Netwrix Endpoint Protector Reviews

I work for a financial services company. As a consequence, we work with multiple lenders and lender clients; essentially banks and building societies. There's a requirement in this industry for tight controls from an information security point of view. For many years we've had industry requirements to deploy a number of technical controls to secure things like device control.

Prior to using Endpoint Protector, we used Ivanti Device Control. However, from the UI point of view, it was a bit of a dated product, and some of the functionality wasn't brilliant. We also took a recommendation from our service provider, who had been using this product with other customers, and as such we deployed CoSoSys Endpoint Protector. We primarily have one single purpose, which is to secure all of our endpoints, mostly laptops. We have a very small number of client computers as well, but we primarily use it to block all removable media and all USB points on the laptops.

As a business, we don't enable and support the use of removable media. We do have a small number of use cases where that is allowed, primarily within our IT team, but they are the exception. As such, every single USB port is blocked across the business with Endpoint Protector to mitigate the risk of somebody intentionally, accidentally, or for whatever reason being tricked into inputting their USB drive into our network which would then cause potentially a risk to the confidentiality, integrity, and availability of our data.

We have a contractual requirement for us to have a tool like CoSoSys. It mitigates risk for us as a business by enabling us to be sure that no one can exfiltrate data from our company via USB media or be infected by malware by plugging a device into an endpoint.

We only use that one particular feature. I believe there are other features available but I don't believe we pay for the other elements of functionality of the software. There are other features like DLP within the software, however, we have a suite of additional tools within our business to control those other elements so we use CoSoSys exclusively for device control.

We only use it for a very small use case. It certainly has a wide range of functionality, although, we don't use the vast majority of the functionality because we don't pay for it or because we have other tools in place that are specific for a certain purpose.

The granularity of the policies that we can create is good. We block USB media. One of the reasons we left our previous provider is because of the lack of this functionality. We have built some custom rules to make exceptions for staff members that should be able to use USB media. Of course, the ability to amend and write policies is far more granular than the previous product that we used. Switches, disabling and blocking Bluetooth, weren't available with our previous supplier. 

The feature that locks down USB devices means that if you plug removable media into any of our USB drives, it blocks it. As we block, we blacklist all the types of USB devices, and the cloud running trail blocks that. If someone puts the USB drive in, it will block them from opening that drive or even registering that drive. If they want to make an exception, they have to make a formal request to do so, and that can be made either by email or through an application to our IT desk.

The versatility regarding the exit point Endpoint Protector supports in making sure that important data doesn't leave our organization is vital for us. In the industry that we're in, data breaches are a significant concern. While our staff is contractually required to maintain confidentiality and they're all very aware that they shouldn't try and transfer company data of different classifications elsewhere to non-company devices, there's a risk. If we didn't have Endpoint Protector in place, they could plug in a USB drive, copy a file onto the USB drive, and then take that onto their personal computer or share it externally, whether that be with the press or the public, etc. This tool stops that from happening. It means employees are unable to share files and exfiltrate data via that channel.

We have other controls to stop other channels. One of the biggest concerns for us as a business is employees sharing data via the internet, dragging files and confidential information from our computer drives into Dropbox or into Webmail, et cetera. We have other controls and tools to stop that. But Endpoint Protector is used exclusively to stop USB media.If we didn't have Endpoint Protector in place, they could plug in a USB drive, copy a file onto the USB drive, and then take that onto their personal computer or share it externally, whether that be with the press or the public, etc. This tool stops that from happening. It means employees are unable to share files and exfiltrate data via that channel.

We have other controls to stop other channels. One of the biggest concerns for us as a business is employees sharing data via the internet, dragging files and confidential information from our computer drives into Dropbox or into Webmail, et cetera. We have other controls and tools to stop that. But Endpoint Protector is used exclusively to stop USB media.

I have been using Endpoint Protector for 18 months.

The stability is very comfortable. We have no qualms or concerns. There have not been any incidents or issues with it not working, or any problems that I'm aware of. Any kind of such problems would be raised to my attention and discussion review, and there haven't been any concerns raised by users or with our IT service desk. There has been no concern there.

Scalability is about the policies. We could deploy it simply to larger groups of people as and when required. There's a procedure where we deploy using an RMM tool. It's easy to deploy.

At present, we don't have plans to increase usage. We have a number of different controls and requirements, and we have specialist tools for each of the different requirements. We're also trying to move towards a Microsoft stack where possible because we have so many different tools in use. Microsoft doesn't do device control. 

I have never personally been involved with technical support. There was joint deployment with our MSP. There have been no problems, so I think it's fairly positive.

We were previously using Ivanti.

The setup was quite straightforward and didn't cause any issues. But I wasn't involved. Our IT system team deployed it around 18 months ago. I was quite new to the business at the time. It went relatively smoothly, there were no hiccups, and there were no deployment problems.

It took under a few weeks to implement. It was not a couple of weeks of solid work. We deployed it slowly within a UAT testing environment and only on a small number of laptops. Once we were comfortable that the config was working as expected, then we deployed our tool to other users. We deployed the end client to all endpoints using an RMM tool we use from SolarWinds.

