, but once you get the hang of the cloud, it's straightforward to set up. It took about a month to deploy, with three to four people involved in the project phase. Now two people manage it.

The deployment process was quite simple, as we're using Microsoft Azure Cloud. It involved activating the subscription as part of the license.

Integration with our existing infrastructure was mostly smooth, with some resolved certificate signing challenges. Overall, it was quite smooth.

Regarding return on investment, Microsoft Defender for Cloud is fulfilling its purpose. There's always room for improvement, and Microsoft is working on it. They regularly introduce new features, and their business development team is active in engaging customers about new features and benefits.

We decided to go with Microsoft Defender for Cloud because of its ability to cover cloud applications. No other tool we've seen has such vast coverage for Azure Cloud applications. Also, since it's a Microsoft native tool, it's easier to implement in Azure cloud.

Overall, I would rate Microsoft Defender for Cloud eight out of ten.

My advice for other users using the tool is to first do a proper risk assessment around the cloud, develop use cases based on the protect-identify-detect-defend model, and then implement the solution accordingly.