Morphisec Reviews

Our use case is for memory protection of our desktop and VDI computers beyond traditional antivirus capabilities.

We are on the most recent release.

We have seen it successfully block attacks that a traditional antivirus did not pick up.

Morphisec has reduced the amount of time that we spend investigating false positives by four to eight hours a month.

Memory morphing and the central console are the most valuable features. Most traditional antivirus solutions don't come with these features, so you need a tool, like Morphisec, to add this functionality.

It would be nice if they could integrate Morphisec with other traditional antivirus solutions beyond Microsoft Defender. That is probably my biggest gripe.

I have been using it for three and a half years.

It has been very stable. We haven't had any unintended consequences. Usually with security solutions, they introduce a lot of chaos and false positives in an environment, but that has not been the case in Morphisec. It has been uneventful, luckily.

We don't really have a lot of maintenance that goes on day to day. A lot of it is kind of set it and forget it. We have one admin who works on it, but they probably only touch it once a week unless they get an email alert that tells them to look at something.

Our environment isn't particularly large. We only have around 500 endpoints in our environment.

I would rate the customer/technical support as 10 out of 10. They are all very competent, motivated people who are very helpful.

We did previously use another solution before Morphisec. The company was acquired by VMware and discontinued.

We started it on a very small subset of computers. We tested on those for an extended period, then we pushed it out to the entire environment.

The deployment took 30 minutes at most.

The solution is very easy to deploy. They have excellent trained staff who can assist with a deployment as well as upgrades. They make it as easy as possible.

We haven't had any cybersecurity incidents on machines running Morphisec. We also haven't seen a large number of false positives on machines running Morphisec. I guess you could argue that there is a return on investment there because it has obviously decreased the amount of time that we spend looking at false positive events and remediating cybersecurity incidents. In general, it is always harder to build business cases on security tools.

Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. There is less overhead because it is more focused on the protect versus remediation, removing additional steps that you need to do associated with remediation.

Morphisec has reduced our team’s workload by four to eight hours a month.

It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off.

There aren't too many players in this market. It is very niche. Morphisec is in an interesting niche that a lot of companies might touch on, but not at the depth and breadth that Morphisec does.

We have looked at other vendors, but they don't necessarily overlap with Morphisec. 

While the solution provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard, we are not using that function right now.

The best thing would be to first understand the difference between traditional AV solutions and the Morphisec product. After that, it is just so easy to implement and install. I would recommend running an evaluation of it, because there is no reason not to.

I would rate Morphisec as eight out of 10.

We've been using Morphisec as a layered defense in our security plan. We have beefy firewalls and another antivirus; Morphisec isn't technically an antivirus. It's a protection agent. It's one of the layers of our security plan. We use it to defend ourselves from any sort of CryptoLocker attacks or ransomware drive-bys, and it should catch auto-executes that come from ads. We haven't been breached, as far as I'm aware.

We started with it on-prem and we had no complaints. It made sense. A cost analysis was done and on-premises cost less than the cloud, which is how things normally are. We used our own network so the cost was cut because they didn't have to use any of the load on their servers or network. It was all on us. But about a year ago they approached us and we were torn away from the on-premises solution. They made such a compelling cost-savings case for us to go to the cloud that it made sense to go to the cloud. We also got another service from them along with the protector, some sort of BI.

We're using it on all of our endpoints, servers and desktops that users touch. For servers that don't get touched by users, we don't have Morphisec on them because we just don't need it.

I wouldn't be doing Morphisec any favors saying, "Well I can't tell if it's working because the rest of our security posture seems to be taking care of anything else that gets through." Maybe it's not working at all. I can't tell. It would be useful to set up a virtual machine—and this is something I should bring up with our Morphisec person—and get some triggers that are actually on our dashboard so we can prove to management that Morphisec is doing what they said it was going to do. Worst case scenario, we have an infected virtual machine that I just blow away. The short answer is that we haven't seen it protect us from something yet. 

