TrendAI Vision One – Endpoint Security Reviews

We use Trend Vision One Endpoint Security to protect our systems from unwanted attacks. Malware attacks, encryption, zero-day attacks, and other threats are all happening in the world today. Therefore, the main purpose of using this product is to protect our systems.

Most of our customers deploy Vision One Security as a cloud service, except for government agencies, which always deploy it on-premises.

The XDR feature helps detect and defend our endpoints against threats.

The protection features can help defend against unknown threats. When an unknown application is detected, we can send information about it to the Vision One Security team for analysis and signature creation, which will be shared globally.

The machine learning capabilities help with the detection of ransomware which is important.

Vision One Security provides a single console for cross-layer detection, threat hunting, and investigation.

Vision One Security provides end-to-end visibility into the entire IT security environment. We can use the added visibility to decrease our response times.

Vision One Security integrates with other security products. When a threat is detected in the network sandbox, Vision One Security can deploy rapid updates to the endpoints. It's important that the solution can identify the threat and provide a rapid update.

Vision One Security has helped our organization by protecting us against unknown threats and reducing our response times.

It uses virtual patching to protect against vulnerabilities before vendor patches are available.

We have seen a reduction of 20 percent in viruses and malware since moving to Vision One Security.

Vision One Security as a service has helped reduce our staff workload by 30 percent.

We used Trend Vision's managed XDR services in conjunction with Vision One Security and they helped with the integration and patches.

Real-time scanning is a valuable feature.

Patch management is an important feature that helps protect our machines.

The XDR feature which provides us with real visibility into our environment is the most valuable.

I would like to have DLP features implemented into Vision One Security. We have a lot of customers asking about DLP.

I have been using Trend Vision One Endpoint Security for almost four years.

Vision One Security is a stable solution. I would rate the stability eight out of ten.

Vision One Security is highly scalable.

The technical support is good but we sometimes experience delays with some tickets.

We previously used Sophos, but its console was resource-intensive and impacted the performance of our Windows machines. Vision One Security is more resource-friendly than Sophos.

Deployment is complex, and most organizations use scripts to automate the installation process. Each environment is different, and deployments typically take two days to complete.

Vision One Security is expensive but we manage to work with the cost.

I would rate Trend Vision One Endpoint Security nine out of ten.

Trend Vision One Endpoint Security can be challenging to learn due to its extensive features, but it is easy to manage once we are familiar with the console.

Our customers range from small to enterprise businesses.

Maintenance is required for packet releases on the servers.

Many customers are moving to this type of centralized system, and I recommend Trend Vision One Endpoint Security.

We provide Trend Micro Apex One to our customers to protect their endpoints.

The database engine is more efficient than other endpoint solutions and this helps protect against threats.

There are advanced protection capabilities that adapt to protect against threats, and its AI helps detect unknown threats and user attacks.

Trend Micro Apex One detects ransomware using its runtime machine learning capabilities. It can identify suspicious or infected machines and help to remediate them.

It provides a single console for crossfire detection, threat hunting, and investigation. The single console UI provides end-to-end visibility into our IT environment.

Apex One integrates efficiently with other security products. We can connect with the vendor that provides us with the API needed for the integrations.

The learning curve for Apex One is short. The steps required are easy to understand and follow.

Administering it is not difficult.

It has helped our customers by providing many features that help them scan their environments and provide recommendations to improve their security posture. These features include an intrusion prevention system, application control, and a firewall with filtering.

Trend Micro Apex One has helped our customers reduce the number of viruses and malware by 80 percent.

Trend Micro Apex One as a Service has helped reduce staff workload by providing reports that alleviate the headaches of security teams.

The AI and machine learning feature is the most valuable because it helps mitigate threats based on an organization's behavioral patterns.

Some of our customers need to add cache file signatures in Trend Micro Apex One, but it is currently not a supported feature.

Trend Micro Apex One can become the market leader by improving its signature base, patterns, security profiles, engines, and integration with multiple vendors.

I have been using Trend Micro Apex One for three years.

The technical support is slow to respond.

Neutral

The deployment is straightforward. First, we deploy an SQL database to consolidate all of the organization's databases into a single, easy-to-manage database. We then download the Apex One Security Agent to the Apex One portal and install it on the target endpoints. Once the agent is installed, we receive the ports, IP addresses, and IIS names of the endpoints. We then install the Apex One Security Agent on the Trend Micro Apex One site and configure it to scan the agentless operating systems for integration with Active Directory.

Three people are required for the deployment.

From what I understand the pricing is not expensive for Trend Micro Apex One.

I would rate Trend Micro Apex One a ten out of ten.

Our customers in the oil and gas industry deploy Trend Micro Apex One across their environments.

We use Trend Micro One Endpoint Security for endpoint security. We are using the SaaS version of One Endpoint Security. 

I am confident in One Endpoint Security's capability to defend endpoints against threats like malware, ransomware, and malicious scripts. 

