Our use case for Trend Vision One is for our security platform. We use it for antivirus, XDR, and network telemetry purposes.
Beheerder ICT-Services at a government with 201-500 employees
Centralized visibility improves threat detection and response
Pros and Cons
- "I like how easy it is, and there is a single pane of glass. We have one console for everything."
- "Trend Vision One helped reduce the time to detect and respond to threats by 70% to 80%."
- "Vulnerability scanning could be improved. They need to see more CVEs and scan products for known vulnerabilities, allowing for better display and review of potentially exploitable servers by hackers or through configuration settings."
What is our primary use case?
How has it helped my organization?
Trend Vision One helped us to consolidate our use of security vendors and reduce silos. We had three or four consoles from different products, and we consolidated them into one console with this product.
Trend Vision One helped reduce the time to detect and respond to threats by 70% to 80%.
Trend Vision One has helped us reduce noise from false positives.
We have been using cyber risk exposure management for 2 months since upgrading in April. It helps us identify blind spots by providing more visibility and insights into our environment, making it a valuable feature.
We use the network sensor, and its coverage is critical. With SIEM, we gain substantial insights into our environment, and having a complete 360 view is necessary in today's security world. It reduces the risk by 50%.
Having AI built into the Trend Vision One platform is important for our organization. It reduces many manual steps, resulting in more and quicker detections and advanced automation for remediation, improving efficiency by 60% to 70%. The solution aims to reduce risks and enhance detection.
What is most valuable?
I like how easy it is, and there is a single pane of glass. We have one console for everything.
Trend Vision One provides centralized visibility and management across protection layers. It has the functionality of different products and management of a single pane of glass. We have one console for everything. As a security engineer, it's easier to check the alerts and find everything. It consolidates a lot of consoles into one, and that's what we like most about it.
What needs improvement?
Vulnerability scanning could be improved. They need to see more CVEs and scan products for known vulnerabilities, allowing for better display and review of potentially exploitable servers by hackers or through configuration settings.
Buyer's Guide
TrendAI Vision One
September 2026
Learn what your peers think about TrendAI Vision One. Get advice and tips from experienced pros sharing their opinions. Updated: September 2026.
917,433 professionals have used our research since 2012.
For how long have I used the solution?
We have been using Trend Vision One for approximately 18 months.
What do I think about the stability of the solution?
We haven't experienced any stability issues. It has proven to be stable.
What do I think about the scalability of the solution?
The scalability of Trend Vision One is good.
How are customer service and support?
I have contacted technical support from Trend Micro. The quality and speed of support are good.
How was the initial setup?
It was easy. It took us one day to fully deploy Trend Vision One.
Some maintenance is required for updating agents on the servers.
What about the implementation team?
The deployment involved just one person working with the vendor in one day.
What was our ROI?
Trend Vision One has reduced risks by 50%. We have reduced the response time by approximately 70%-80%.
What's my experience with pricing, setup cost, and licensing?
When we have a good product such as Trend Vision One, the price is fine.
Which other solutions did I evaluate?
We have used Trend Micro products for many years, and we upgraded to Trend Vision One. We didn't test any alternatives, staying with what we've used for years.
What other advice do I have?
I would rate Trend Vision One an eight out of ten.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Senior Technical Engineer at Safezone Secure Solutions Private Limited
Manages cyber risk across endpoints and email while simplifying detection and response workflows
Pros and Cons
- "ROI is absolutely achievable, especially with TrendAI Vision One and server TrendAI Vision One platform."
- "Compared to other vendors like SentinelOne or CrowdStrike, all of them are providing detection and response methodology. However, TrendAI Vision One provides more visibility but has limitations on the response part."
What is our primary use case?
I work with Trellix, Trend Micro, Fortinet, and Netrix for DLP solutions. For Netrix DLP, I use Forcepoint, and for email security, I use Barracuda.
I have been working with Trend Micro for the past six years. I started with Apex One and Worry-Free, which evolved to TrendAI Vision One. TrendAI Vision One is a collaborative XDR platform designed to bring all security solutions such as mail security, cloud security, endpoint security, and identity security together and manage them from a single console. That is the main goal of TrendAI Vision One.
From my end, I have deployed email security, endpoint security, XDR, and web security from TrendAI Vision One. We are using TrendAI Vision One with both business essentials and pro bundle.
