TrendAI Vision One Reviews

We use Trend Micro XDR to enhance our security framework.

One of our partners was the victim of a major attack, and we realized that our environment was susceptible to the same thing because we were only using an antivirus solution. 

Trend Micro XDR is deployed on-premises, and we use it on our core business servers, clients, and the management portal to protect all of our network nodes from attacks.

Trend Micro Vision One provides centralized visibility and management across protection layers, which is important. It is part of our monitoring tool. The visibility gives us a centralized view of our network nodes, activities, and possible attacks.

The risk index feature plays an important role in our KPIs, which we report to the management team. Our business is dependent on our systems running 24/7.

Trend Micro XDR has helped decrease our time to detect and respond to threats.

Trend Micro XDR has reduced the time we spend investigating false positive alerts by 50 percent.

The most valuable feature is the network protection shield on every server, which isolates attacks and prevents our clients from being affected.

The deployment process could be more streamlined over the existing infrastructure, as it was not as easy as we thought. We are working with an expert from Trend Micro to improve the rollout process, but it has taken some time and we do not yet have a concrete understanding of the issue. There are some features that we have to install repeatedly before they start running.

I have been using Trend Micro XDR for one year.

Trend Micro XDR is stable.

Trend Micro XDR is scalable.

The technical support is good.

The deployment took six to eight weeks to complete. We had around five part-time people involved in the deployment.

Trend Micro XDR is expensive but we got a good deal from Trend Micro. We pay for an annual license.

Currently, we are researching the question of whether to use Trend Micro XDR when we switch from our classic NPLS internal corporate lines to an SD-WAN solution. Or if we should use an integrated solution from the SD-WAN and firewall provider, such as Palo Alto or Fortinet.

I would rate Trend Micro XDR eight out of ten.

We have 300 people in our organization that use the solution.

Maintenance is easy and done by two people, who update, patch, and install new servers; client-side, they also update user stations and analyze logs.

I recommend Trend Micro XDR. It is user-friendly.

We use Trend Micro XDR for rapid response to end-user computing and security concerns.

As a health system, one of our core challenges is ensuring full visibility into our attack surface. We have many thousands of endpoints and end users that must be properly secured and protected. Our primary use case was to improve visibility, and response time, and reduce complexity. That is why we chose Trend Micro XDR.

Trend Micro XDR is deployed on Trend Micro's private cloud.

We are using Trend Micro XDR on our endpoint and server infrastructure. The coverage is extremely important to our organization.

Trend Micro XDR provides us with centralized visibility and management across protection layers.

The centralized visibility and management across protection layers have helped our efficiency. The most significant advantage is that we used to manage these platforms with three or even five engineers, and now we're managing them with one.

It is extremely important to us that we can drill down from the executive dashboards into XDR detections. This provides us with the single pane of glass view that I mentioned previously. Being able to see at a high level that there may be systems that are behind on patch levels or need additional service or support, and then being able to drill down specifically to an individual machine, which may be unique in our environment, is very helpful.

We use the risk index to evaluate ourselves holistically, including our performance against best practices and security, as well as our performance against other healthcare systems around the world. This allows us to identify areas where we may have vulnerabilities or where we are particularly strong so that we can focus on improving in the areas where we need to.

Trend Micro XDR has helped us improve our resource utilization through automation, reducing manual effort and enabling faster response times. In under a week, we had tuned our environment to perform optimally.

Trend Micro's Managed XDR service has significantly reduced our team's workload by nearly 50 percent, providing a big improvement in our overall threat intelligence and endpoint security.

The Managed XDR service has enabled our team to work on other tasks. This additional availability for our staff has allowed us to reduce our need for contractors. If we are overburdened, we will hire contractors to assist in other areas of the business. However, because we have become more efficient, I have been able to hire some of those contractors and reduce the burden of contract labor.

Attack surface work management capabilities have been extremely valuable. The user and identity services provided by CREM help us to focus on and improve visibility into end-user behavior, including that of endpoints such as laptops and desktops, the network, cloud infrastructure, and applications.

The ability to detect our blind spots has significantly improved our security posture. Seeing everything clearly in a single, easy-to-understand dashboard allows us to allocate our resources directly to where they are needed most, enabling us to respond faster.

The biggest advantage of Trend Micro XDR is that it has helped decrease our time to detect and respond to threats by around 50 percent.

Trend Micro XDR has helped reduce the amount of time we spend investigating false positive alerts by 60 percent.

Trend Micro XDRs automation capabilities save us around ten hours per week. 

We are very impressed with the single pane of glass visibility that Trend Micro XDR provides. It allows us to work from a single console instead of having to use four or five separate tools to maintain the same level of security. This is extremely helpful.

The manageability and artificial intelligence built into Trend Micro XDR are extremely helpful.

I've seen a lot of improvement in just the year that we've been with Trend Micro. However, I think that continued optimization of the environment towards automation and orchestration, a kind of layer that sits underneath all of the technologies, would be extremely important. When we look at the speed and sophistication of attacks today, such as ransomware, malware, and cyber threats, we need tools and technologies that can react faster. So, I think integration with automation, orchestration, and artificial intelligence will help tremendously.

I have been using Trend Micro XDR for one year.

Trend Micro XDR is remarkably stable.

Considering our growth rate of nearly 30 percent per year, Trend Micro XDR is scalable enough to keep up, so we have no concerns.

Technical support is exceptional. They are extremely engaged and supportive of everything we have needed.