One Endpoint Security has predictive machine learning and behavior monitoring, which are essential for endpoint security. Our file scan also scans the memory for malware. Behavior monitoring is particularly effective at detecting ransomware attacks because it can check for unusual encryption methods.

I like the way Trend products integrate with each other. The servers are all tied into Central, which is now integrated into my Vision One console. The on-premises stuff is also integrated with Azure.

We use a single dashboard through The Central to view detections, threat hunting, and investigations. The visibility through the single console is important. When we open the dashboard, it tells us what it has found. For example, I am currently looking at the SaaS version. If I go to One Endpoint Security, I can see all of the agents that are currently connected. It takes a few moments for all of the agents to load. We are currently in a downtime during the summer months. We are a school board, so there are fewer staff members on-site, and not all of the schools are open. We have 12,000 employees and 80,000 students. However, not all of the students are online right now as they would be during the school year. Next Friday, we will have more staff members in the office. When school starts after the Labor Day long weekend in Canada in September, everyone will be back online. Currently, the dashboard only shows 9,140 agents. Last week, it showed 6,400 agents. I have the system set up to remove inactive agents so that the system does not have to constantly scan a bunch of systems that are not even there. I have seen up to 17,000 endpoints on our system.

Vision One is now monitoring my Cloud One workload security and My Cloud Central. This means that Vision One is collecting data from both systems and giving me a comprehensive overview of my security posture. When I open Vision One, I will be able to see visibility into my entire organization. I have configured Vision One to send data to our Syslog server and receive data from our Qualys server. The Qualys server scans my servers for vulnerabilities and reports back to Vision One. I have also set up a service gateway and a workload security data center gateway. The workload security data center gateway feeds data from my VMware ESX servers into Vision One. This allows Vision One to see the real-time status of our VMs, including which ones are powered on, which ones are running the Deep Security Agent, and which ones are still running on my on-prem Deep Security server. Vision One provides me with a risk overview, an exposure overview, and an attack overview. This information includes details about credential access, lateral movement, collection impact, and suspicious mail forwarding rules.

We have our Azure system for Office 365 and on-premises Azure Active Directory also connected to Vision One. This means that Vision One can see all logins to our Azure system and our on-premises AD. I have agents running on our on-premises directory controllers, so this data is also being fed into Vision One. Vision One can also see our Azure domain controllers and our DMZ. I receive alert emails when something serious happens. I haven't received any of these emails since we started using Vision One. However, I receive emails about endpoints that have had files quarantined. The file on the endpoint was too large to move to the main server quarantine, so Vision One just gave me a small error message. Currently, the endpoint protection dashboard shows that out of 19,678 endpoints, agents have been deployed on 13,675. This includes Macs. The dashboard shows one Linux endpoint, which is my service gateway. There are 882 Mac OS endpoints, which is lower than the usual number of 1,100 because not all of them are turned on. There are 12,792 Windows endpoints. The dashboard also shows that 6,003 endpoints have no security protection. These endpoints likely include network equipment, certain Linux servers that are not running Trend Micro software, and proprietary operating systems that are used by our network team and other IT groups. There are also endpoints that are listed in our Active Directory, but they are either turned off or do not have any active systems.

Updates are applied on an hourly basis. If an exploit gets through and an endpoint has not been updated, it will receive the update on the next cycle. The most common reason for an endpoint not receiving an update is a network issue or the endpoint being powered off. Once an endpoint goes online, it is configured to automatically retrieve security updates from the server, or directly from Trend Servers over the internet if the server is unavailable. The first thing the endpoint does when it goes online is update its security patches, signatures, and scan engines. When a detection is made, the endpoint first deletes the file and quarantines it. It then blocks the action of whatever the file was trying to do. The endpoint's virtual patching, behavior monitoring, and predictive machine learning then stop any unusual activity. This may even include an activity that is supposed to happen. We have had members of our ICT department complain that they were unable to install software because the antivirus protection was blocking it. In some cases, we have groups within our organization that are responsible for maintaining their own servers. When they are doing upgrades, they may schedule us to temporarily disable the antivirus protection so that they can complete the upgrade. Even if malware does not get detected by the web reputation system and is downloaded by a user, it may still be detected by the signature-based malware detection system. If it is not detected by either of these systems, it may still be blocked if it tries to contact its master. These master addresses are often common addresses on the internet that are used by bots to communicate with a server that is maintained by the threat actor. If a bot is blocked from contacting its master, it will be unable to function. If we see a large number of bots being blocked, we will investigate the system to see what is causing the issue. In many cases, it turns out to be a legitimate activity that is being blocked by the system. For example, we may have custom scripts running on certain servers that look suspicious to the system. We can manually whitelist these scripts so that they are not blocked. Overall, the system is designed to be overprotective. This is because it is better to block something that is legitimate than to let malware through. We can always fix a false positive, but it is much more difficult to fix a security breach.