It hasn't taken anything off my plate. It's just a "gun under my pillow at night". It's something that we can tell our cyber-insurance people, "We have this, and this was used." In "Pretend-Land," where we got compromised, we can say, "We have all these layers of security and it managed to get through all of them, so we did our due diligence. Now please pay us for our losses."

What's valuable is really the whole kit and caboodle of the Morphisec agent. What it does is genius, in a way, until the bad guys get wise to it. You set it up and then you watch the dashboard. There isn't really much tinkering. As long as you did the install correctly, it should be pointing at your server and it will tell you a bunch of information on each client.

We have only had four attacks in the last year, "attacks" being some benign PDF from a vendor that, for some reason, were triggered. There were no actual attacks. They were just four false positives, or something lowly like adware. There have been false positives with both the on-premises solution and the cloud solution.

I'd rather see false positives than not seeing anything. If I see nothing then I literally cannot tell if it's working or not. But there are some false positives that are ambiguous enough to be caught.

We have been using Morphisec for about two years.

I don't look at the dashboard every day, but the on-premises solution was flawless. If the network was down between the clients and the server in our local area, we would be in trouble. But Morphisec's AWS implementation has been stable as a rock.

I believe it's scalable. I don't know what the upper limit is. Our company is a medium-sized business, with about 100 end-users and 500 employees in total. Morphisec easily holds those 100 users.

All the end-users are using the solution, meaning the solution is attempting to protect them from the silly mistakes that they make. But there are only two of us who actually look at the dashboard.

The business is growing so we do increase the number of clients. Whenever we add a new computer, we add Morphisec to it. Once we get to version 5, we'll revisit the ATP integration.

We didn't have a solution before Morphisec for this specific layer of defense, for the CryptoLocker/ransomware niche. We had an antivirus.

The demos worked great. They would open a bad file on a virtual machine and we watched the CryptoLocker being stopped in real time. It's hard to compare with that.

The initial setup was definitely straightforward. It has to go on every computer. There's a different installer for desktops versus servers. You just choose which one is which. We use PDQ Deploy, and a script that the onboarding technician helped us with, and it worked. It ran perfectly. We even have scripts for uninstalling it and installing the newer version, and Morphisec assisted us with that. It was definitely easy to do.

Before I saw the version 5 update and the notes on that, about how it's going to update automatically, I'd say the implementation was a slight pain. It wasn't a huge pain but you can't really get away from how you have to install this on all your computers. However, they actually made that process very easy, and I can do it with just a couple clicks to almost an entire organization, as long as computers are online.

Over the course of a day, it took about two hours to get the script going and select all the computers for each kind of installer. I kept running it over the course of the day because certain computers would be turned off or they were restarting. I had to do a good couple of runs of it, but it was very simple and quick.

Since there was nothing already doing what Morphisec does, on the computers, and Morphisec plays well with the current antivirus that we are using, we just installed on each computer remotely and it started working. We watched the dashboard fill right up in a matter of minutes.

We're not on the latest version but I'm actually excited for the latest version because it will do away with the manual updating process. The clients will start to update themselves. We will have to wait until one of our Morphisec representatives reaches out to us so that we can get the installer for the newest version. Version 5 is where it begins self-updating. Until now, I've had to manually update each time we wanted to do an update. The new one will mean I won't need to be worrying about updating or if the versions are out of date.

In terms of working with the solution, if Morphisec says, "Hey you're going over the number of licenses," we look to see how many are offline and we look at the versions. We look at it just to make sure that everything is going okay. We have alerts for when there's a threat. We get emailed saying, "Hey, look at this. There's a threat going on on XYZ computer."

I haven't seen ROI because I haven't seen a threat that it has protected against, exactly. If you're always wearing a bulletproof vest and you never get shot, was the vest worth it? I'd rather have it than not have it.

We looked across the rest of the security field and we spent more money on Morphisec than other solutions that do a similar thing, but the demos that we've seen were impressive enough to sway management. The technology behind it is clever enough for us to think it's cutting edge. It didn't save us money but we spent money on it because we thought it would be a good product.