We have a managed service provider who we use to support some of our IT needs. They were the ones who recommended the products and they would have been the ones who actually implemented the product and do much of the actual deployment with our IT service desk.

The implementation required around 2-3 staff members. It was one person from the MSP and two people in-house who would have worked on that project to deploy it. It was a normal project team for the deployment of that size.

Day-to-day maintenance only requires one or two employees. We don't have somebody looking at it daily, but our service desk will review it, update it, and amend things within the tool as and when required. It really runs by itself, it's not a huge amount of maintenance, which is a good thing.

ROI is very hard to quantify but Endpoint Protector is ultimately priceless. If device control wasn't in place, any single data breach that could occur as a consequence of a USB device being able to transfer data externally could result, for us as a business, in considerable loss, and considerable fines. There are massive fines for data breaches in the UK.

Data breaches could have a very significant reputational impact on our business. It's very difficult to quantify, but we haven't had any of these breaches. If we didn't have Endpoint Protector in place, we would be at a higher risk.

The pricing is very fair. No concerns. We don't have massive budgets, we're quite a small company, but we don't have small budgets either. I think it's quite competitive.

I don't believe there are additional costs in addition to standard licensing. 

We reviewed Ivanti Device Control, which is the previous tool we were using, and we compared it with Endpoint Protector's product set. Then we compared the prices and compared the features, and decided to go with Endpoint Protector over the previous supplier.

We have a third-party that automatically encrypts confidential data transferred to USB storage devices. That's not a use case for us with Endpoint Protector.

We exclusively use Windows. We do have instances of Linux, but from an endpoint point of view, it is exclusively Windows. 

As a business, we're never going to move into a Mac OS environment, so the fact that it supports Windows, Mac, and Linux wouldn't be one of our prerequisites. We looked at Endpoint Protector to make sure it supported Windows but the fact that it supports all platforms wasn't that important to us. Obviously, if it didn't work with Windows we wouldn't have used it, but from that point of view, it's not important for us now.

We also don't use it to search for keywords that are important to our business. We have a third-party tool we've had in use for several years that classifies all our data and ensures that we have visibility of where data is and what type of data is at risk.

I would rate Endpoint Protector an eight out of ten. I'm by no means an expert on the tool, however, it does appear to offer quite a large range of different functions within the toolset. Sometimes, it should try to focus on one thing rather than multiple things. Endpoint Protector does device control very well, which is why we use that particular function.

We store graphics files on our computers and they are confidential, so we implemented this product to block all of the computers from being able to send the data outside of our organization.

We use it to block USB ports so that people cannot connect an external hard drive, flash drive, or anything else that people can use to take files off of the system. Essentially, it blocks data transfer.

We only have two policies. The first is to block everything and the second one allows for Wi-Fi and Bluetooth connections.

This product does give us multiple choices for blocking data exit points. Without giving specifics, I can say that I know we have better security because of it.

We have Mac and PC machines, and it is very easy to manage both types. There is no noticeable difference in features between Mac and Windows machines.

We use role-based access for administering this solution, but as we are a small company, it is only insofar as having an administrative role that can perform any of the functions when needed. Some people can unblock certain policies, but we have a single administrator that can do everything.

The most valuable feature is blocking data transfer.

The software is easy to use and the dashboard is intuitive.

I have been using Endpoint Protector since I joined the company five years ago. I believe that they were using it for one or two years prior to that.

Stability-wise, it is very good and very safe. It seems to work fine.

We have approximately 117 endpoints and for the time being, I don't think that we will be expanding. We already have all of our computers.

I have not used technical support often, but every time I have, it was perfect. They have good support and they have helped me very well.

Several years ago, we used ESET but we found that it only logged the files that were transferred via the ports. This was not what we wanted to do, so we canceled the license and implemented Endpoint Protector instead for blocking the ports.

When I last renewed the license it was for a two-year term, and they gave me the second year at half price. It was a very nice gesture. Normally, I renew my license annually and I was happy to get a discount for committing to two years. There are no costs in addition to the standard licensing fees.

It would be helpful if they offered discounted pricing for long-term contracts to serve customers who are interested in committing for periods of three years, five years, or longer. I have been with the same company for five years, it was installed when I arrived, and we are going to continue using it in the future. Perhaps after a company has completed their first year, they should propose longer contracts to them.

My advice for anybody who is considering this product is that if they want something to protect data on both Macs and PCs then this is a very good choice. I have never worked with a product that is this easy to use.

In summary, this is a good product and for now, I think that it has everything we need. It seems to be a perfect match for us.

I would rate this solution a ten out of ten.

We use Endpoint Protector as our data loss prevention solution for Windows, Linux, and Mac machines. Our clients work from outside of our building and in different locations, and we need to use this product to keep our data secure.

There are many benefits to using this solution.

In terms of the granularity of policies that we can create, this is a good product. We have created two policies that are used on Windows, Linux, and our Mac machines. The first is related to screen sharing, and the second is responsible for blocking files in email attachments.