I started using One Endpoint Security in August 2020. I learned how to move agents, install software, and get the agent onto the server. I also learned from the documentation, knowledge base, forums, and other users. I found One Endpoint Security to be more difficult to learn than PaperCut because the terminology and concepts are different. PaperCut is just about printing and monitoring, while One Endpoint Security is about cybersecurity. There are also many caveats to consider with One Endpoint Security. I found the scan settings to be particularly challenging. Trend Micro has helpful best practices documents, which I used to learn what the normal settings are for servers and workstations. For example, servers don't need to be scanned for office document exploits because they typically don't have Office installed. I also learned that it's important to balance security with performance. We don't want to scan servers so heavily that it slows them down, but we also don't want to skip important security checks. In January 2021, we changed our policy on security settings. We now tell users that if there are any problems, we will fix them. We would rather have a small problem that we can fix quickly than have to restore a server from backup, which can take days.

One Endpoint Security provides virtual patching, also known as vulnerability protection, to protect against vulnerabilities before they are exploited. Deep Security and Workload Security call this feature intrusion prevention, but it is essentially the same thing.

Workload security now has a feature called Activity Monitor for each endpoint. This is a free version of their Endpoint Basecamp product that is automatically installed with every One Endpoint Security agent. Even if we are not licensed for Endpoint Basecamp, it will still be installed. On the servers, I had to remove the Endpoint Basecamp and then deactivate and reactivate the workload security agent to get the Activity Monitor working properly. However, I am glad that we get free monitoring for our servers, even though we do not get it for our workstations.

The agent program version column in the agent screen, we could never sort by. It's so handy to be able to sort by that now. We can go to one end of the scale to see the lowest agent version, and then go to the other end to see how many are updated to the latest agent.

Microsoft's new Azure Code Signing is causing a lot of issues for us with One Endpoint Security. We currently have two systems in operation, on-prem and SaaS, and many of the agents won't upgrade beyond version B11564 because these newer versions require Azure Code Signing compliance on the endpoint. If we are not up to date with our Windows updates, we don't have this compliance. Irrespective of the Windows version we are running, we have to apply patches to the machines, if the OS is not damaged, to make them compliant. After that, we can upgrade to the latest version of the respective agent. This process also applies to both Deep Security and Workload Security.

I have two production servers: one for Windows and another for Mac. These servers are available in both on-premise and SaaS versions. Additionally, I have a test server that is located on-premises. The significant distinction with the SaaS version is the absence of a test server where I can install a new version. This means I can't allow the agents on it to upgrade and then perform testing. In contrast, with the production SaaS version of One Endpoint Security, I have numerous agents transitioning and coming online. It's essential that these agents upgrade to a newer version. Among these agents, there are five or six different versions, not counting the really old ones that have yet to upgrade due to ACS non-compliance. I can't leave the testing phase for an extended period because I still have outdated agents that need to be updated. These agents can't be left hanging while I wait to test the newest version that has just been released. New versions seem to come out every couple of months in the SaaS environment. In the past, when I solely used the on-premises version, I would review security bulletins for the SaaS version to identify any issues. I'm apprehensive about potential future situations involving this, primarily because the majority of our agents now operate on the cloud version. If a problem is discovered, rolling back on those agents would be challenging. It would require careful operation to revert them to a different version.

The on-premises version of One Endpoint Security has an update function that allows us to manually update a bunch of servers. For example, if I just turned on a policy, I can force the agents to quickly download the policy and start following the update procedure or update settings. However, this function is not available in the SaaS version. This is because the system cannot communicate with the agent through the firewall. The SaaS version has an automatic update function and an update source entry in the update agents sub-menu, but it does not have a way to force agents to update. This is a problem because we cannot automatically update the agents. We have to manually log in to the machines and give them an update command. Currently, we have no choice but to wait until the agents find the updates themselves.

I have been using Trend Micro One Endpoint SecurityOne for three years.

I have the enterprise version, so I can usually talk to someone in the Philippines even during after-hours. I only do this when it's something that can't wait until the next day. If it can wait, I'll let it go until then. But if something is broken and needs to be fixed right away, I'll get in touch with the Philippines team. They have some good people there, and the support is really good. I think Trend's support is probably the best of any of the vendors I work with.

I have a few open tickets, and one of them involves the developers. They keep coming back to me with questions that they have passed on to the service representative I'm working with. The developers want to know why I'm seeing something that they think I shouldn't be seeing. I'm generating a report that is supposed to show me all the endpoints on our workload security server that do not have agent self-protection enabled. This is part of the Vision One report. One of the endpoints that the report identifies is our service gateway. It is running Ubuntu Linux and has a Deep Security agent installed, but agent self-protection is not enabled by default. There is a way to enable it, but it's not typically done for Linux systems. Agent self-protection prevents unauthorized configuration of the Trend Deep Security agent service settings. This means that we can't change or stop the service without first disabling agent self-protection.