Positive

We previously used Sophos but switched to Trend Micro because of its enhanced capabilities.

The initial deployment was straightforward. The deployment took between one and two weeks to complete. 

Moving between security tools requires an analysis of the existing environment to understand the current configuration, rulesets, and architecture. This analysis is quickly followed by implementation to improve the security posture and validation to ensure that the infrastructure is not only properly protected, but better protected than before.

Three people were required for the deployment.

We have been able to reduce some labor costs and use our resources more efficiently. These savings of hours per week are definitely a return on investment.

The solution is fairly priced.

I would rate Trend Micro XDR ten out of ten. The solution works extremely well for us. In a healthcare environment, the types of data and the sheer size of the attack surface are somewhat extraordinary. Having the enhanced capabilities of the Trend Micro toolset has been very important to us, and I strongly recommend it.

We have 11,000 users, five acute care hospitals, and around 80 clinics.

Two people are required to maintain Trend Micro XDR for the investigation of threats and incidents. When threat intelligence comes in from Trend Micro or we receive an alert, we validate or respond to it. A lot of this process has been automated, which has helped tremendously.

I strongly recommend Trend Micro XDR and advise doing a proof of concept against any current tool on the market, as it works extremely well and a POC can clearly demonstrate this in a short period of time.

We use Vision One to detect to detect and respond to malware incidents. With endpoints (Apex One/Cloud One Workload Security), network (Deep Discovery Inspector) and Office365 (Cloud Email and Collaboration Security).

The environment is complex, distributed in more than +100 locations. Some locations are just offices, some others are industrial facilities with ICS and SCADA. Besides Windows, we deal with a lot of operating systems, including Solaris on SPARC. And our users are diverse, with lots of employees roaming around the country.

With CREM, we tackle important use cases around identity protection and risk management in general. Identification, prioritization, and remediation.

The full stack of Vision One has delivered what "SIEM 2.0" couldn't deliver. The capability to monitor threats and discover attack vectors before they are exploited and across all our workspace (on-prem, IaaS, PaaS and SaaS). We have invested well over a million into SIEM during the last decade. A full ArcSight upgrade and then a Splunk migration assisted with a large MSSP. Vision One is still ahead at a fraction of the cost.

Going through a capable, single-vendor solution was necessary, given our small team. Choosing the best solutions for every task and building all the integrations was not an option.

Vision One is much more than just EDR for us; it is a threat intelligence platform and a SOAR too. And even with the limited capabilities in this area, we find ways to tackle challenges our MSSP and SOC haven't been able to accomplish on a very large budget.

I like everything. The most valuable feature is how the stack fully integrates all components of a solution. Then, integrations with third parties will be provided.

As an example, I am capable of sending a suspicious file directly to my Deep Discovery Analyzer appliance (a sandbox) while investigating a suspicious download/file interaction, and I can then quickly push the IOCs in the suspicious object lists to protect both managed endpoints, and the rest of the network too! Yes, you can push domains and IP addresses to Palo Alto through a Trend Micro Service Gateway, ensuring you can protect even what cannot receive an endpoint. And all this without writing a single line of code. The ease of use and ease of deployment for use cases like this are my favourite features.

The SOAR features (Security Playbooks) are quite limited. At the moment, it is impossible to execute a simple piece of Python code that would pull or push something to an API, for example. While you can tackle some use cases, a SOAR from another vendor is still a must-have.

To assist with complex use case integrations, having all the data from the SIEM inside XDR would be great, too. That's where the market is moving with solutions like Falcon Logscale and Cortex XSIAM. Pivoting from XDR to Splunk or vice-versa can be time-consuming during incidents.

I was actually an early beta tester of the Apex One Endpoint Sensor before Vision One appeared in 2021. That would be three solid years of using it.

Quite reliable. In the last three years, only one incident created memory leaks on Windows Servers. We didn't see too much impact (fortunately) as a workaround could be quickly provided.

Support is quite responsive when something does work well. However, we do pay for Premium support.

The scalability is really good.

My experience is generally good, but I have had the chance to deal with premium support. I'd say I get the support I expect for the price that I pay.

Positive

Although we have been dealing with other security vendors (McAfee, Symantec, Proofpoint, and more), Vision One was really our first EDR.

The initial setup was a breeze. It is realistically one of the strong points of the solution.

We implemented the solution in-house. Although with premium support, you do get a lot of help from Trend Micro if you ask for it. You'll be able to talk to actual experts.

It is very hard to quantify an ROI on a security product. It doesn't generate revenues, and you can't quantify the cost of incidents that didn't happen.

Product names are changing all the time. Lots of changes in the last three years. They introduced the concept of credits, too, which did not make anything easier.

It's also easy to underestimate the credits required with Cloud Email and Collaboration Security: people invited from third-party tenants will count.

The credit usage and allocation tool has been improving, at least.

We had a look at Carbon Black and CrowdStrike Falcon.

It's probably the best solution for a small team that cannot absorb the complexity of a multivendor solution. The ability to execute VS the cost is surprisingly good.

I primarily use the solution to prevent attacks. 

It's good for detecting malware and anomalies. We use it on our endpoints. 

The user interface is very good. Everything is all on one single platform.

With this product, we get centralized visibility and management across all of our protection layers. With a central platform, we don't have to look around across different websites or platforms. We can go right on the portal and manage things. It also helps us reduce the learning curve. We can manage and monitor products from the same place instead of learning different platforms. It's also helped us increase efficiency.