This functionality is important to us. At the end of the day, we get reports about files, the users, and what they are doing. Preventing screen sharing with unknown people, or accepting files from somebody who is not known, are both things that I want to prevent.

We get detailed reports that identify our clients and we can see how each of them is spending their day at the office. Essentially, we have good visibility of the traffic on our endpoints.

To this point, I have not needed to lock down a variety of different USB devices. I have not used, for example, a card reader. I have only used it to lock down USB storage devices. In the future, I may use more of these features.

I have had no difficulty with using this solution in our hybrid environment that includes Windows, Linux, and Mac machines. There is no difference in features between the different platforms. There are differences such as the web browser that is used. For example, in Windows, we use Chrome, whereas, with Mac, we use Safari. Certain things are different based on the software but otherwise, everything is the same.

The most valuable feature is device control. If you have the wrong devices connected to the network then it may cost you, and this product allows you to control them. For example, you can prevent users from using an external hard disk, which is something that I like.

There is a clipboard feature to ensure that a user cannot print their screen or take a screenshot. This is one of the reasons that we feel secure when using this product.

The users are happy with using this solution on a daily basis. 

I would like to see an alert feature that when a system is started, it checks to make sure that the client has the most up-to-date policies. Before the policies are updated, nothing can be done on the system.

We have been using Endpoint Protector for one year.

This is a stable product and we haven't had any problems with it.

We have between 50 and 60 people in our organization.

Within the past month or two, I have experienced problems and contacted technical support by email. They immediately responded and gave me suggestions on how to improve our security.

Normally, I send the support team an email and they answer within 24 hours. They analyze the problem and try to determine why it has occurred. They ask end-to-end questions such as what I was doing at the time, which allows them to assess and analyze all of the relevant points.

This is the first DLP solution that we have used.

The initial setup is very easy and there is nothing difficult about it.

Our deployment took one month and we didn't know anything about the product in advance. We didn't know exactly how it would work or which features would be added. The vendor explained everything to us after that.

The minimum number of licenses they sell is 50 or 150 users. They do not sell, for example, a package of 10 licenses. It would be helpful if you could purchase a smaller number of licenses at one time.

We did not evaluate other such solutions before selecting this one.

My advice for anybody who is considering this product is that it's user-friendly, and everyone can easily understand the details about how it works.

I am 100% confident in the security that I get from this product.

Overall, I think that our requirements for basic control, including application control, have been met. I'm happy with the current product and I like the feature set. That said, if they provide additional features in the future then we will use them.

I would rate this solution a ten out of ten.

The main reason that we brought this solution into our ecosystem is that we work with a number of financial institutions who value all of their data, whether it's marketing material, all the way up to client data, which we don't really handle as data.

Because we do promotional stuff, we need to adhere to what our clients are asking us to do to lock down the ability to lose data. We use Endpoint Protector to limit our employees' access to removing data off of company computers.

We are running the current version of the server, which I updated recently. We are running different versions of the client on different machines because we're currently doing some testing to see whether our software has conflicts with theirs.

We are a smaller company and at this point, we don't have a whole lot of concern about losing data. So, in that sense, using Endpoint Protector has not really improved anything. On the other hand, we've had a couple of hiccups where some employees have had issues with operations like attaching documents. In this regard, it's given us a slight burden, although we've been able to resolve such issues fairly quickly.

As time goes on and we become more familiar with the system, this will change. For example, as we run tests, and as we've done certain implementations, we've discovered some bugs here and there in the process and we have resolved them.

Endpoint Protector absolutely gives us the ability to lock down a wide variety of USB devices and it is extremely important to us. We have multimedia machines, and these machines are used for editing video. We use external devices as caching services or caching drives, and giving certain people access to external devices like that is a risk. However, locking down other flash drives gives us flexibility. It means that our media department can use their external devices while other people cannot.

The versatility in terms of exit points and making sure that important data doesn't leave our organization is something that I find extremely useful. It's been able to do exactly what we needed to have done so that we're adhering to our clients' standards. It's extremely valuable because it's blocking everything that we need to have blocked.

Because we're a smaller company, most of us don't typically use flash drives or other external devices to move data. However, what we really enjoy is the ability to lock down different applications, such as a cloud storage app or even its related website. This means that nobody can move data from a machine to a cloud-based system, such as Dropbox, for example. We can lock down the Dropbox app and the website so it prevents people from moving data via the cloud to it. Another example is blocking FTP transfers and all of those types of situations.

This product has the ability to search for keywords to help make sure that specific data doesn't leave the organization, although we have not used it. At some point in the future, we may get to that level of granularity. However, from a business standpoint, this is not a significant concern at this point. This implementation is primarily in place so that we are satisfying our clients that specifically ask for this type of protection for their data. Thus far, this level of granularity has not been brought up.

The most valuable features are the ability to prevent access to external devices, and also site blocking. We have two of the main features that we enjoy the most, which are device control and then Content-Aware Protection (CAP).