Positive

I would rate Trend Micro One Endpoint Security ten out of ten.

My concern arises when an endpoint lacks One Endpoint Security, as we are not actively monitoring for this. While we possess a scanner, this is why I intend to maintain the on-premises system's functionality. I plan to transition away from the deep security system and migrate the application team to the cloud version, although this transition process is currently pending. I need to retain the on-premises One Endpoint Security primarily for assessment scanning purposes. This involves scanning all items listed in our active directory, along with the subnets for our VPN, to identify unprotected endpoints. During a recent scan, I identified nine such endpoints and proceeded to install the agent on them. Occasionally, there are instances where the agent won't install, but no error message indicates a connection issue or existing installation. Some of them show as not having the agent installed, even though they do, which can happen when the endpoint is booting up during the assessment scan and the agent hasn't yet been loaded. Resolving this is relatively swift, although there are instances where devices not compliant with ACS will trigger a message stating that the agent cannot be loaded. These devices are then flagged, and I work on making them ACS-compliant to ensure proper agent protection.

The noteworthy aspect of One Endpoint Security is that we didn't begin using it extensively until the third quarter of 2021 when vulnerability scanning was initiated. Although we had an Central server, we were not using any policies on it. To enable Vulnerability Protection, we needed to implement endpoint policies in Central. Vulnerability protection involves virtual patching, where regular scans check our operating system's vulnerability to known exploits. It also includes monitoring applications for vulnerabilities and guarding against those vulnerabilities until they can be patched. This process is largely automatic, as the rules to counter cyber threats are introduced until the system is patched, at which point they are removed automatically. In contrast, on the Deep Security side, I need to execute this process manually. A weekly automated scan takes place, followed by an emailed report. This report aids in identifying missing policies or necessitated rule adjustments based on scan findings.

We have to constantly monitor the systems to make sure it is okay. I have email alerts coming in from Trend Micro One Endpoint Security, and Central Systems. I have folders for workload security, deep security, and Trend Micro in my inbox. I check these folders even when I'm not online to make sure there are no major alerts. In a way, this gives me peace of mind. As long as the agents are running properly and there is enough memory and disk space, everything is fine. However, I still have to manually check the System Event Log to see if any One Endpoint Securityendpoints are running out of memory or disk space. We also use SCCM. I set up a scheduled script to create a report of all endpoints with less than 1 gigabyte of disk space. I put this report in a folder that is accessible to all of our school techs and team leaders. This way, they can check the report periodically to see if any endpoints need to be reimaged or have some garbage removed from the disk.

We use Trend Micro Apex One for our organization to provide security between departments.

It was implemented to help with all the policies regarding our migration.

Trend Micro Apex One does a good job defending endpoints against threats such as malware, ransomware, and malicious scripts.

Its advanced protection features can adapt to safeguard against unforeseen and cleverly disguised new threats. This is particularly crucial in the education sector, where our staff and students frequently visit research websites that may harbor potential security risks.

Apex One can detect ransomware with runtime machine-learning capabilities. This is useful for us.

Apex One provides us with a single console for cross-layered detection, threat hunting, and investigation.

The single console provides end-to-end visibility into the entire IT security environment.

A single console streamlines our response times, allowing us to save up to two hours. Previously, investigating issues required navigating multiple portals, which was time-consuming.

It is easy to learn and use.

The main benefit is the protection of our devices and systems.

We have not received any viruses or malware since implemention.

Apex One has helped reduce our administrative overhead.

The policies, protection, and ease of use are the most valuable features of Trend Micro Apex One.

When I create and implement a new policy, it takes a couple of hours to apply to the devices.

I would like the ability to customize the report notifications and who they are sent to.

I have been using Trend Micro Apex One for almost three years.

Trend Micro Apex One is stable.

It is easily scalable.

The technical support is good.

Positive

We previously used Symantec. 

I would rate Trend Micro Apex One 9 out of 10.

We have 2 administrators for Apex One with 600 endpoints deployed across multiple departments in one location.

Maintaining Apex One is easy.

Trend Micro Apex One is a user-friendly solution with great features and I recommend it to others.

We use Apex One to protect our endpoints and servers against viruses. 

Apex One offers a lot of bang for your buck. It includes an antivirus solution, DLP, app control, and all the other features found in endpoint protection solutions like Microsoft Defender. Many other solutions require additional licenses for different operating systems, but Trend Micro software bundles everything.  Many other endpoint protection platforms are restricted by the operating system, but this is an all-in-one solution. The firewall and other aspects of endpoint protection can all be managed from one point.

We are pleased with the antivirus features and the overall experience. Trend Micro has enabled us to catch all the malware scripts and nasty things out there. We have a multilayered defense with different antivirus vendors and layers. It's easy to integrate Apex One with our other products. 