We have made use of the executive dashboard. It greatly increased visibility. We get a risk management view and metrics that help us narrow down and find issues. It helps us reduce risks. The risk index feature gives us a score to help us in our security goals. With it, we know what's the baseline or standard, so now we know what we need to do in order to meet the standards out there in the industry. We can see everything we need to in one glance. 

It's kept up to date and is consistently improving. This helps us protect our environment. 

The patch management has been very useful. They help recommend what needs to be installed.

We leverage the attack surface risk management capabilities. It shows the entire incident, including how it happened. We can use the information when we're doing forensics.

We've been able to reduce our mean time to detect and mean time to respond. What would previously take us two to three hours to fix, we can do in one hour or even half an hour. We've also been able to reduce the amount of time we spend investigating false positives. 

We'd like to see more use of AI around analytics and controls. 

I've been using the solution for five years. 

The stability is good; I'd rate it eight out of ten.

We're a small-to-medium-sized company. We have it deployed to less than 5,000 users. 

I'm not sure of the scalability. It works for us and our company size.

Support is okay. They could be more responsive and could provide more communication channels. 

Positive

We did not previously use a different solution. 

I'm more of an end-user. I do not handle the installation aspect. The deployment was done a long time ago. 

The tool does not require much maintenance. 

I'm not familiar with the exact pricing of the solution. My understanding is the licensing is reasonable. 

I'm an end-user and customer. 

I'd rate the solution eight out of ten. It has very good management and monitoring benefits. 

We use Vision One together with the other products in the Trend Micro security stack, such as XDR, Site Management, and Apex One. 

Vision One has made our detection and response time much faster. We have 30-plus integrations, helping us to identify the most critical threats. The more connections, the better. We can also identify and resolve false positives faster. 

I like Vision One's workbench. It provides helpful logs that I can search, and the telemetry is excellent because I can see what's happening during an attack or potential attack.

Another one of my favorite features is attack surface risk management. It shows me faults and blind spots in my security. I also like the attack phase management. The model shows the risks in the corporation and provides considerable information about what is happening on the platform and the network, offering more visibility. There's also a risk index that shows me where I can improve my security. 

Vision One provides centralized visibility and management across multiple layers. This is critical because I need to see what's happening. It also allows me to set separate rules and policies for some security areas. 

Vision One's search could be improved. While the platform is very user-friendly, the search feature uses terms that aren't as intuitive. The automation is excellent, but I wish there were more templates to help me optimize more things. 

I have used Vision One for nearly a year.

I rate Vision One nine out of 10 for stability. It has only crashed once. 

I rate Trend Micro support six out of 10. They respond quickly but the answers aren't clear sometimes. They don't always understand the issue, so I need to explain a lot.

Neutral

I previously used the Microsoft 365 security stack, but I found Microsoft's XDR lacking. We also used Microsoft CASB and Defender for Endpoint. Vision One's threat intelligence and modeling are better. It has all the features like attack surface and risk management as well as the workbench. I also find Vision One easier to navigate. 

Vision One is easy to deploy. It's mostly automatic, but we needed to deploy some of the agents manually. If you can deploy all of the agents to the endpoints automatically, it takes only about five minutes. 

Vision One is expensive, but I think it's a typical market price. 

I rate Visione One nine out of 10. I recommend fully exploring Vision One's features. It has many features that you don't need to pay extra for. There are so many things to explore. For example, they have free playbooks for third-party integration.

The reason we invested in Trend Micro XDR was to consolidate security operations and monitoring. On top of that, we invested in their managed detection and response service, which they can provide on top of the ETA service, which makes our lives easier. You can say that with it, we need fewer hands.

We're able to gather a more simple view of what was going on in our infrastructure. Before this solution, we used a SIEM system. Trend Micro XDR made monitoring more simple, and we trusted them as a security partner.

It definitely has improved our visibility of all of our ongoing items in the infrastructure. We can get a good overview of what's going on across our network and what our security looks like.  

Having everything under one management console and having them monitored from one place is the most beneficial.

It saves time and we do not have to invest in a lot of products to meet all of our use case needs.

It's quite simple to monitor everything under one console. It makes life simpler for our operations team. 

We have the solution everywhere, including email, network, endpoints, and cloud. This is important to have this coverage. As a former incident response analyst, having visibility everywhere is really important. Having everything correlated into one place increases visibility.

We have centralized visibility and management across our production layers. They are also improving that from month to month. It's important for us. In security operations, the fewer places you need to go to have a look around, the easier it is. Back in the day, we had to open ten different consoles. Now we just open one. 

The most important thing for us as a customer is that we can spend more time in other places as it's simpler to have that overview. We have much more time for other tasks. 

We use the solution's executive dashboards. We like that we can drill down from the dashboards into XDR detections. It helps the C-suite understand. However, it also helps us drill down by allowing us to choose which views we want. 

We have a trial version of the Risk Index. We have a daily look at it and it gives a nice overview of our vulnerability management and what the attack surface looks like. It helps us prioritize our daily tasks. 

The Managed XDR service was great. It helped quite a lot. We had to get used to working with them and they with us, however, now it's quite an easy task and the advisory and alerts we get from them have been helpful. The availability to work on other tasks has helped us improve in other areas. It's positively affected our business. Having this product means that we are improving in a lot of different areas that we also need to focus on. They can do the monitoring better than we can do it ourselves. We don't have the manpower to do it on our own so it helps a lot to have them help with management.

