Initially, we observed multiple false positive alerts with Cybereason Managed Detection & Response. We've worked with Cybereason to whitelist and fine-tune alerts, particularly those related to ESLR detection, which created more noise in our environment. Identifying the purpose of each feature and its necessity for detection needs improvement.
System Analyst at a tech services company with 11-50 employees
Real User
Top 10
Feb 27, 2025
The interface, particularly the dashboard we use for looking at alerts, could be improved. The ease of use of the dashboard and accessing security reports needs enhancement.
Business Development Manager for Cybereason at Bechtle
Real User
Top 5
Jan 14, 2025
If the language barrier was addressed, it would lower the barrier for a number of German customers. It would take away a unique selling point for our own specialist managed service. I'm a bit hesitant, however, this would improve the product or the offering. Detection time already is very quick. The completeness of the offering was integrating more data. I am discussing with a customer who wishes to include identity data. Detecting early when someone tries to compromise your ID would be a nice feature.
Head of Research Development and Innovation at CSIR
Real User
Top 10
Aug 21, 2023
My company's issue with the solution stems from the fact that for every client, we have to spin up a new Cybereason instance, so there is not a single Cybereason instance where you can manage all your clients. For every new client or every new case, my company has to spin up a new instance, because of which there is a new URL. My company has to invest in enrolling people again and add all your new IOCs back into each instance. There is no centralized way to manage multiple instances of Cybereason, which is probably the biggest issue that wouldn't allow onboarding someone new, causing a lot of effort in the initial setup, maybe through a whole different web interface at times.
Learn what your peers think about Cybereason Managed Detection & Response. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
Cybereason is the leader in endpoint protection, offering endpoint detection and response, next-generation antivirus, managed monitoring and IR services.
Founded by elite intelligence professionals born and bred in offense-first hunting, Cybereason gives enterprises the upper hand over cyber adversaries.
The Cybereason platform is powered by a custom-built in-memory graph, the only truly automated hunting engine anywhere. It detects behavioral patterns across every endpoint and surfaces...
Initially, we observed multiple false positive alerts with Cybereason Managed Detection & Response. We've worked with Cybereason to whitelist and fine-tune alerts, particularly those related to ESLR detection, which created more noise in our environment. Identifying the purpose of each feature and its necessity for detection needs improvement.
The interface, particularly the dashboard we use for looking at alerts, could be improved. The ease of use of the dashboard and accessing security reports needs enhancement.
If the language barrier was addressed, it would lower the barrier for a number of German customers. It would take away a unique selling point for our own specialist managed service. I'm a bit hesitant, however, this would improve the product or the offering. Detection time already is very quick. The completeness of the offering was integrating more data. I am discussing with a customer who wishes to include identity data. Detecting early when someone tries to compromise your ID would be a nice feature.
My company's issue with the solution stems from the fact that for every client, we have to spin up a new Cybereason instance, so there is not a single Cybereason instance where you can manage all your clients. For every new client or every new case, my company has to spin up a new instance, because of which there is a new URL. My company has to invest in enrolling people again and add all your new IOCs back into each instance. There is no centralized way to manage multiple instances of Cybereason, which is probably the biggest issue that wouldn't allow onboarding someone new, causing a lot of effort in the initial setup, maybe through a whole different web interface at times.