Once Apex One is set up, it isn't problematic to administer. The correct configuration and deployment is something that takes time. It isn't necessarily specific to Apex One. It's true of all vendors because you have guidelines and specific rules.

We had issues with our system integrator who didn't have enough experience with Trend Micro. There aren't many enterprise customers in our country who use Trend Micro on the level that we are using it, so it might be a little too complex for them. Trend Micro is typically used in small companies that do not need all the advanced features that we are looking for. The integrators don't have experience deploying these features. The scope is broad, but Microsoft Defender is simpler. 

Many vendors are pushing customers to the cloud for advanced XDR features. This drives costs up substantially and takes control out of the customer's hands. I would like Trend Micro and other vendors to make the advanced capabilities that are increasingly being deployed to the cloud also available on-premise.

We have used Trend Micro endpoint protection products since 2010. We had OfficeScan and Deep Security at one point.

I rate Apex One nine out of ten for stability. 

We haven't had any issues with scalability.

I rate Trend Micro support seven out of ten. Like most vendors, Level 1 support is catastrophic. At Trend Micro, everything starts at Level 1, and the process of how quickly you get from Level 1 to Level 2 is something all vendors have issues with.

Neutral

We were using Sophos. Trend Micro Apex One is bundled with other enterprise protection products, so it covers more than just antivirus.

We had some initial challenges configuring high availability on our server, but it wasn't difficult otherwise. 

We had help from a systems integrator and Trend Micro support. I rate the integrator two out of ten and Trend Micro seven out of ten. 

We have seen a return on investment. When we initially switched to Trend Micro, we reduced the licensing costs by decreasing the number of products we use. In three years, we recovered the initial investment, and our costs have been more optimal since then. 

Apex One's pricing is highly competitive. That's one advantage. We compared the pricing of solutions that do everything we want, and others are more expensive than what we have. There are no additional maintenance fees, but we have a support contract that we renew annually. 

I rate Trend Micro Apex One eight out of ten. I would recommend Trend Micro to companies looking for more than basic antivirus protection. If you need firewalls, application control, device and USB control, Trend Micro bundles all of that. I would recommend Trend Micro to a company that needs to cover all those areas

We were using it for our endpoints. We had more than 1,000 points. 

We were using it for anti-malware, DLP, and device control. We also used encryption, which did not work well, but the anti-malware, DLP, and device control capabilities worked very well.

By implementing Apex One, we wanted malware protection for our endpoints. We also had a requirement for a data loss prevention solution. It was integrated into the Trend Micro suite, so we got three capabilities: malware protection, DLP, and device control. The Trend Micro suite worked for these three use cases for us.

Device control worked as expected. We tried other solutions too, but they did not work the way we configured them, whereas with Trend Micro, it was not difficult.

Apex One was good at defending endpoints against threats such as malware, ransomware, and malicious scripts. In the five to six years that I used it, I did not have a single issue. All the endpoints were protected. I did not have any outbreak or anything else. It was effective.

Apex One had advanced protection capabilities that adapted to protect against unknown and stealthy new threats. It was pretty good. In the reports, we could see the outbreaks mitigated by Trend Micro. It automatically provided an alert.

Apex One provided us with a single console for cross-layer detection and investigation, but I am not sure about threat hunting. As I understand, threat hunting is something that comes under the SIEM solution. I am not sure whether it has threat-hunting capabilities or not. I did not deal with that.

Apex One integrated well with other security products. It was good. We integrated it with our SIEM solution. It was seamless. When a threat was detected, it deployed rapid updates to endpoints. It was very critical. I could see that every two hours, definitions were getting updated.

Apex One has consistently been a good product. It consistently performed well for me. It kept getting updated for any new evolving threats and ransomware. I did not have any issues.

Apex One provides virtual patching to protect against vulnerabilities even before a patch is available for the source of the issue. Because we did not have any issues, we were not very concerned about that, but the feature was there.

Device control works well, and the anti-malware updates are also pretty good. Every two or three weeks, you get updates. The frequency of the release of new definitions is quite good. We had peace of mind.

It was easy to administer. It was easy and user-friendly. When new technicians joined, we just provided access to them. They could efficiently manage it. It was not very difficult to train them.

Trend Micro's encryption is not up to the mark. We tried their encryption product, but we did not like it. Encryption was difficult to manage.

Other than that, I do not have any input. We did not go into XDR. We were planning, but then we moved to another solution. The product is stable, and they should keep working on handling new threats.

I used it for five to six years. I stopped using it three months ago.

It was pretty stable. We never had any problem related to stability, where it was not performing or not updating. 

It is easily scalable. If an organization has 500 endpoints and they are expanding to 1,500 endpoints, the migration is not very difficult. It is easy.

We had a support partner to support us. Whenever there was a technical issue, they helped to resolve it. I never went very deep into it because our partner used to handle the technical support service.

We were using McAfee. We switched because the pricing of Trend Micro was competitive at the time. 