The way that they explained how their solution works was more in-depth than other solutions that we were looking at. It looks cleaner. It has a good UI for the dashboard. It's not overbearing with security tabs and a lot of other stuff. It tells you, "Here's the list of all of your protectors. Here are all the threats. Here's the dashboard that gives you a little bit of everything," but not in an overwhelming way.

It sells itself, honestly. My advice to others looking into implementing Morphisec would be to use PDQ Deploy. The hardest part was getting all of the endpoints protected in a timely manner, but Morphisec assisted us with that. They suggested PDQ Deploy, which is a great tool. Implementation went so smoothly because of that.

Morphisec provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard, although we're not currently utilizing that feature. We're definitely interested in it. The reason we're not using it is because you have to purchase the upgraded version of Defender for Microsoft. We thought it was the regular Defender that each one comes with, but it's actually ATP, Advanced Threat Protection. That's what integrates with Morphisec. We're just waiting for the CFO to say, "All right, who wants a bigger budget?" and we'll say, "Yes, us, please: ATP." We would do it if we could bend our CFO's arm to get that kind of protection.

We do a multi-layered security approach. Morphisec is really our last layer of defense. It is our insurance policy. So, if a vulnerability gets through the user, network security layer, and antivirus, then Morphisec will then come into the fight.

We have it deployed across all of our workstations and server environments. We have 800 workstation licenses and 75 server licenses. 

Right now, we are using 100% on-prem. We have just converted to Office 365. With that, we will be doing cloud hosting as well

In the last month, we have had two instances that Morphisec stopped, one with Internet Explorer (IE) and the second with another update. We don't know the specific vulnerability that was exploited. We shouldn't be using Internet Explorer here. So, it notified us:

1. We had a user using IE.
2. It prevented something. 

I don't know what vulnerability within IE that it was attacking, but it did go to attack a vulnerability, and Morphisec prevented that.

Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. It changes the memory locations of where certain applications run. If you think of Excel, opening a PDF, running an Excel macro, or opening a web page and clicking on a link, all of those actions run in a certain area of memory. Morphisec changes the memory locations of where those run. 

If an attack comes in and the hackers are doing a vulnerability on an Excel macro, for example, they know macros are always deployed in a certain area of memory. They write their hacks to that area of memory. Morphisec removes that area of memory and deploys all macros into a different place. When the macro goes to run, it runs in that old area of memory, which no longer is running Excel macros. It basically goes to deploy and blows up, so nothing happens. By morphing the memory location, the hack still gets through, i.e., it doesn't stop the hack from getting through. However, when it goes to run, it doesn't do anything. From that standpoint, it's really looking at: If something happens, it is the last line of defense. 

We have a number of other applications that are more forward-thinking where we are looking at logs and training people as well as doing network security. But if a hacker actually gets through all of those different protocols and goes to deploy a vulnerability or malicious piece of code, it will deploy but not do anything. The reason it won't do anything is because Morphisec has moved that process to a different area. So, it is really after the fact. 

Morphisec is really good about sending us alerts of security incidents that have happened in the world, saying, "Okay, here is an incident that is happening. It is a zero-day and Morphisec protected it in our labs." They send those out as they come up. I usually get one a week. 

We heard there was a company that had deployed Morphisec on most of their servers, but not all of their servers. They actually got hit by a hacker. All of their servers that had Morphisec running were 100% protected. All of the servers that did not have Morphisec got hit. From my standpoint, we have Morphisec across the board. We are acquiring a few other companies, and one of the first things that we are doing is deploying Morpiesec to all the servers and workstations in those other companies.

What it does is valuable. A vulnerability might be able to potentially get through and still not be able to run. This is not a question of "If," but a question of "When" someone will get through. If they do get through into our environment, we are comfortable knowing that our last line of defense is Morphisec. A lot of times, without Morphisec, we wouldn't know until we knew. You either get the encryption or it could take a long time to understand. This solution is more of a peace of mind for us.