We use the Attack Surface Risk Management capabilities, which are also in the trial period. It's absolutely helped us to identify blind spots in our environment. It made us realize that, for example, users were using their work email for private services such as Netflix or other services that, if they had a data breach, would be an issue. With this, we can reach out to those users and explain to them how to act on the Internet, not to use your work email for private services, et cetera.

It's helped decrease our time to detect and respond to threats. It's likely 80% faster now. It's also helped us reduce the time we spend investigating false positive alerts. They do a lot of the initial work for us and come back with the actions we need to do on our part (if any). It's helped us reduce false positive investigations by 50%.

We're using some of the automation capabilities of XDR. It's helped us save time. At the moment, it's likely helped us save 20% of the time we'd normally spend on manual processes. 

They should increase their potential for third-party integrations. We'd like to see integrations with other IT security vendors that are not currently there. 

I'd like to see central management of all products.

I've been using the solution since it came out, essentially. I've been working with it for eight or nine years.

The solution is quite stable. 

We don't have branch offices, however we have 2200 clients and 800 servers. 

It is easy to scale if you are a bigger organization. We do plan to scale further in the future. 

We have Service One, which includes three-year support. It is 24/7/365 support and they are quite good. 

Positive

Before Trend Micro, we used Splunk. The use case and monitoring were easier with Trend Micro. We found it easier to fulfill our needs using Trend Micro. 

I was involved in the deployment process. Some of it was quite complex. Unfortunately, we had an on-prem environment that wasn't well taken care of. The migration was hard, however, that was more our fault. It could be easier to migrate, however. 

It took us about nine months to fully deploy. 

We already had some products in the cloud, however, we needed to migrate all of our endpoints. The on-premise agent needed to be placed in the cloud and we had some problems as some clients did not have an opening to the internet, et cera. There was some preparation we needed to do. We needed to do some upgrading before migrating. 

There were two to four people performing the implementation. 

The solution requires maintenance and we have a person that manages that. 

We had help from Trend Micro professional services. 

We have noted an ROI. Having them monitor our IT solutions allowed us to have fewer people on the team. It's saved us in man hours. 

The solution is affordable. You do need to pay additional fees for some of the functionalities.

We also evaluated Microsoft's solutions. 

I'm a customer and end-user.

We realized the benefits of the solution pretty fast - within a couple of weeks. We knew the benefits beforehand which is why we chose Trend Micro. The possibility of having the solution monitored by the vendor itself was quite helpful. 

I'd rate the solution nine out of ten. 

I would advise others to prepare your needs beforehand. If you know those, you will know Trend Micros is the right fit for you. It's great. If there's a problem with central management or monitoring, Trend Micros is quite useful. 

We use Trend Micro XDR for endpoint detection, endpoint user protection, and virtual security.

We have deployed Trend Micro XDR across our entire environment, which is important for our organization's threat detection capabilities.

We use Trend Vision One to monitor our environment 24/7. Centralized visibility is very important to me and my management. In addition, management wants to see centralized dashboarding. This is very important.

The centralized visibility and management across our protection layers have improved our efficiency.

The executive dashboard is important to our organization. I use the dashboard each morning and evening.

Trend Micro XDR has helped our organization improve its defenses against external and internal threats.

The Managed XDR service has positively affected our team's workload by providing 24/7 monitoring. This has saved our team 20 percent of their time to focus on other tasks.

The time to detect is under one minute.

The proactive approach is the best feature. When Trend Micro XDR detects a virus in our system, it stops it and secures our branches.

The centralized dashboard has room for improvement.

I have been using Trend Micro XDR for almost two years.

Trend Micro XDR is stable.

Trend Micro XDR is scalable.

The technical support is good. We receive a response within ten minutes.

Positive

We switched to Trend Micro XDR from Kaspersky because it is a better product and we have not faced any issues.

The deployment took one week and required a few people to complete.

Trend Micro XDR is expensive.

I would rate Trend Micro XDR ten out of ten.

We have over 100 Trend Micro XDR users.

Normally, we use the solution for day-to-day investigations. We get alerts when something is going on in the environment. Right now, we are using that tool for the asset management team to identify services or applications that are not allowed for governance and all of these purposes. In addition to that, we use it for isolating devices. We also have a service with them, an MDR service. They analyze information, and they do investigations for us as well.

Mainly, we were concerned with the visibility of the environment. We didn't have a tool that was able to allow us to see or have visibility of what the endpoints were doing on the servers in the environment. That was the main reason to adopt this solution - to have visibility on the environment as, in the past, we didn't have that capability.

The isolation of devices has been really important. We like all the attack surface-managed NPEs. It's helping us to identify devices and protect us on the network. That's in combination with third-party integrations as well. We have integrations that are helping us to identify devices using our vulnerability management services. It's scanning the network and it's sending all that data to VisionOne. With that information, we identify devices that are protected on the network and the environment.

The reports are a really good feature for showing results to upper management levels.

The search features help us try to correlate information and identify any suspicious activity. That's another feature that has been really important.

We are using it everywhere except for the network, so we don't have the network discovery service from Trend Micro. However, we have it on endpoint servers and email and also the cloud as well. We use cloud conformity to connect that piece.

Trend Micro has a feature called Vision One, that provides us with centralized visibility management across all protection levels. That's helping us to have a centralized view of the console. That's the main reason why we still have that product.