In terms of policy creation, you can get extremely granular. The ability to have multiple departments and having the ability to assign computers on top of specific users is fantastic. We don't utilize that section, but if we had a centralized computer that multiple people would use, I really enjoy that I could specify which user gets which policy. It's the same computer, but it's based on a user-level granularity. It's not just global rights on the computer. I really do enjoy that, although I don't use it.

We are not currently using the functionality for the automatic encryption of confidential data transferred to USB storage devices, although it is on our to-do list. This is something that we need to test in the future.

Endpoint Protection provides a single platform to support Windows, macOS, and Linux, and so far, managing DLP in our hybrid environment has been seamless. I don't see much of a difference between the operating systems in terms of what can and cannot be done. This is extremely important to us because we are 95% Mac-based, with just a few Windows machines. Our Linux machines have just been retired since we've gone 100% remote.

With respect to the feature parity between Windows and Mac, they're identical. On the user side, I don't see a difference between Windows and Mac because what you can do on the client-side is quite limited. On the backend, or server-side, they're identical.

This product provides zero-day protection for macOS, although I'm currently dealing with an issue on the most recent rollout of the Endpoint client that doesn't seem to be fully functioning. It is absolutely important to me, but it has not been successful. This is something that they are definitely working on resolving. I've had multiple IT consults where we've brought on a couple of developers to try and figure out what's going on with the Mac's most recent update versus their most recent update.

We have been using Endpoint Protector for between five and seven months.

Stability has been fantastic and I have had zero downtime. Once we solved the hardware issues, rolling out updates to the server has been flawless. So far, I've rolled out two updates and there has never been a software issue. The only problem was at the very beginning, and it was a hardware issue.

We have not had to scale the system. The software needed a decent machine to run it, and that was it. There are three people who have access to the server-side. There is me on the technical side, one is the office admin, and the other is the VP of marketing.

We don't have plans to increase our usage at this time, but rather it will maintain where we're at right now.

Technical support has been fantastic. They get back to me quickly. They're willing to schedule video conferencing so that I can share my screen. They're willing to bring on a level-two support technician to look at the details. They're able to supply everything for me support-wise.

We did not have another DLP in place prior to this one.

The initial setup was complex. I was not informed at the beginning of purchasing the software that they needed a cloud-based solution. They either hosted it at a cost or you needed your own dedicated server for it. I had been under the impression that they hosted the platform to then roll out updates, but didn't realize that it was a cost to it all.

It took more than a month to deploy because I had to source all of the equipment. They have a very good "how-to" document on deploying the software but once we got to that point, it was not the software causing a problem but rather, it was a hardware compatibility issue.

It was just me in charge of deployment, so you don't need a dedicated implementation team, although I did ask the technical support team questions. During this, their support was amazing.

There are other people in the organization who use the product but technical-wise, it is just me.

As of right now, we don't see ROI explicitly. However, the value is that when our clients ask if we're doing specific things, we can answer and make sure that we're in compliance with what they want us to do, which is keeping their data safe.

For what it's doing, the cost is somewhat high for us, but it's the cost of doing business with the clients that we have. Equivalent-wise, for what it can do, it's fairly close to the other competitors.

During the evaluation, we looked at Jamf and others. Jamf was a more Mac-based deployment software but they offered some of the things that we were looking for. There was a solution by Cisco but the price tag was so high that we didn't look at it further. We also looked at a Microsoft product, but they didn't offer anything on the Mac side.

What sets this system apart from everyone else is that it's one solution for multiple operating systems. Some products do really well in Mac environments but don't really have a good solution for Windows, and vice versa. This is one that covers the three operating systems that we need.

The biggest lesson that we have learned from using this product is that it can keep our computers and data from leaving the organization. That's extremely valuable for us, and I can see how it would be so for other companies, as well.

My advice for anybody who is looking into implementing this product is to make sure that they understand the requirements for the environment ahead of time. Our biggest hurdle at the very beginning was that piece of hardware. You have to make sure that you have either the cost evaluated within the budget to have Endpoint host that solution, or alternatively, that extra piece of hardware to house an internal machine.

In summary, this is a good product and I don't have any suggestions for improvement. We're new to the software and it is quite detailed. I've been able to do everything that I need to have done.

I would rate this solution an eight out of ten.

We use it for detecting the traversal of data through endpoints. We keep a multi-tier isolated environment, so we have inner and outer cordons of access control. And over VPN, users could potentially be one of the exfil points, at least the privileged ones with access. Being able to identify when information enters the system and leaves, based on a number of complex criteria, because we work with medical information from all over the world, is the purpose of it in our organization.

The solution is all on-premises. We're a healthcare organization, and that's actually one of the reasons we use it. We can't have a lot of our security functionality in the cloud.

We operate a Waterfall scene mechanism. We trickle up data from a bunch of different endpoint and network solutions to a central event and processing correlation mechanism. We're able to detect when somebody accesses data internally and correlate that to a DLP event when a file lands on their system. It actually provides a data point within our global view. It's an ongoing operation.

We also use it to monitor all clipboard activity. When a detection occurs, we can generally identify it pretty quickly, but someone would have to be copying some pretty specific data to match the policies we've created. When it occurs, we know. Generally, it's also in the line of business. We have healthcare analysts here, and that's what they do all day.