We were happy with McAfee, and we were happy with Trend Micro. We did not have any issues with either product. We did not see any reduction in viruses and malware after moving to Apex One.

It was an on-premises solution. My team and I were involved in its deployment.

It took us about three to four months to completely implement it. We took our time. We first implemented it on some of the machines and saw the results. We then implemented it on other machines. Within one year of implementing it, we could realize its benefits.

We work with a consultant. He supported us with any technical issues. The initial configuration and installation on a certain number of machines was done by the consultants, and later on, my team handled it. Overall, we had seven to eight people who were involved in its deployment.

For managing it, I had two resources for managing servers and different applications. They could manage Trend Micro along with them. I did not have to have a separate resource for it. The same two people could handle it along with their other responsibilities. They were responsible for monitoring, updating clients, and checking the client status. They checked how many clients were updated and troubleshooted the ones that were not updated. They looked at the compliance reports and alerts.

Its price is competitive.

We did not evaluate other options because Apex One was already being used in other groups in my company. They were satisfied with it, and it also had better pricing, so we just went for it. We did not evaluate other products.

It is pretty good. We did not have any surprises. We did not have any kind of attack. Trend Micro provided good protection. It gave us confidence.

It has a lightweight agent. The installation is not very difficult, but the partner should be competitive enough. The product is good. It does not require much maintenance, but you should have a good partner to support you. 

Overall, I would rate Apex One a nine out of ten.

Some customers require on-prem endpoint protection. When they need endpoint protection and DLP features with ransomware protection and firewall features, I use this product. And when they need multi-layer security, like application layers, network layers, IoT devices, and network switches, then I provide the XDR solution. 

As resellers, we benefit from the solution offering multiple events, seminars, and more, to gain knowledge and help clients. The solution offers a lot of updates and support to their partners. Solutions like Sophos don't have principals in our country (Pakistan) either. They are in the UAE. 

The core endpoint protection is the most valuable aspect. The DLP features are very good. The firewall security is also excellent. 

When a customer wants DLP features and endpoint protection, they can not get it from Sophos or Kaspersky. Only Trend Vision offers certain features.  

Trend Vision One Endpoint Security is great for defending endpoints against threats such as malware and malware and malicious scripts. Their AI feature is very attractive and very good as compared to the other malicious traffic detecting solutions. Trend Vision has excellent AI features and sensors are available when we use the XDR solution. 

They provide email sensors in the network devices. They provide the sensor in firewall traffic. The sensors are very good, and they're working well. 

Trend Vision offers virtual patching, which is a very good feature.

It has advanced protection capabilities that adapt to protect against unknown and known threats. They are connected with the global threat intelligence forum. They also have their own threat intelligence. They get data, use sensors, and have the capability to mitigate various attacks, including zero-day attacks. 

It detects ransomware with runtime machine-learning capabilities. Benchmark protection is necessary when customers have confidential data. They need the backup solution or they need two anti-ransomware detectors to make sure they are protected. That way, when attackers compromise any end users, they stay on the end user, and cannot spread. 

The product provides our customers with a single console for cross-layer detection, threat hunting, and investigation. They have a central dashboard for network administrators who can control everything from one window and analyze all of the end users and their activities. We can do single threat hunting from the console. Customers want the ability to see all events in their network and on their endpoints. It makes administration easy and more user-friendly. 

There's visibility into the entire IT security environment. This end-to-end visibility reduced our customer's response times by 30% to 40%.  

Trend Vision One Endpoint Security integrates with other security products. You can integrate with other Trend Vision products and third-party solutions like firewalls. The productivity with the integration goes from 70% to 80% up to 100% when you integrate with Trend Vision solutions. It's better to create a Trend Vision environment. 

Trend Vision One Endpoint Security deploys rapid updates to endpoints. Their sandbox is good. They have, as mentioned, very good threat intelligence. They're sharing details on global direct intelligence with Palo Alto, Kaspersky, and Sophos. They share all the events, and all the intelligence, and upgrade their sandbox accordingly. 

The updates to endpoints are very good and necessary to ensure protection from the latest threats. 

The learning curve is low. It's easy and user-friendly to learn. You need to be a bit technical to properly administer the product.

Trend Vision One Endpoint Security offers very good virtual patching. This is important for customer networks. The patching allows multiple authorities to double source patching of endpoints. This helps with audits, as it allows for regular patching to ensure endpoints are up to date and protected according to compliance requirements. 

We've seen reductions in viruses and malware since using the product. There are multiple levels of scanning, and AI helps to reduce threats and viruses. We've seen an overall reduction of 70% to 80%.

It's reduced administrative overhead overall thanks to its centralized dashboard and single network administrator. It reduced overhead by about 50%.

The main problem I faced with the solution was when customers were trying to buy the solution, they wanted a reasonable price, and when you compare this with Sophos or Kaspersky, Trend Vision is competitively more expensive. The price is the main concern of the clients. Otherwise, the solution is very good.