Centralized visibility is important. When we are doing investigations, we can do everything in one console instead of moving to different screens or different windows. The centralized visibility and management across these protection levels helped with our efficiency. It helps us to identify quicker, any potential threat, or any special activity.

They have this feature called Risk Index which I use sometimes to validate the level of rates we have. We don’t use it often - maybe once every one or two weeks. We use it to rank our security operations overall. Mostly, we just check it out of curiosity.

We use the Managed XDR service that they have. It relieves a lot of workload especially during investigations or interim reports about any particular activity - especially with the coverage after hours. It is helping us with the capability there. Also, if something really bad is happening, we have eyes watching all the activity, which is nice.

Using this Managed XDR service enables our team to work on other tasks - especially when we, in certain ways, allocate some of the investigation pieces. We basically create a request for them to investigate things, and that allows us to focus on other things to optimize our security toolset. That's really helpful.

We use the attack surface risk management capability they have. We use that heavily right now. It was a big use case in the past few months. We use it to identify multiple devices without protection, the applications that have been used by our users, and which ones are risky. We are using that on a regular basis. It's helped us identify blind spots and more assets. It's positively affected our security posture by improving a lot of our visibility.

XDR helped us decrease our time to detect or respond to threats. In the past, we didn't have that visibility. When we enabled that tool, at the beginning, it was a little bit noisy. That's something to be expected coming from a new tool. However, after testing through these years, things are improving, and now we can see better results, especially during investigation alerts.

The solution has helped us to reduce the amount of time we spend investigating false positive alerts. In the beginning, there was a large amount of false positives. Right now, we are day to day trying to reduce them. At this point, they are lower compared with the beginning of the implementation. Things are improving. We are reducing false positives as we go which is great.

We do use the automation capability a little. However, we noticed some limitations, especially on the playbook side. The API we use. We are integrating that with another product, a SOAR product. The playbooks are a little bit limited in what they can do at this point. Let's say that we want to connect on a specific API. The templates we cannot modify very well. When we noticed that limitation, we decided to go and use Trend Micro VisionOne API and connect it to other tools to develop that activity using another product.

Under attack surface management, when you go to the specific sites or applications that the users are accessing, the capability of downloading that report could be better. Let's say, as an example, we want to identify users using chatGPT, for example. We want to download that data through an API or through the GUI. Right now, it's not available as an option. Maybe having the capability of extracting data from VisionOne for specific areas of the tool could work. That's something that could be useful, especially if we want to generate that report and send it to specific teams. Often, we don't want to provide DX to all the people. Sometimes it's easier to just have that file and share that file with the people who need to have that information. 

I've been using the solution for around three years now. 

The stability is good. It's not very common to have any outages. Sometimes there may be a glitch, however, it's rare. Normally we have 95% stability.

The scalability is good, especially when we are talking about third-party integrations. We can have visibility and control of all different assets. So we can have good scalability and visibility and know more about the environment in places where we didn't have any idea things were happening. It's a SaaS tool, and we don't have to do any maintenance, and it's easy to deploy. It's pretty straightforward.

When we have specific issues or problems connecting some products we ask for support. They respond really fast. They always try to mitigate and resolve all the issues we have. If they cannot resolve the problem, they normally share some suggestions on how we can mitigate future problems.

Positive

We did not use other solutions, although we did use Apex One for a long time. We have also used an EDR product.

I was involved in the deployment. I was the one leading the data during the implementation. The process is pretty straightforward. It was a little tricky to reduce the false positive alerts, however, the portion of deploying to the environment and connecting the pieces was simple. 

From our side, we had three or four people involved in the implementation. 

We had some help with the deployment and we had some guidance in the beginning. We requested some support from our account manager.

The pricing is good if you look at all the compatibilities and features offered by the product. There are features that can increase the pricing. We can put some credits to some features, however, if we want to enable them. With the amount of credit we have, we are covered for all of our needs.

I'd rate the product eight out of ten.

It is a really good product and easy to deploy. They allow you to have more visibility on your environment, especially if you have any kind of XDR solution. It will increase the visibility of what's happening in the environment. Also, from the perspective of doing maintenance updates or patches, the cloud is the way to go. The product management team does a really good job of increasing the features, and they are listening really closely to what the customer needs via feedback. 

We use Vision One XDR for our endpoint security. Our company has nearly 4,000 users. We have endpoint cybersecurity agents for which we can use XDR. 
Trend Micro has multiple subscription licenses for individual Vision One components. There are also licenses for XDR for endpoints. We have adopted four packages from Trend Micro: endpoints, workload security, mobile security, and email security gateway.  

We didn't realize the benefits immediately after deploying the solution, but we saw results quickly. When you install Vision One, the policies are set to the default setting. It scans your machines, and you get alerts if someone is attacking, there's a vulnerability that must be patched, or there's a Trend vulnerability you're patching somewhere.

It has reduced our detection time. The detection is quite fast, but the response at the SOC level might take time. Vision One can be used to conduct analysis first. It reduces the investigation time because Trend Micro has an advantage in Pakistan. They have local technical resources deployed here. Organizations can get heavy false positives, but Trend Micro can help you define the policies accurately.

Our primary focus is DLP, and Vision One has solid DLP features. We also use URL filtering and device blocking, and there's telemetry for identifying exploitable vulnerabilities.