There are effectively two areas of DLP to look at from a technical perspective. One is how it performs the pickup of information traversing the system and the other is how the policy engine, which analyzes the data, works. On the first aspect, CoSoSys is probably best of breed for macOS because they're reasonably well-integrated into the operating system. They're looking at the file system operations level, not at the execution level. Whereas things like Forcepoint are looking at the applications being run and they try to apply policy to that. The pickup paradigm is a lot better than their competitors.

The search for keywords, in our security operations, is critical and we use Endpoint Protector for that. We're a HITRUST-certified organization, and one of the things we need to do is be aware of the movement of personally identifiable health information. Since we work multi-nationally, we have to be able to identify PHI from across different countries and their different medical coding standards.

Another valuable feature is the  Content Aware Protection. We use the device thing to some degree, but it's the Content Aware Protection that's critical for us. That's the aspect of it which is DLP. The content protection engine is what detects the data when it's traversing, and the rest of it is other ways to lock down the system from being able to move data in and out. But the detection aspect of it, that's the really key part for us, because we have to be able to record that, even if it's completely legitimate.

It's quite easy to manage DLP in a hybrid environment because you have the centralized server that receives telemetry from all of the agents. And because that's what's forwarding the telemetry on to subsequent log ingests, you get a single data stream across all of the agents. We also have host intrusion detection, which is backing a lot of this stuff for us. We have full command execution logging in every machine. Every command that is run is recorded. We can cross-correlate very tightly between the DLP and what's being done on the machine itself. That way, we know execution and data movement.

We use the role-based access features, for the teams that administer it, to some degree, because we have an auditing agency that reviews our policy compliance. It's satisfactory. We don't have complex requirements for it. We've got a couple of internal admins with equal privileges and then we have an auditor role. It seems to work fine.

The policy engine could use a bit of work. They're definitely going in the right direction. We've been working with them over the last few weeks to try and optimize that. But it's reasonably clear that they're just not putting as much effort into the policy engine as into other things, like content discovery.

It's somewhat lacking in terms of the granularity of the policies that you can create. Because this is a Mac environment, you have slim pickings. You have really good detection mechanisms, like Code42, but a lot of those players don't operate at the medium business size. So, in terms of the market segment, CoSoSys is really the only player that will be able to still effectively pick up on it, so they're the only game in town on policy. They don't really have much competition in this segment.

I've been using CoSoSys Endpoint Protector for two years.

The stability has been quite good. They did have one shaky patch cycle in the last two years, but compared to the ginormous mess in this industry right now, they're definitely doing better than most.

The scalability works for our use case. It's actually quite resource-light for what it's doing. Being an OSSEC author, I'm writing a C application that does a lot of the same stuff for processing of live-streaming, textual telemetry. They did a lot of optimization work to make this efficient. It's an expensive operation, inherently. What they're doing is really CPU-costly. Most of the time they don't match on anything, and the worst thing that an expression engine can do is not find anything.

We are constantly growing. We're probably going to be growing by 30 or 40 percent again this year. We're going to have to bump up our license counts.

Our experience with their technical support has been better over the last year. Initially it was a little bit shaky, but they've definitely gotten better. There's always room to improve, but on a scale of one to 10, they're probably at a six or seven. They're doing better than the rest of the industry, like Cisco for example, which is a one out of 10.

We did not have a previous solution.

We just used a Zen appliance, so it was incredibly straightforward; it was effectively drop-in.

Configurations are ongoing. As we get new data in, we do continue to configure. And, obviously, with updates and new features and features being removed, changes are made all the time, but the initial deployment took about half a day.

Our implementation strategy was to understand our data first. We do a lot of in-house software development, so we understand regular expressions, pattern matching, and mechanisms like that; what's expensive and what's cheap. We defined what was identifiable in our data, figured out an identification strategy and policy mechanism first, and then went to implement it across the board. We knew that the number of endpoints we had was relatively small.

In terms of the staff employed in the deployment, we're probably not typical. We hire top-tier talent. Everybody here starts out well into the six-figure range. So it takes one of us to deploy this. We're not your average shop.

In terms of maintenance, there's the occasional update. There is almost no downtime. The hypervisor is more unstable than the VM itself.

We have about 100 people using Endpoint Protector across our organization. It's literally everybody in the organization, including me and the CTO and the CEO. We're all beholden to this. There are no exceptions.

You get ROI in the first year. Endpoint Protector is a facet of our visibility into the environment, but it's a daily-use facet. It's like the passenger-side mirror on your car; you use it all the time. You could probably live without it, but you use it all the time. It's a necessity and it's a useful one. It's one that I endorse within our company to relicense every year.

Pricing is quite reasonable. For smaller organizations, it lets them get into the product domain, whereas a lot of vendors won't even talk to them. Endpoint Protector is just about at that sweet spot of being serious enough that you have to budget for it, but at the same time, affordable enough that the value is well worth it.