I'd like to see Trend Vision One Endpoint Security include role functionality and server protection. Users should have better email protection to ensure high results.

Customers would like DNS security improved in the product.

I've used the solution for three years or more. 

The solution is stable. 

Customers have been very happy with their ability to add endpoints. 

We manage the SLA for one- to three-year periods, and if any policies need changing, etc., we are there to help customers. There are people who monitor the network and offer on-call support. When customers need field support, my team can assist.

When we do need the assistance of support, we've been satisfied with their response. They are quick and effective.

Positive

I'm not a fully technical person, so I was not directly involved in the deployment. My pre-sales manager was largely involved in deploying and handling the dashboard as well as administering it to multiple end-users. If we run into any trouble, we can get help from Trend Vision sales. They can provide guidance. 

The solution is working okay. There is no maintenance needed. 

The solution is quite expensive.

I'm a reseller. We sell the product to clients. Some of my customers want DLP and firewall options, and some require endpoint protection. Trend Vision One Endpoint Security is powerful when a customer requires protection and not detection. I'm also working with Trend Vision's XDR solutions.

I'd rate the solution nine out of ten.

Our customer experienced a ransomware attack while using a different security solution. This prompted them to switch to Trend Micro Apex One, which they deployed for both their servers and endpoints. However, they only opted for the Endpoint Detection and Response version for their servers, not for their endpoints.

We have deployed Trend Micro Apex One to strengthen our defenses against viruses, enhance access control, and implement device control measures.

Apex One effectively defends endpoints against threats, including malware and malicious scripts.

The advanced protection capabilities adapt to safeguard against unknown and stealthy new threats, a critical advantage for our customers. We often observe that our customer's systems lack proper patching, making them more susceptible to infections. However, Apex One effectively mitigates the damage caused by these attacks.

It utilizes runtime machine learning capabilities to detect ransomware. This is crucial as ransomware poses a significant threat, and customers are increasingly moving beyond traditional antivirus solutions due to ransomware's heightened prevalence.

Apex One offers a unified console for cross-layer detection, threat hunting, and investigations, depending on the services we subscribe to. Utilizing a single console for these tasks is crucial as it eliminates the need to manage multiple solutions and their respective consoles. When a single OEM provides its solutions within a single console, it presents the most efficient approach, eliminating the need to toggle between different consoles, manage disparate systems, and correlate data across multiple platforms.

Apex One provides around 95 percent visibility into our IT security environment.

Improved visibility can help reduce response times and proactively address issues with our endpoints. This allows us to take a more proactive approach rather than a reactive one.

Apex One is easy to learn, but like any security product, it requires additional skills beyond simply navigating the solution. However, for those who need to explore the solution and figure things out, it is quite convenient. Technicians should not take long to adapt to a user's experience with any kind of endpoint security system.

It has improved our customers' security posture, enabling them to realize the benefits within the first three months.

Apex One proactively shields our customers from vulnerabilities by employing virtual patching, even before a patch is available for the underlying issue. This proactive approach proves invaluable in safeguarding against emerging threats.

Ideally, the reduction in risk stems from the implementation of multiple security measures. For instance, if an organization fails to implement device control, it might become susceptible to phishing attempts. These phishing emails, if clicked on or if attachments are downloaded, can lead to malware infections. However, endpoint security can block these threats before they reach the system, regardless of whether they arrive through a device, email, or web access. This is where detection becomes crucial. Endpoint security doesn't necessarily reduce the number of threats in the network environment, but it does prevent those threats from exploiting vulnerabilities on endpoints.

Apex One has helped reduce our customer's overhead by 30 to 40 percent.

Apex One includes a built-in fine-grained DLP solution. This is particularly beneficial for SMB customers, as they may not need to invest in a full-fledged DLP solution if Apex One meets their requirements.

The application and web controls have room for improvement. A fully integrated endpoint security system, encompassing EDR, should include application control, web control, device control, patch management, and encryption. This comprehensive solution would be highly appealing to customers, as they currently rely on multiple tools to address these security needs. Moreover, an EDR solution would provide visibility into endpoint vulnerabilities, such as unpatched systems, enabling proactive remediation. These features would undoubtedly enhance the value proposition of Trend Micro's security offerings.

I have been using Trend Micro Apex One for one year.

Trend Micro Apex One is stable. We have not encountered any issues.

Trend Micro Apex One is highly scalable, meaning there are no significant challenges with increasing the solution's capacity to meet growing demands.

The technical support is good.

Positive

My team was part of the deployment and from my end, it was a smooth process. The deployment took three days to complete. 

We utilized Trend Micro's auto-deployment feature via Active Directory to seamlessly uninstall the existing antivirus software and deploy Trend Micro Apex One.

The deployment required two people from the customer's side and one person from our end.