It offers us centralized visibility. That's the advantage of Vision One's unified platform with data lake capabilities. They pull telemetry data from the endpoints, network devices, and cross-layered architecture, and Vision One performs filtering and analysis.

Additionally, Trend Micro can integrate third-party tools, such as Fortinet, Cisco, or any other vendor's firewall, to get the logs and alerts from them. Vision One is much more capable in that way.

Having that centralized visibility has improved our efficiency. The organization has multiple tools segregated into separate windows that give you a particular type of visibility. Multiple SOC team members can view the same window. The beauty of Trend Micro is its ability to integrate all of the systems in one cloud platform, right, in terms of Vision One. From your workbench, you can easily monitor and centrally manage alerts. My SOC team is happy with it. 

The risk index feature is a rich view that rates any alert on a scale of 1 to 100 and classifies it as internal or external. Few OEMs can provide that sort of capability. The index ratings provide a window into device health and how alerts can be resolved. 

The attack surface management is a fantastic feature with a proactive approach. Normally, organizations do pen testing quarterly or once a year, but attack server management proactively checks user authentication or changes in your environment. 

Vision One's functional capabilities are excellent, but the platform can be upgraded and simplified in many ways. We use multiple playbooks to automate many things, but I'm not sure there are mature cybersecurity applications. There are several external alerts, and their behavior changes daily, so I'm not sure automation can help you that much. We're using the playbooks, but it might require some improvement.

We have used Vision One for two and a half years. 

I rate Trend Micro support eight out of 10. They stick to the SLA and respond on time. They are cooperative and supportive. I'm very satisfied.

Positive

We have evaluated multiple vendors, and Trend Micro is among the best. You cannot have a typical apples-to-apple comparison. There are a lot of things which we need to compare. Other tools may not be at the network level or have the third-party integration that Vision One has.

Deploying Vision One is easy. You can deploy it with a few clicks and configure the policies or use the default ones. It's flexible and user-friendly, and there are no headaches. The deployment time depends on your environment. If you have thousands of endpoints, it takes some time, but it's just a few minutes if you have a couple. 

Trend Micro is pricey, but it has more capabilities than a standard XDR, so the customers consider it reasonable. The market has accepted it. Trend Micro has a 64 percent share. 

I rate Trend Vision One nine out of 10. 

Each component that we have purchased from Trend Micro has its own unique value set. But as CISO, the most excitement in my day is when a Zero Day initiative lands. It's one of those things that, by nature, you're generally not prepared for, and the initial reaction of the security team was, "What are we going to do about this?"

When that happened, I suggested we look at our Trend Micro IPS and see if there are any vaccines related to the particular Zero Day, and there were. We enabled those vaccines and we could see, using the ExtraHop appliance, that the issues we were seeing before had been remediated. That particular experience was a predictor of what was to come. Since then, on almost every occasion, we have had a mitigating response in our arsenal to any type of Zero Day attack before the attack actually occurs.

And even when we got into a situation like Log4j and there wasn't anything in our arsenal to deal with it, we called Trend Micro, and they said, "Yeah, we're delivering it right now, but you'll have to install it manually." And I was thinking, "I'll install it while upside down if I have to, but the bottom line is just get it over here." We deployed it and—problem solved. I believe they own that VDI initiative and it's really good that they're so close to it. That is something that has really really made my life a lot easier. Running around with your hair on fire is not fun.

In essence, it has allowed us to get a handle on our security initiatives and planning, and construct security over the long term. We've been working with them for at least ten years.

Their toolset integrates well with our existing infrastructure. It integrates well with our AT&T AlienVault SIEM.

Another piece that makes Trend Micro kind of unique—and I could see where they might have had a problem kicking the whole thing off—is that they were one of the companies, early on, that spent a lot of time integrating their toolsets, and I was really impressed with that. That meant the endpoint management system could reach out to the Deep Discovery system on the network and pick up something that it perceived as a suspicious object. It could then sandbox it and monitor it. If that suspicious entity reached out for command and control or did something nefarious, the endpoints would be alerted and would start getting rid of the problem.

The issue this addresses—and it's one of the most important issues—is that you really have to consider automation and be conscious of it. Because when the stuff hits the fan, you're not necessarily fast enough, as a human being, to get everything done the way it needs to get done—and document the process.

You might not think about that last piece so much when you start doing security engineering. But when you get into a big healthcare company like ours, there are audits going on all the time. The auditors will want to pick out two or three events that you've dealt with and say, "We want to see the audit trail," et cetera. As a result, there are advantages to the integration of Trend Micro's disparate toolsets.

Trend Micro has worked very hard on making their toolsets, like IPS, Deep Discovery, Deep Security, et cetera, talk to each other and work together. And they're still doing it today.

They have made their IPS an application rather than an appliance. You install it on the endpoint, which is a server in your data center, and it will actually configure it to a minimal standard. That means the applications and the version of the operating system you're running, right down to the colonel version, get only the tools installed that are needed for that particular instance.

They minimize the installation because they don't want you looking for bugs and indicators of compromise that you're not in a position to experience because you're using an operating system that isn't vulnerable to them. That gets rid of a lot of overhead when it comes to server management. They keep in mind that these are servers that have a job to do. They're not just desktops, and if they're eating up a lot of the CPU, that's bad for us because we're out to do business and make money. We've never had a problem with them. It's really reliable, once you get it set up.

When you deploy these tools from Trend Micro, the integration and getting them to work together, are among the more difficult pieces of the puzzle. But when you get that set up and working, you're glad you did.