I work across the industry. I've used just about every solution. In the Mac space, CoSoSys is probably the market leader, because of the level of detail that they've put into the platform is very significant. They really did bother to optimize it and to make it run efficiently. A lot of these tools are afterthoughts on Mac and, if they do run at all, they destroy the machine. When you have a bunch of engineers trying to code, they notice.

This solution is right up there with Forcepoint Data Loss Prevention and Digital Guardian, but Code42 Next-Gen DLP is probably the closest comparable thing. But that is not a data loss prevention tool, it's just an identification and tagging tool. But it has a very similar semantic of pickup and analysis. 

Endpoint Protector is in the same market space as Forcepoint, in terms of pricing, but it's an apples-to-oranges comparison. Forcepoint is pretty well-known for having a good policy engine, but their detection and pickup mechanism, especially on the Mac platform, is just not practical. I can walk around it in my sleep. Again, we hire highly-talented engineers who can do the same thing, so if one of them decided to go rogue on us, Forcepoint just wouldn't help.

In my private practice, I work with a lot of other firms, including some design firms that are Mac-based and, as they start to ramp up their security—because they're now becoming vectors of attack into their own customer bases—this product is definitely something that's on the radar.

The ability to lock down a wide variety of USB devices is a secondary thing for us, because we do central policy management through another solution, so we have devices locked down through other policy engine mechanisms. But it is very convenient how CoSoSys has implemented it. That ability is definitely on the list for us but not at the top because for us, for policy regulatory compliance, we have to be able to tell when the data is moving in and out. That's the big thing we look at.

In terms of Endpoint Protector's support for Windows, macOS, and Linux, in our case, Linux is a non-starter. We operate big-data clusters. DLP just doesn't work in that context. The information is broken out into multiple pieces and spread all over the environment and traverses between the nodes as part of computation. DLP can't work in that kind of technique. As far as the Windows mechanisms go, we currently don't have Windows workstations or any Windows assets. I'm a red-teamer by trade, one of the people who gets paid to break into places, and Windows has a shared authentication model, meaning that if I compromise one of your servers or workstations, I can basically move unfettered throughout your network. Our environment is a mix, a heterogeneous environment, so that attackers would have to adapt to every different point they want to compromise.

Overall, Endpoint Protector really provides what you expect from it. There are no huge surprises one way or another. If you do your research, it's exactly what they say in their advertisements. They are not promising things they can't deliver. It does its job well.

We use it primarily for endpoint protection. We have to be SOC 2 compliant. We have a number of standards that we have to abide by for HIPAA reasons and SOC 2 reasons, which is why we initially put it in place, but we mostly use it for endpoint protection and MDM.

We have access to some healthcare data, at times, which means that we have to follow very strict guidelines. So we need the endpoint protection.

I like the main dashboard. It's very intuitive. 

The offline temporary passcode solution is really easy to use for both the backend administrator and the users.

The granularity of the policies that you can create is pretty sufficient. We haven't had to make any super-granular policies. I understand what its capabilities are, and it is really nice to know that if we have to crack down and be a little more strict on our policies, Endpoint Protector provides those features.

It also provides us with the ability to lock down a wide variety of USB devices, which is pretty important because we don't want certain data accessed. It does a really good job when it comes to the versatility of the exit points it supports, making sure that important data does not leave our organization.

Endpoint Protector also provides a single platform to support Windows, macOS, and Linux, although we don't use Linux, we just use Windows and Mac. It makes it pretty easy for me to manage DLP in such a hybrid environment. I find it intuitive. It's pretty vital that it supports Windows and macOS because we use both types of computers in our company. It provides Zero day protection for macOS.

There are times when the server needs to be updated, and it would help if I got a notification for when the newest version comes out, because at the moment, I'm going in every now and then and checking. Sometimes it comes out and I didn't know it had come out. It would be super-helpful if I got a notification saying, "It's time to update the server."

I've been using CoSoSys for a little more than two years.

It hasn't changed much since we started using it, so I haven't really found myself having to adapt or learn anything new. It has served all the purposes that we've purchased it for, so it's pretty stable.

We have such a small team that scalability hasn't really been an issue at this point. It's easy enough for me to manage it on my own. We have fewer than 50 employees, and somewhere between 50 and 60 computers, so I haven't really encountered any scalability issues. We've adopted it 100 percent.

For the most part, their technical support has been really responsive and good about setting up time to go over things. They have been pretty timely, in general.

We didn't have anything in place before.

It's really easy to install. I had to do most of them in person. At the time, most of us were in the office, so I just had folks drop off their computers at my desk for 15 minutes while I set it up. Some took less than 15 minutes. We do have some remote workers, and I used Zoom which has a remote screen option.

It was done over the course of a couple of days, because I had 50-something devices to do.

I don't know if Endpoint Protector has this kind of feature, because I didn't need to use it. But if I had more than 50 computers, it would have been really time-consuming to do the implementation. It wasn't that bad for me, but any more than 50 computers would be a little bit of a hassle.

Our return is that it serves the purpose that we need it for.

The pricing model changed the last time that we renewed, but it's reasonable compared to what's out there.