Morphisec stops attacks without needing knowledge of the threat type or reliance on indicators of compromise. Their development team has developed the security capabilities over a large number of different vulnerabilities, e.g., Adobe Acrobat or Excel macros. We don't have to be experts on any of these. More importantly, the zero-days concern me. All our other security software says that they can stop zero-day threats, but hackers are really good and this is really profitable for them. When the zero-day threats actually get used, it's nice knowing that we have Morphisec. 

We don't have false positives with Morphisec.

From a company standpoint, a little more interaction with the customers throughout the year might be beneficial. I would like check-ins from the Morphisec account executives about any type of Morphisec news as well as a bit more interaction with customers throughout the year to know if anything new is coming out with Morphisec, e.g., what they are working on in regards to their development roadmap. We tend not to get that up until the time that we go for a yearly renewal. So, we end up talking to people from Morphisec once a year, but it is usually at renewal time.

I tried to sign up for something, but I am still not getting any alerts when Morphisec releases a new version or when our console has been updated. So, I would like to be cognizant when any changes are being made or feature enhancements are added. It would just be helpful to be alerted when that stuff comes out.

Until we migrated to their cloud platform, I wasn't even aware that some of the updates were being pushed out. Then, I came to find out that we were two iterations behind a major release. So, getting those updates or bulletins are very helpful.

If I look at the dashboard, I can see one or two applications hit every once in a while for things like Internet Explorer or some Visual Basic Scripts. I can see that stuff is being prevented, but I don't know exactly if it is securing us in any way that we wouldn't have already had in place. Overall, I don't know 100% if it's increasing our security posture, but it does give us a nice peace of mind.

We have been using it for two years.

It seems very stable and rock-solid because it is not causing any issues.

I don't require any maintenance on our side.

There haven't been any issues with scalability since we have been on the cloud platform. We do not have to maintain the on-premises servers anymore. It is hosted in an AWS environment, which should be pretty easy to deploy once we add more employees.

Our technical resource is the solo admin at this current time. Two other people have access, but there is not much that we look at or review on it. We just make sure it gets deployed on all our endpoints. That is the only thing we really monitor. As for looking at the console, unless there is something that we need to look at, we are not really reviewing it.

We get security bulletins and an email that says, "Hey, this vulnerability just took down whatever company." So, we get technical bulletins that say, "This new zero-day vulnerability just came out, we have tested and stopped it."

The technical support is pretty solid. I did have some issues after we migrated from versions, switching to the cloud version. I ran into a few deployment issues that turned out to be a bad package. They were able to help me with that. They have been pretty good. Anytime I have an issue or question, they are pretty responsive.

Before Morphisec, we did not use anything greater than our normal antivirus or malware protection.

The initial deployment was pretty straightforward. It was basically just following the included documentation and working with the admin at the time. We set up a package to push the install out to all our machines. Then, anything that was outside the default library. I added to the protector plan. Certain applications, like Notepad, weren't included in the original deployment. This is stuff that is specific to our environment, like Power BI.

Our deployment took about two weeks.

My technical resource was the one who implemented Morphisec.

It has given us peace of mind that we won't be on the news. We do a good job with backups, but if we don't have to use them, that is much better. If the federal government and major corporations who have full-on security teams can get hacked and are vulnerable, then I am not going to say we are not vulnerable. So, for us, it is just a question of when. With Morphisec, at least when it does happen, I feel confident that we have in place solutions that will not only prevent it, but also let us know when something has happened.

Morphisec has 100% enabled our team to focus on other responsibilities or affected productivity. It has reduced our workload by one full-time employee. 

Our return on investment is that we haven't needed to have a full-time employee manage it. It hasn't taken away from our other initiatives. Efficiency is really where the savings is. We are getting peace of mind at a decent cost. We can see it working, and it doesn't take full-time resources to manage it.

It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately.