When you manage a security department for a number of healthcare organizations and deploy security into their environments, they want it done today. And they certainly don't want to be bothered with it over the course of a few weeks. We've been in our Cloud One migration for a couple of months now and it isn't our only project. We've got a lot of things going on here and at our subsidiaries, for which I'm also the CISO. It's very busy. We don't have time to sit down and work on projects just for the sake of having the resources to work on them.

When we invest the time to integrate disparate resources, appliances, and applications, we do so with the idea that we're going to get something out of it that is worth more than what we put into it. In each and every case, that's what has happened with Trend Micro.

Still, a lot of folks I know have adopted their technology but have not integrated it. The endpoint management tool sits on the endpoint and manages it, but it's not fully integrated with, for example, the sandbox. So it would be nice if they could simplify the integration process. And I would like to see better documentation.

Another point is that, with Vision One, there were issues that we experienced with the IPS and EDR technologies when we first got it. We had some difficulties figuring out how to make it dance. Once we figured it out, we were okay.

The remediation they put in place for that was to increase the number of presentations they did on the software, presentations where they answered questions. We attend one about every two to four weeks with Trend Micro to go over things, and it's not just us. There are 70 to 100 people in those meetings. They figured out that, while it's okay to build reasonably complex systems, at some point you have to pass the knowledge along to the end-users. That's not always easy to do. Most companies operate under the mindset that, "Well, we understand it, why don't you understand it?"

We started the integration of Trend Micro Vision One three or four years ago.

Trend's gear is very stable and reliable. In this business, it almost has to be because, if your system goes down frequently, you just don't have time to mess with it. In the years we've had their IPS deployed, and that's a complicated product, we may have had one or two failures. And as I recall, it was something in a power supply. If your primary failure is something to do with a power supply once every ten years, you're in good shape.

It's the same thing with all of their technology. The way they design it, just keeps running and that's not necessarily always the standard in the industry. For example, I finally had to abandon IBM's IAM solution because it was so bad. It would just break. We don't have those problems with Trend Micro. Their stuff just works. It's really good and well-designed.

It's reasonably scalable, but remember that, as you're scaling out, some of the components need to be scaled while other components just need to be reconfigured. You don't want to be paying for what you don't need, meaning you don't necessarily have to double everything. When you scale out, you have to give it some thought.

Their tech support people are better than most. In my career, I have seen it all. But Trend Micro support is really good. They're the best vendor I have for support.

Anytime we've had an issue with their gear, they have been prompt and have gotten on it and gotten it fixed. And if they can't fix it, they replace whatever they have to replace.

Another aspect with Trend Micro that is really good is that they listen to what you say. If you come up with a use case that they don't currently have, they'll add it to their repertoire and, a couple of updates down the road, there is that tool you needed. It's just a well-driven and well-run company when it comes to that side of things.

For example, in the beginning, using the dashboard was a little bit tricky. But the cool thing they did was to hold biweekly meetings on it. They would not only go through use cases, but at the end they would ask, "What else would you like to see? How would you enhance this?" Once the CISO community got a hold of that, they were coming with their guns loaded and saying "I'd like to see this and I'd like to see that." And Trend Micro started knocking out the ones that made sense. As of today, it's a completely different ballgame than it was back then. They're constantly upgrading their platforms.

And they don't absolutely have to do large releases to get things into the users' hands. They'll build something out and say, "Hey, we've included this. Try it out and let us know what you think." Most companies would say, "That feature will be in Release 5 and not until that release. Release 5 is slated for May, but it probably won't be out until October." Trend Micro is not like that and we appreciate that.

Positive

We go back quite a way with Trend Micro. When I first met with them, it was a sales guy at Torrey Pines resort who was meeting with individuals. A bunch of CIOs and CISOs were brought together there and put up for a few days to meet with various salespeople. It was a "getting-to-know-you" event and I did it every year. One of the sales guys was from Trend Micro and I didn't know anything about them but I was impressed with his presentation. I thought to myself at the time, "Keep this one in mind. Think about this a little bit."

About a year or so later, when, at the time, we were using the IBM endpoint suite, IBM decided to take it down. It had about five different toolsets, one of which was IBM BigFix, which is a patch management solution that we still have.

They said that if you want to replace them with what was called, at the time, Trend Micro OfficeScan, you can, and we did. When we migrated to OfficeScan to replace the endpoint piece, we realized that the other IBM pieces were all up in the air except for BigFix. We then just blocked out IBM tools for Trend Micro tools, component by component. That worked out really well for us because the Trend Micro toolset was a lot more comprehensive than the IBM tools. And it integrated well with our BigFix infrastructure. It all just worked together. It was a no-brainer. Trend Micro built much better security systems than IBM did.

Once we had OfficeScan in place, we started talking about purchasing an IPS. I generally do a proof of concept when I'm going to purchase something. Trend Micro's TippingPoint IPS system was included in the eval. What I found is that it's not only the best product, but it has the best product support and that really makes a difference.

We're using Trend Micro on just about every front that they work on. They've been a tremendous partner for us, really good.

When we first kicked off the security department here, one of the problems we had was that we were chasing malware up and down the wire. We had McAfee endpoint management software and antivirus at that time, but we couldn't run it because, if we did, it would eventually eat up all the CPU and tip over the desktop.