Choosing a solution was a discussion that happened before I was in the mix. I don't know if other solutions were discussed before this one was decided upon. I do know that it was something that another employee had used before and she recommended it. I don't know if a lot of other research went on or they just said, "Okay, since someone knows it and they've used it, we'll use it too."

In terms of feature parity between Windows and macOS, with Windows it takes a lot longer to install, but that's really the main difference.

I was looking for a DLP solution and Endpoint Protector happened not only to help with that, but also with the USB management piece. As a credit union we have a lot of sensitive data, so we need to be able to see it at rest and block it, and not only on-premises, but off-premises as well. A lot of people work remotely now and this solution is really working for me because once the endpoint is on there, I'm still in control.

I've seen, through all my policies, how exit points get blocked. The eDiscovery is one of the important things in Endpoint Protector. That's been working a lot for me, especially with the remote users. The eDiscovery allows me to see data outside of the network.

I have policies right now with eDiscovery for social security number, credit card, member number, and I created a duplicate SSN. So it's finding anything where that agent is installed, anything from the computer. It's finding all that data and it's reported to me.

I don't have a single most valuable feature. Every feature is really working for me. One of the reasons I bought it was for the USB block, but that's not as much a use case anymore since I have a lot of people working remotely. It's the DLP part that is more important to me right now, to pinpoint the data that's getting moved.

The granularity enables me to not only see a file, but to read inside the file and pull out the data inside it. The granularity is really pretty good on that. It's very important. Let's say somebody just exported a file or emailed a file or uploaded a file on the internet. Seeing the inside of the file is really important to me. Whether it's encrypted or not, I still can see inside the file.

I'm the only admin on it, but the role-based access is fine. I have one user that I give access to so he can just see device control and that's it. That's all I need him to see. I was able to do that, so I'm pretty happy with the role-based access.

I use the solution's clipboard granularity feature to monitor copying and pasting to specific exit points, and it works great. People are trying to get the data any way they can, from the clipboard and things like that. I'm able to see it, report on it, and block it.

I've been using Endpoint Protector for going on two years now.

I'm pretty impressed with its stability.

I don't see any issues or limitations with scalability. As long as you have the license, everything should be fine.

I'm managing about 300 devices right now.

One of the areas where there is room for improvement is support. It takes time for them to respond. They need to respond on time. Instead of sending an email, I think it would be very helpful to say, "Let's set up a WebEx to see what's really going on," instead of the back and forth of email.

I didn't replace any solution with this one. I was looking for a USB management solution. I have competitors like ManageEngine, but when I happened to find Endpoint Protector, with the USB and the DLP side of it in one solution, it was good to have that in one platform. I was going to have to find another DLP solution to be able to manage all this.

The initial setup was straightforward for me. They have good documentation, so if you follow everything it should be fine.

My deployment took a month. The implementation strategy for the solution was to set it up, deploy it to a couple of test machines, and see how it was behaving. Once that was done, I deployed it to everybody.

It doesn't require any maintenance on my side, other than when the updates come available. I get them installed and that's it.

I deployed myself.

I have definitely seen return on the investment when it comes to satisfying my auditors. I can show them I'm looking at all these things. And I'm protecting the credit union at the same time. It's really all worth it.

I don't have any issue with the licensing and pricing. I would love for it to be cheaper, but at the same time I'm getting a lot from it.

Compared to a lot of the USB management systems out there, Endpoint Protector is the only one that comes with true USB management and the DLP side of it. I'm pretty impressed because I've used several solutions with DLP and USB management, and I've never seen granularity like this solution has.

I haven't seen any solution like Endpoint Protector. Everybody says, "USB management: We can control, we can block, etc." And you have other solutions that are DLP only. Having it all in one place is really helpful. Not only do I have the USB management side, but I can come back and say, "All right, what's in that USB? What sensitive data is in there?"

I'm in a Windows environment, but I see it does MacOS, Windows, open sources. It has all of that on the platform.

I'm not using the EasyLock USB Enforced Encryption app to automatically encrypt confidential data transferred to USB storage devices. I'm more monitoring it. But I have the option of force it to encrypt.

Overall, I've never seen a solution with this much granularity. I didn't expect that. I did the demo, but it was only when I actually put in my environment and saw things and said, "Oh, wow." The reporting and the analysis have provided a lot of lessons learned. I didn't think I could get that much information.

We use it to block USB and any external devices for read-write. We only allow people to read an external device, not to write to an external device, unless we approve it. Our main reason is that we have 30 percent of our workforce working globally around the world. In addition, a lot of them do not have WiFi access, as they are working in the desert. We needed an application that allows us to unblock or block something by giving a code and could be sent by WhatsApp or SMS.

It's hosted on the cloud, then deployed to workstations. This is a portal from the vendor that we have access to where we can see and remove the agent.

Once you put a policy in place, you can see if somebody is trying to access something, even if it's not allowed and will not go through. In IT, we need to make sure that we think first before applying the rules that we do want. We have different groups levels of access. Once you have done this correctly, then it definitely stops any misuse of data and leaks. However it is not the software. It's you, as the administrator, who has to make sure that the profiles are set up correctly.