Through the years, we looked at Darktrace as well as two or three others. They came with astronomical price tags, while I think Morphisec hit the better price point.

It was not just the initial price tag, but the number of people required to manage the solution. On some of the other solutions, we were able to knock down the pricing considerably, but we needed one to two full-time employees, which we don't have, just to manage the solution. With Morphisec, our technical resource is the main person who works on it. He spends less than two percent of his time managing Morphisec. It is plug and play. It doesn't take a lot of resources, which gives us more time savings as well as being more efficient.

Ease of implementation and ongoing management of the solution were the two top priorities. Our secondary priority would have been cost.

Make sure you implement it on all machines, workstations, and servers. Don't buy it and miss some machines.

Morphisec says they haven't been hacked. From the instances that I have seen when doing research, I find that to be true. Time will tell, but so far it has been working for us.

We will be implementing the Morphisec Guard probably next month. We are just rolling out Microsoft Defender right now. We are evaluating it now. I think we have also started replacing our former antivirus. 

Windows Defender and Morphisec go hand in hand, at least from an antivirus standpoint. Morphisec was built to work with Defender, and Defender is a pretty good product. So, that is what we will be using moving forward. From an antivirus standpoint, we just switched our antivirus to Defender within the last month. Between Defender and Morphisec, we don't really have another antivirus need after that.

I would rate this solution as a seven or eight out of 10.

Our primary use case is to have it for more protection than Defender can give us. We wanted more protection against the threats that are out there with malware and ransomware being the biggest. It's to supplement threat protection in addition to having Microsoft Defender. 

We only use the agent. We've transitioned from on-prem to the cloud this year.

We haven't had an issue since we've had Morphisec, so it's working. If we see something, we'll ask them about it, and then if we need to, we'll look at the machine. Generally though, if we find something, we tend to re-image a machine as opposed to fixing it. We just wipe it.

Morphisec gives me even more than Microsoft can give me, even if I were to pay. It doesn't technically save us money because we're paying for a Microsoft package that comes with Defender. 

It has reduced the team's workload by a couple of hours a week. It also saves money on our security stack. It's cheaper than others. It saves between $10,000 to $15,000 yearly. 

We liked the ability to see both the Defender and Morphisec through a single console to see the problems that might be going on.

It provides full visibility into security events and from both solutions in one dashboard. I'm not a big security guy, if I have a threat that looks like there's a problem, I will ask Morphisec to dissect it for me, and tell me what might be happening. Because it tends to be all hash codes, so I can tell what's going on. They've been pretty good with that.

I haven't been able to get the cloud deployment to work. When there's an update, I'm supposed to be able to roll it out for the cloud solution, but right now I'm continuing to use our SCCM solution to update it.

I have been using Morphisec for a year and a half. 

They've been very good. We've been able to see any problems that we have easily. We've been able to deploy new solutions. The migration from on-prem to cloud was very easy because Morphisec did it for us. They migrated the data. When I do have problems, if I need it, I can call them. They've been right there for me.

The agent that is installed on the endpoints stable doesn't take up a lot of resources. 

I haven't had any problems scaling it. I only have about 3,100 devices to deploy it to plus seven servers. 

In terms of maintenance, I just look at the reports and see what's happening and if there's something that's going to need attention.

Technical support was very helpful. I just told them I had a problem and they went and found the solutions.

I have had other solutions. We were just on the Defender and we added Morphisec to that. 

The initial setup was straightforward. For the original, we built the on-prem solution, which was a single install that they provided, and then we deployed our clients through our SCCM. We just did it with an MSI file. It was very straightforward. It took half a day. 

We deployed it ourselves. 

The ROI is that we haven't had any outbreaks. It's working.

Pricing was competitive. There were no additional costs to standard licensing. 

We looked at a full Malwarebytes deployment and Sophos. We liked the price and then supplemental for the Defender since we were already paying for Microsoft.

We were going to be required to remove Defender, which would have been extra steps, and that almost never goes smoothly. Plus we were concerned about the size of some of the clients and how well they were going to perform for us. They had older machines.