TrendAI Vision One has two kinds of solutions for endpoint security: standard endpoint protection for desktop machines and server and workload protection for existing Linux servers, Windows servers, or even containers and workloads in the cloud where you can install agents for those containers as well. These are the deployments which we have done for endpoint security.
What is most valuable?
The detection part works well for me. The response part, including automatic containment, requires creating playbooks. Even though I create them, I have faced many threat attack scenarios where detection pops up, but the appropriate response action is not being taken.
Attack discovery and attack surface discovery are valuable features. Every organization has endpoints, and no organization will be willing to do a full discovery or testing on all those endpoints or devices. Attack discovery helps us know which endpoints we have with Trend Micro, what vulnerabilities and loopholes are available in the endpoints, and provides insights into our attack surface.
I have used the cyber risk exposure management product completely except for security awareness. I have used data security posture, identity security posture, and network security functionalities. I have not ensured cloud security yet, but we are yet to have hands-on experience with that. I have showcased these functionalities to customers and conducted many POCs for new clients covering cyber risk exposure management, XDR, email security, endpoint security, and network security. I have explained how well TrendAI Vision One captures the correct data.
The response time after detection is approximately three hours.
What needs improvement?
Visibility is good, but TrendAI Vision One can improve the response part. Compared to other vendors like SentinelOne or CrowdStrike, all of them are providing detection and response methodology. However, TrendAI Vision One provides more visibility but has limitations on the response part.
If TrendAI Vision One can improve the response time and playbooks, particularly with more customizable playbooks, it would be greatly helpful. We have raised feature requests to Trend Micro. If they have more predefined playbooks and more options for response management, it would be beneficial because that is what end users are expecting.
As a reseller, we are dealing with the pain because customers are asking why response is not being taken even though TrendAI Vision One detects suspicious files. In some cases, I follow best practices by updating playbooks at regular intervals, but that is a manual process. An automated process to take appropriate action for suspicious and malicious files would be necessary. The response part might be improved to provide better value.
For how long have I used the solution?
I have been working with Trend Micro for the past six years.
What do I think about the stability of the solution?
TrendAI Vision One is stable. Before TrendAI Vision One, Trend Micro had Apex One and Worry-Free products for endpoint security that were not stable. However, after TrendAI Vision One was introduced, I do not see any stability issues.
What do I think about the scalability of the solution?
Scalability is good. Previously, it was good because they were using a credit system where they would give credits and based on the credits we could allocate our own licenses. Right now they have removed this feature, so we are yet to do some testing on that. The credit system was effective because we had flexible licensing and scalability, and we were able to use the resources when and if it was necessary.
How are customer service and support?
Two factors are important: the time to give the first response and the technical ability of the engineers. I heard that they have laid off many old employees and senior employees.
The integration part is good. They also have an AI platform built into the console which provides more details in layman's terms. When explaining an attack to management, you can communicate it to a CIO in technical terms because they are from a technical background and will understand all the details. However, when taking this to a CEO or CFO who are not technical persons with backgrounds based on industry, you should explain it in simple terms. The AI integration with TrendAI Vision One gives the details in a much simpler way in layman's understanding. That feature is good.
How would you rate customer service and support?
Neutral
How was the initial setup?
The installation is easy. Even for Linux and Mac machines, it is just two or three commands.
What was our ROI?
ROI is absolutely achievable, especially with TrendAI Vision One and server TrendAI Vision One platform. Previously, they had MSVA, which was a virtual appliance that on-premises clients needed for mail security. After they came up with the cloud email security solution, many customers are feeling relief, and the latency is much better when compared to an on-premise solution.
For ROI in email security, they provide BEC, which is the best ROI for every customer. If there is an outage that occurs in Microsoft or AWS or any other cloud platform, there is an email continuity platform for emails. That is good ROI.
From a deployment perspective, it shows around fifty to sixty percent. The impact given to the business in terms of real impact is up to ten to twenty percent.
What's my experience with pricing, setup cost, and licensing?
This is quite affordable. It is not that expensive.
Which other solutions did I evaluate?