Sometimes, we have engineers who are in the desert taking pictures with an external camera, etc., and they need to send these pictures ASAP to our online portal for reporting. These devices are normally blocked. We can then very quickly (within seconds) open up this device for a certain time to be fully accessible. Then, we do not have to worry about it because the policy will kick in after the period that we have given. This helps us a lot when people are onsite doing reviews of company sites and they need to send a report. It also gives us control of what people can access at that moment, because most of our field engineers have zero access to any external devices. They are only given the device once we decide, "Yes, they need it and for how long."

We are a pretty small company. We only have an IT engineer who administers everything along with myself. We don't have a big IT team; it's only one engineer and me. The access is great because we can do it from home. We don't need to be inside the company since all of it is cloud-based.

There are a lot of features, but the main feature is that I can use a device serial number to unlock any particular machine or for all machines. If I have a phone, like a Samsung phone, I can whitelist that specific phone for full access wherever it is plugged into any of our devices. This is the same with a USB, because most USBs come in bulk and have the same serial number. I can then whitelist that particular USB to be read-write with full access.

When you want to uninstall and reinstall, there are a lot of issues. You have to do a lot of workarounds to reinstall Endpoint Protector. This is a major issue that we have constantly because we still have old systems with XP. While there are only very few, we need to run them because there are machines attached that only run on XP. When we need to uninstall and reinstall on XP or Windows 10, we have serious issues left in the Registry Editor everywhere. There is a lot of manual interference to get the reinstallation to work. For the uninstallation of Endpoint Protector, they need to work on this so it doesn't leave any leftovers behind.

We have been using it now for a little bit over one year.

The stability is very good. I had no downtime nor any other issues. It doesn't require a lot of maintenance from our side. We don't need to go, and make sure, "Is it running or is it not running?"

Even if people are not in our LAN, it's still protected. We have tested it in various locations.

If you ever need more devices, it would be very easy to get more licenses within 24 to 48 hours.

We are using 162 licenses.

If we have an issue, their support is great. They come back normally within the same day with either a solution or remote session to assist us.

We have rarely used Endpoint Protector support directly. We have very good connections with the reseller, who has a technical support that normally responds within the same day, or at least by the next day.

We had GFI EndPointSecurity, which was a good solution. I can't say anything bad about it. However, GFI stopped developing the product. For our use of just blocking external devices, it was very good, but Endpoint Protector is quite a bit better and has many more features. Even if GFI would come back, I would not go back to them because I'm extremely happy with the functionality of Endpoint Protector.

The initial setup is very straightforward.

Because our current system is from a different vendor, we needed to have minimum downtime. When we switched the old one off, we needed to switch the new one on instantly. The groundwork was done before the old one was switched off, then deployed over the weekend. Things worked absolutely fine. We had very few systems which didn't take the implementation. They were mostly those which were not online, but the rest of them worked smoothly.

Our reseller assisted us in our initial deployment by setting up some basic rules and helping us to understand how it works. From there, we took over. They were extremely good in their technical knowledge of the system.

It all depends on how the reseller supports this installation. We had a very good overview by our reseller and support during the installation. I found the installation very straightforward and quick, but that all depends on your reseller and how good they are trained. This process was very technical for us. The reseller assisted us in switching over within two days from the old system to the new one.

It is a software where I always want it installed, then up and running. The only time that you need to look at or interfere with it is when new agents are coming in, so you can deploy them. 

It has a fair price. They just changed recently from perpetual licensing. When I bought it, I bought it on perpetual license, then they changed the whole company policy to go to subscription. It was a bit of a shock to us because we haven't upgraded it that many times. However, after speaking to CoSoSys directly, they gave us a very good renewal price.

There are many vendors out there who do protection access of external devices. However, I haven't found any vendors, other than Endpoint Protector, who let you enable or disable the device without being on a WiFi, Internet, or just by giving a code. That was our main thing because maybe 30 percent of our workforce are around the world or somewhere in the desert with extremely weak Internet connections. This solution is a very good option where you can just send them an SMS code. Then, the code that we create depends on what we say, for example, "Should they have access for the whole day or 10 minutes?" Afterwards, I don't have to double check if the system is blocked. 

Have a look at a good demo. You will see the benefits of the system. We only use it for device blocking, but there are so many other features. It depends what you want out of Endpoint Protector. An overall demo of its capabilities will let you see that it is worthwhile.

There is an application out there that does multiple things in one go. We looked only at blocking off other devices, but we are rethinking that. Next year, we will be looking to buy usage of all the other features. It would be nice to have one application that does multiple things in one go, which normally other people would use several applications and software subscriptions to do the same thing. 

There are so many policies that we have not even had time to explore all of them.

We don't use the EasyLock USB Enforced Encryption app to automatically encrypt confidential data transferred to USB storage devices. Instead, we have a secure online storage called FileShare, similar to Dropbox, but only for us. This way, people don't save it on their USB and actually have to send it directly. They can only then send it from the camera into their desktop or laptop. Then, from the laptop, they send it directly into our cloud system.

I would rate this solution as a nine out of 10.