It's been a good experience. Morphisec has been helpful and we haven't had any outbreaks since running it. The install was easy. Updates have been pretty easy.

I would rate Morphisec a ten out of ten.

We use Morphisec in conjunction with our other endpoint tools to be a type of fail-safe. If something can get through Trend Micro or CrowdStrike, Morphisec is the secret weapon, because if it sees anything it will stop it. We have a defense-in-depth model, and Morphisec caps it off for us.

The solution is hosted by the vendor.

Often, it's very hard to get the vendors of the biomedical devices we use to allow us to install security software on their devices for monitoring. Morphisec is the first one that we've gotten the vendors to potentially buy-in on. They're taking a look at it to see what it does and allow us to start distributing it across some biomedical PCs. That's a big deal for us.

Another benefit is that, while Morphisec hasn't necessarily reduced the number of false positives we get, it makes it easy to determine whether something is real or false. We don't have to spend a lot of time trying to figure that out. We get a lot more false positives from CrowdStrike. When it comes to investigating something like that with Morphisec, we don't have a lot of occurrences. We may have gotten three false positives from it in the last year, and that was when an application got upgraded and changed.

The simplicity of the solution, how easy it is to deploy and how small it is when deployed as an agent on a device, is probably the biggest aspect, given what it can do.

It's a set-and-forget, unless somebody says something or we get an alert. It is not something you have to manage every day, that's for sure.

The only area that really needs improvement is the reporting functionality. Gathering the detailed information that is in the system for an executive, or for me as a director, could be better. Some of the interface and reporting aspects are a little bit dated. They're working on it.

We have been using Morphisec Breach Prevention Platform for just about four years.

I've never had a problem with its stability.

In terms of scalability, it's easy to push out. It will go on pretty much any Windows device, which is great. We have it on every endpoint our organization owns. That includes servers and workstations. The only thing it probably does not touch is anything that is biomedical. We've adopted it 100 percent. Obviously, we'll add licenses as we add devices.

We are also looking at some of Morphisec's other product lines that they have recently come out with.

I would rate their technical support very highly. If we need technical support, which we haven't needed much, they're quick to respond.

Aside from that, I would say that working with Morphisec, from the business development and partnership points of view, has been tremendous. They're always willing to listen to new ideas. And they come to us and say, "Hey, we have these things that are going on. Are you interested in looking at it and giving your opinion on it?" They're very in tune with customers and communicate well, which is rare.

Positive

We did not have a solution to do what Morphisec specifically does. We don't use Microsoft Defender. I know Morphisec has the capability to pull all that together, but we are not a Defender customer. Currently, we use CrowdStrike.

With our testing process and our change process, it took us about a month to deploy the solution. It was very short compared to what our processes normally take.

We deployed it to the IT department, and then to another group as a testbed. After dealing with any small issues, and by that I mean there were a couple of applications we had to whitelist, we started deploying it across our fleet to all 6,000 devices.

It's simple to push it out through SCCM because it's a very small, lightweight application that does not affect the users in any way. It does not slow down their machines or have dependencies that need to be installed, and it runs on pretty much everything.

The financial savings are unknown, but the risks that Morphisec offsets, and the dollar amounts tied to those risks, are tremendous. We're potentially saving millions of dollars from a breach because we have Morphisec in place.

The pricing is definitely fair for what it does.

Before we got Morphisec we evaluated solutions that claim to do similar things, and we have done additional evaluations since we started using it, but I don't think anything can truly touch what Morphisec does and the way it does it.

A lot of the solutions out there are basic antivirus tools and they add on EDR capabilities. They're usually trying to compare EDR to Morphisec. A lot of the competition says they're similar, but they're rooted in old ways of doing things. Morphisec is just a different process.

My advice is to get to know the individuals at Morphisec. Lay out your infrastructure and where you need to put it and let them help you do that. Also, be open to new ways of tackling security problems.