We buy from Trend Micro. TrendAI Vision One definitely falls in the leader quadrant in Gartner, and its capabilities are good. It can be in that leader quadrant. For an endpoint security solution, managing attacks is the key thing. It is not about daily activities like what policies and functionalities are provided. These matter, but at the end of the day, if an attack is going to happen, the end user will assess the support of TrendAI Vision One and the response part of TrendAI Vision One. These two parameters are going to be assessed, and based on these two parameters, any quadrant achievement from labs like Gartner or Forrester will be based on these two parameters only.
What other advice do I have?
For standard endpoint protection, if it is a detection, it is a detection. When compared to CrowdStrike, TrendAI Vision One creates much less false positives. There is no big noise on this, but that is one way to consider it. False positives do come, and it is completely based on the configuration which we do. On the initial phase of the deployment, after a month or two, we keep it in detection mode, and after that, we pursue the prevention mode so that blocking is enabled.
If the containment functionality gets automated, it would be on a better note. The response part, if improved, will be very helpful. From a deployment perspective, it shows around fifty to sixty percent.
TrendAI Vision One is fully on the cloud with no on-premise option. They tie up with multiple cloud vendors, but they provide a SaaS platform built by Trend Micro. Trend Micro itself is hosted on some AWS servers, which is what I have heard, but I do not want to comment on that.
I would rate this review an eight.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: My company has a business relationship with this vendor other than being a customer. Reseller
Buyer's Guide
TrendAI Vision One
September 2026
Learn what your peers think about TrendAI Vision One. Get advice and tips from experienced pros sharing their opinions. Updated: September 2026.
917,433 professionals have used our research since 2012.
Head of I T at Conquest Group
Transforms cybersecurity landscape with efficient and comprehensive protection
Pros and Cons
- "One of the best decisions we made was choosing Trend Vision One; it has transformed our entire security and cybersecurity landscape, providing a one-stop solution to manage everything efficiently and effectively."
- "The only disappointing aspect is that every time new features are adopted, additional credits are required, which could push the budget over. This practice should really be reconsidered by Trend."
What is our primary use case?
I use Trend Vision One for Total XDR and endpoint protection as an all-in-one security solution.
How has it helped my organization?
One of the best decisions we made was choosing Trend Vision One. It has transformed our entire security and cybersecurity landscape, providing a one-stop solution to manage everything efficiently and effectively.
What is most valuable?
One of the most valuable features is Cyber Risk Exposure Management.
What needs improvement?
There is room for improvement in leveraging AI technology to protect against emerging AI-based threats.
For how long have I used the solution?
I have been using the solution for two years.
Which solution did I use previously and why did I switch?
We previously used an outdated and inefficient Trend Micro system, which caused high security risks.
What's my experience with pricing, setup cost, and licensing?
This is not a competitive price — the costs are on the higher side. However, I don’t regret it, as it can help save significantly in other areas. The only disappointing aspect is that every time new features are adopted, additional credits are required, which could push the budget over. This practice should really be reconsidered by Trend.
Which other solutions did I evaluate?
I also evaluated CrowdStrike as an alternate solution.
What other advice do I have?
Trend Vision One is a five-star product.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Platform Engineer Ii at a outsourcing company with 5,001-10,000 employees
Platform has improved ransomware detection and now supports faster automated incident response
Pros and Cons
- "TrendAI Vision One solves these problems by providing greater detection capabilities and automated response across all of these layers."
- "TrendAI Vision One could bring in more data loss prevention capabilities specifically on the endpoints, as the current offering lacks some important capabilities."
What is our primary use case?
TrendAI Vision One is our centralized platform for managing multiple security products, specifically on endpoint and workload security.
We have integrated TrendAI Vision One with Microsoft and AWS cloud accounts that we use. Our SOC team monitors TrendAI Vision One and the platform provides them with multiple views of data sets and detections that have occurred, helping them to quickly onboard with all the relevant data they should be aware of.
We are using TrendAI Vision One sensors across endpoint and workload security.
What is most valuable?
We were facing multiple cybersecurity incidents in our endpoint and workload security, including attacks such as ransomware and malware. TrendAI Vision One solves these problems by providing greater detection capabilities and automated response across all of these layers.
TrendAI Vision One helps with integration and correlation of multiple security solutions and provides us with better dashboard and reporting capabilities to showcase the data to our board.
We are seeing fewer threats and events across these security layers since we invested in TrendAI Vision One. The platform has been particularly useful in protecting against ransomware.