Apex One is expensive. On a scale of one to ten with ten being the most expensive, Apex One is an eight.

Initially, customers may be satisfied with the price of Apex One for the first year or two. However, as they become aware of other alternatives that meet their needs more effectively or at a lower cost, they start considering switching to a different option.

I would rate Trend Micro Apex One nine out of ten.

For an organization with 500 to 700 employees, at least two dedicated personnel should be assigned to maintain Apex One if the customer operates multiple shifts. Otherwise, one dedicated personnel per shift is sufficient.

Trend Micro Apex One is a good option for organizations that don't have budget constraints. 

My main use case for TrendAI Vision One – Endpoint Security is for endpoint security. At the endpoint level, such as Windows endpoints, I have installed and deployed the TrendAI agent where it collects logs from the XDR telemetries and sends them to the centralized Vision One console. At the endpoint security level, I am using TrendAI Vision One – Endpoint Security on the TrendAI cloud or the on-premises solutions.

The best feature that TrendAI Vision One – Endpoint Security offers is the correlation capability, where at the endpoint level, the TrendAI sensor forwards the telemetries to Vision One and Vision One correlates all the XDR logs to tell me the exact risk or gap.

It has helped my team in real-world situations by saving time for the engineers because it provides all the correlation details and then tells me which gaps need to be addressed on priority, making it a time-saving feature for the engineers.

Some features of TrendAI, such as web reputation or behavioral monitoring, are underrated. For example, web reputation operates at the firewall level, but TrendAI checks the reputation on the TrendAI Threat Intel Center, and if it has a bad reputation, it blocks and restricts user access.

Since I started using TrendAI Vision One – Endpoint Security, it has positively impacted my organization by identifying compliance and system-related vulnerabilities, as well as malware that was previously hidden. TrendAI found it and then addressed it.

Finding those hidden vulnerabilities has helped my organization improve compliance scores and reduce incidents. For example, at the system-level configuration, encryption is disabled, or patches or certificates are mismatched, meaning the compliance score always shows the risk score. After addressing things such as Windows updates or patches, the compliance scores are improving, and I also enabled BitLocker. Additionally, some older backup data stored on the local machine was scanned by TrendAI scanner, and it found data that had been sitting for three or four years and contained malicious intent, which has been addressed.

TrendAI Vision One – Endpoint Security could be improved in customer support and some features that are not related to endpoint security, particularly in email security.

Support sometimes takes time to attend to queries, and I have noticed a bug in email security where inbound protection quarantines emails that have attachments, which blocks legitimate emails that have signatures attached, as the email gateway considers those as actual attachments.

I have been using TrendAI Vision One – Endpoint Security for more than two years.

In my experience, TrendAI Vision One – Endpoint Security is generally stable, but there was one instance of a data center issue recently where the Middle East Dubai data center was down for TrendAI Vision One services, affecting people who had provisioned their tenant from that domain to access the console.

TrendAI Vision One – Endpoint Security's scalability is good because it covers endpoint security, network security, ZTSA, cloud security, and email security, making it capable of handling growth and increased demand well.

I give customer support a rating of four out of ten.

Before using TrendAI Vision One – Endpoint Security, I basically worked on the client's requirements, where different clients have different needs. TrendAI is trendy and easy to understand for both clients and non-professionals, making it accessible for the technical team to understand its capabilities and features. I have not evaluated other options before choosing TrendAI Vision One – Endpoint Security.

I advise others looking into using TrendAI Vision One – Endpoint Security that it is very user-friendly, and with only some firewall rules, I can deploy the solution to an environment.

I have seen a return on investment in terms of time saved because the workbench alerts shared by working on the Trend Micro side and the security playbooks are saving more of my team's time, making it very helpful for the engineers.

Regarding my experience with pricing, setup cost, and licensing, as a cybersecurity engineer, I do not have much information about the sales part, but I can say that Trend Micro has recently shifted from unit-based licensing to credit-based licensing, so I can purchase credits and utilize them based on my requirements for each module.

We are using their agents in our endpoints, almost 2,000 endpoints. We are using that as an EDR solution.

There is no other opinion; it's the best solution we have faced compared with Kaspersky and other solutions.

The best feature is IPS and IPS control base.

Pricing could be improved. It's a little bit expensive.

We have been using Trend Vision One Endpoint Security for almost two years.

From one to ten, I would rate the stability as eight.

It's very good and efficient. If I rate it out of ten, it would be seven to eight.

Support is handled by the global team. In my experience, I would rate it seven to eight out of ten.

Positive

In my previous organization, we used Kaspersky. This tool is better compared to Kaspersky.

It's a user-friendly tool. I would rate it eight out of ten for ease of setup.

The global team manages the implementation.

Pricing could be improved as it's a little bit expensive.

In my previous organization, we used Kaspersky.

I recommend it as the best tool for EDR and XDR solutions.

I'd rate the solution nine out of ten.