We were looking for a replacement for that. We took a look at Trend Micro's Vision One technology and we found that they were deeply interested in what they refer to as attack surface management. It integrates the Trend Micro EDR tool that we had and turned it into something that can trace backwards. It could not only detect that an event had occurred, which is what we used to get, but now gave us information about what led up to that event. What sequence of events happened in our platforms that led up to it? We could trace it backwards, and that's the XDR component. They replaced the EDR component and that's when we got into business with Vision One.

Since then, we have deployed the Deep Security and Deep Discovery components. in addition to their IPS TippingPoint and their endpoint. We also have their email security solution in place.

The Deep Security toolset sits in your data center on every server instance you want protected. The operating systems Trend Micro supports are Windows, Linux, Solaris, and AIX. And what do we deploy in our organization? Those four operating systems. I thought, "That is like a message from God himself." I was taken aback by that.

And right now, we are migrating into their Cloud One environment. That takes it to the next level and allows us to take advantage of the analytics that exist in the cloud without having to set up all of the infrastructure to support it. Everything we have remains as is, on-prem, but everything now reports up to the cloud, and that information is enhanced and further aggregated into more meaningful data, which then comes back down into our purview. That's what the Cloud One approach is all about.

They are a pretty cool company and they're really well organized and well managed.

The initial deployment is always the toughest because you've never done it before. You're going to run into issues that you aren't familiar with. As you go from OfficeScan to Apex One, to Vision One to Cloud One, it gets easier every time you do it because you know what's coming.

By then, you already have an established group of people who support you, and who have been supporting you for some time. You're familiar with working with them, you know what to expect and how things are going to roll forward. And you pretty much know what the time frame is going to be. That part is all good.

Vision One is on-prem. We started building data centers a long time ago and I had the honor and privilege of doing that. We built out redundancy at the data center level so there are two of everything. And then you think, "Well, what happens if something happens to the data center?" So we built another one. And then we realized we wanted it somewhere else because we get enough earthquakes in Southern California to know that nothing is safe here. As a result, we built one out in Arizona and we mimicked what we had here and then whammed it all together. So we can fail over here or to the Arizona facility. We essentially have two private clouds that we manage. That got us to where we were about a year ago.

And then, suddenly, there was the idea of moving up into the cloud. We did start working with Azure and AWS to move items into the cloud, but there were some issues with that too.

For example, if we build out a big piece of infrastructure in our data center, we purchase the hardware and then deploy it. All of that hardware is CapEx and you can write off the cost of most of it over a period of years. When you move into the cloud, you don't get that break, and if you're taking advantage of somebody else's infra, they're going to be charging you for that service. While I'm no expert on the cloud, we have put together some cloud-based applications, but, from a financial standpoint, it is really expensive. You don't get that CapEx back into your pocket like you do when you're putting together your own data centers.

Our management still wants to put more stuff up in the cloud, so we'll continue to do that, and Cloud One allows you to do that with the workload security features.

We did it all in-house. I found someone who had already worked in security, within our company, and brought him onto my team. If you can find somebody who has already done this job and understands it, then not only can you have them deploy it immediately, which takes that piece off the table, but they are in a position to start learning other things because they already know the infrastructure that you're deploying really well. At every opportunity that I had to grab somebody who already had experience, and was good with what they did, I did so. It helps to get experienced people.

I've always felt that automation and the integration of platforms were going to be the key to this. 

The reason I felt that way was that I didn't go into security when I got out of school. I was fortunate enough to get a job at the NCR Systems Engineering division. I built and designed microprocessors, and then I built operating system software for the microprocessors. I was exposed to a lot of what's going on in the bowels of the beast. Although the beast changes from company to company, you have an idea of what's actually going on.

I then started my own company and what I learned was that integration of elements is key to your success, as was automation. You need to automate solutions because you don't want a bunch of people trying to fix things if you can automate things and take care of problems.

When we look at the logs from the IPSs, for example, they're blocking hundreds of thousands, and sometimes millions, of packets a day. If we were allowing those packets in, I don't know what would happen, but I don't think it would be good.

Also, I don't have a big staff under me. The idea that, as a chief information security officer, you're going to get a couple of hundred people to go work on things is just not going to happen. So you really have to set things up and configure them for automation, and any kind of alerting has to point to the problem rather than tell you where to start looking.

They have a new pricing method and we haven't been pulled into that yet, which I'm grateful for. It's tough enough dealing with dollars, but with their new solution—and I'm not up on it because I haven't used it yet—you buy tokens or some kind of points and you purchase things with them. We haven't gone there. We stayed with what we had.

From a pricing standpoint, they're a really good negotiator and they'll work with you. At the first Trend Micro conference I attended, there was a presentation to their sales team and they were told, "Do not worry about making money. Just make our clients happy, and the money will come." They're good at that and a lot better than most companies. It's always good to have a good partner.

We looked at the new stuff that IBM was coming out with, which wasn't that new, so they didn't get very far in our evaluation. We also looked at McAfee and another company that was a startup at the time, although I don't remember its name.

I had three or four vendors in for PoCs, and I asked each one of them for someone to support the effort, and to give me about a month. By the time I was done, I not only got the best product, but the best vendor too. The support has to be there during that process or they're not going to win the day. Some of them were as bad as, "Here it is, let us know how it fares." And I was thinking, "Well, I may have a few questions between now and then. I hope somebody is on the phone to answer them," but you don't always get that luxury. But Trend Micro was really good and that's why I stuck with them.