We are able to respond faster and quicker compared to earlier because of the automated response that TrendAI Vision One offers, which reduces our dependency on manual effort that was previously required.
What needs improvement?
TrendAI Vision One could bring in more data loss prevention capabilities specifically on the endpoints, as the current offering lacks some important capabilities.
They could also bring in data loss prevention capability and integrate with patch management solutions, which is overdue.
For how long have I used the solution?
We have been using TrendAI Vision One for the past three and a half years.
What other advice do I have?
It is extremely important to protect sensitive and critical data that resides on servers.
I would say TrendAI Vision One is a really good platform overall, and we found it fitting into our budget compared to competitive solutions. I would rate this product highly.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Manager of Cyber Security at a university with 1,001-5,000 employees
We've ease of configuration and customization and improvement in threat response
Pros and Cons
- "The ease of configuration, customization, and organization are what I appreciate the most about TrendAI Vision One."
- "It is a bit slow to implement kernel support on the Linux side. When doing patching and upgrades on our Linux servers, we often find that the Trend agent doesn't support the kernel version."
What is our primary use case?
We use TrendAI Vision One for our endpoint protection in our data center, mostly focused around our server assets, and we do anti-malware, intrusion prevention, as well as firewall, host-based firewall capabilities.
What is most valuable?
The ease of configuration, customization, and organization are what I appreciate the most about TrendAI Vision One.
What needs improvement?
It is a bit slow to implement kernel support on the Linux side. When doing patching and upgrades on our Linux servers, we often find that the Trend agent doesn't support the kernel version. It's usually not far behind, but we often are in a position where we may not be properly protected for a period.
For how long have I used the solution?
We started using Trend Deep Security, which was the product prior to TrendAI Vision One, seven or eight years ago, and then we transitioned to TrendAI Vision One two years ago. While we have been using TrendAI Vision One proper for two years, we had essentially the same product in an on-prem version for seven or eight years.
What do I think about the stability of the solution?
We've had performance issues with the agents of TrendAI Vision One at odd times, but I wouldn't say it's been a widespread issue or a common issue. Once in a while, there have been things that we've attributed to Trend.
What do I think about the scalability of the solution?
The scalability of TrendAI Vision One seems infinite. We're not a huge organization, so we haven't really run into any limitations, but it appears it can scale to accommodate and serve any of our purposes.
How are customer service and support?
The quality of support for TrendAI Vision One is generally very good. If we have any issues with support, we can leverage our sales engineer for support or escalation. I really haven't had any concerns. I have contacted the technical support or customer support via phone number or ticket.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We have used Microsoft Defender, Sophos, as well as McAfee as alternatives to TrendAI Vision One. I prefer TrendAI Vision One more compared to those alternatives.
How was the initial setup?
We transitioned from our on-premises Deep Security deployment to Vision One, and the process was relatively smooth. However, we encountered a few challenges related to legacy configurations and ensuring proper connectivity to our server assets. With an on-premises software application, we didn’t have to worry about internet accessibility for some of our server nodes. Consequently, we faced issues getting non-internet-connected server endpoints to communicate with the cloud. Luckily, there is a solution for that, but it took some time to get everything functioning properly.
TrendAI Vision One is a large product suite. There are many features that we don't have fully deployed, but the amount of time it took for us to go from on-prem to the cloud for similar services without onboarding anything new that TrendAI Vision One offered was two months for 400 assets, server nodes.
What was our ROI?
It has reduced our time to detect and respond to threats, but I don’t have a way to quantify that.
What's my experience with pricing, setup cost, and licensing?
I know the pricing for TrendAI Vision One. It's been a while, but it doesn't seem bad. They made some changes to their pricing in the past. It used to be a per-server node pricing structure, but now they do it by credits. I would say it's improved because we can, for the same investment, shift and adjust which capabilities we're leveraging within the platform. It's not super expensive. It's definitely an increased cost over leveraging Microsoft Defender, which we already have the licensing and capability for. We chose to spend money on this as opposed to leveraging a product that we already had, but the cost is fair.
What other advice do I have?
The sensors we're using include the anti-malware products, and we have the EDR sensors deployed on our server endpoints. They have network sensors and other features, but we're not leveraging any of those.
We started onboarding some of our services in the last three or four months to TrendAI Vision One to gain more visibility, so it's early in that adoption. We haven't taken any action based on alerts or notifications from TrendAI Vision One, as we're still in the early stages of getting our third-party services set up and monitored.
TrendAI Vision One hasn't helped us consolidate use of security vendors. This product is solely used for one purpose. We're not leveraging TrendAI Vision One for other areas within IT or at our company, so we haven't reduced silos. We had an opportunity to go with Defender, which would have reduced the number of products we use, but instead we decided to keep using Trend because we did appreciate it. I'm not sure if TrendAI Vision One has helped me to reduce the noise from false positives.
I would rate TrendAI Vision One a nine out of ten.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Sr. Manager, IT Security at a healthcare company with 1,001-5,000 employees
Exceptional customer service streamlines onboarding and improves AWS security integration
Pros and Cons
- "The best features TrendAI Vision One offers are the dashboard, reporting, and the customer service experience, specifically the customer service experience."
What is our primary use case?
My main use case for TrendAI Vision One is XDR security in our AWS environment for our EC2 instances, and I'm hoping to accomplish effective security measures with it.
What is most valuable?
The best features TrendAI Vision One offers are the dashboard, reporting, and the customer service experience, specifically the customer service experience.
What makes the customer service experience stand out is that the onboarding process was exceptionally smooth. John, our account manager, was able to coordinate us with a technical resource to help with a white-glove onboarding process to ensure that our migration from Trend Micro Cloud One to Vision One was smooth and successful.
TrendAI Vision One has impacted my organization positively, and it's our XDR solution, so it works as intended.
Having TrendAI Vision One as my XDR solution has helped my team significantly. The Sentinel integration is a huge help for allowing us to detect and respond to events in our AWS environment.
What needs improvement?
I cannot think of anything that TrendAI Vision One can be improved.
For how long have I used the solution?
I have been using TrendAI Vision One for about a week.
What do I think about the stability of the solution?
TrendAI Vision One is stable. I have experienced minimal issues with reliability or downtime.
What do I think about the scalability of the solution?
TrendAI Vision One's scalability is excellent. It can handle my organization's growth and changing needs.
How are customer service and support?
The customer support is exceptional. Working with their technical resource, Victor, was fantastic, and I am very happy with the customer service that we experienced from both Victor and John.
I would rate the customer support exceptionally high on a scale of one to ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I did not previously use a different solution before TrendAI Vision One.
What was our ROI?
I have seen a return on investment. I have been a Trend Micro customer for years and I continue to see value in their platform and have used it at several jobs.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing was very easy. Our enterprise account manager, John, made all of that very easy, as he was able to send me the private offer, walk us through accepting it inside of the AWS Marketplace, and helped us cancel our existing subscription.
Which other solutions did I evaluate?
Before choosing TrendAI Vision One, I evaluated other options. I considered Microsoft Sentinel and Microsoft Defender.
What other advice do I have?
The advice I would give to others looking into using TrendAI Vision One is to try it.
I rate TrendAI Vision One an 8 out of 10.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Associate Specialist Infrastructure and Support at a security firm with 501-1,000 employees
Helps secure endpoints and quickly respond to incidents
Pros and Cons
- "Trend Vision One has improved the way our organization functions by acting as both a monitoring tool and an antivirus, giving us insight on potential threats and enhancing our response time to security incidents."
- "Our developers were understandably frustrated that they couldn’t debug code for a month and a half, which impacted our project timelines."
What is our primary use case?
Our use cases for Trend Vision One are monitoring and alerts.
How has it helped my organization?
The biggest challenges we wanted to address with Trend Vision One were securing endpoints and enabling us to quickly respond to incidents or threats. This is the main goal for using this solution.
Trend Vision One has improved the way our organization functions by acting as both a monitoring tool and an antivirus, giving us insight on potential threats and enhancing our response time to security incidents. It is hard to measure the time savings but we save a significant amount of time in responding to potential threats. For example, we don't expect employees to respond to emails, chat, or calls outside of working hours. Trend Vision One has a feature where we can block all access to the laptop or endpoints. It allows us to take immediate action without waiting for the user to respond.
In terms of reducing noise from false positives, unfortunately, some behaviors can be mistaken for bad behaviors, but that isn't the fault of the software itself. It largely depends on how the developers of other applications implement their software and how it is run. We encountered an issue with another software called Rapid7, which periodically runs a command on MacBooks or Apple operating systems. This command, which is quite lengthy, searches for any unsecured credentials or API keys related to GitHub on the laptop. The way the application triggers is significant: it runs under root privileges, executing that command in the terminal for the user. Trend Vision One picks this up as a suspicious command, interpreting it as an attempt to find unsecured credentials. Despite having whitelisted the entire command in Rapid7, Trend Vision One still flagged it. We went back and forth on this issue, but ultimately we decided that it wasn't worth further troubleshooting to silence this alert due to the potential for actual malicious use of such commands. While we could whitelist it, we did not want to risk it being exploited maliciously. In the end, we chose to ignore the alert. They helped us reduce some other noise, but there was some noise that we weren't able to reduce.
Vision One AI has been very useful. All IT people stay up to date with security risks, exposures, alerts, or attacks. Vision One AI helps us explain or understand the alerts and what actions are recommended.
What is most valuable?
The workbench alerts are something we find very useful, as they help us stay informed about various activities. Not all alerts are positive, but they provide valuable insights into the detection methods and help us understand how certain issues arise. For example, if someone attempts to run a piece of software that encrypts a file, one of our tools, which is used for evidence gathering in surveillance systems, may encrypt the file too quickly. As a result, Trend Vision One may trigger an alert. Although this is a false positive, it still gives us insight into the behavior involved. This allows us to investigate the alert further and provide feedback to the user or development team, letting them know that similar triggers are likely to occur with other security systems or software.
Other useful features include intrusion and mailbox alerts, suspicious unauthorized access, tracing logs, website clicks, and email filtering for bad attachments.
What needs improvement?
The improvement I have been asking for is an easier way to create MDR requests. Not all alerts that come through Trend Vision One receive an investigation, and we would like the ability to easily request an investigation on lower-scored alerts without logging into the support portal to create a ticket.
I would like to see Trend Vision One and OfficeScan consolidated into one platform. Currently, it is the same space but two different layers. It would be nice to have both combined instead of having two clients.
There is room for improvement when it comes to support.
For how long have I used the solution?
I've been working with Trend Vision One for three years.
What do I think about the stability of the solution?
Trend Vision One is stable enough. We don't see many performance impacts on our endpoints, except for when our weekly scheduled scans happen. Our developers express that it limits how freely they can develop, but I personally appreciate the insight it gives us and the actions that allow us to take on our devices.
How are customer service and support?
I would rate their support a six out of ten. We encountered an issue with one of our tools—specifically, Visual Studio. One of our developers faced difficulties debugging code because Trend Vision One was blocking the debugging application or causing it to crash. This problem stemmed from a Windows update, and it took us a month and a half to identify the root cause. After we opened a ticket either at the end of March or early April, we waited several more weeks for a solution. Although the Windows update occurred back in February, we didn’t receive the fix until the end of May. The interaction between Windows and the application played a significant role in the issue, as the debugging application starts the code and injects itself into the running application, which Trend Micro flagged as problematic after the latest Windows update. Fortunately, this issue has now been resolved, but it was indeed a painful experience. Our developers were understandably frustrated that they couldn’t debug code for a month and a half, which impacted our project timelines.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
The company previously had SentinelOne before my time, and I can say that SentinelOne was not effective.
We currently use Rapid7 as our Managed Detection and Response (MDR) service. In my experience, both Rapid7 and Trend Vision One serve similar purposes, but they have distinct differences. There are times when Rapid7 provides us with more detailed information, while at other times, Trend Vision One offers greater insights. This is partly because Trend Vision One collects more data from the devices, allowing it to better identify the root causes of alerts compared to Rapid7.
Additionally, I find that the MDR team at Trend is generally more responsive than that of Rapid7. However, there are some disadvantages as well. For instance, we haven't yet set up cloud monitoring capabilities with Trend Vision One. Rapid7 currently handles our cloud infrastructure monitoring and manages services like Office and Okta. While Rapid7 is equipped to monitor these services, Trend Vision One is not yet at that level. We are exploring ways to enhance its capabilities, and if it can provide the same level of service as Rapid7, we might consider discontinuing our use of Rapid7 altogether.
How was the initial setup?
We use the SaaS solution. I was not involved in the initial setup and deployment process, which occurred prior to my time here, but I have readjusted some policies.
Previously, it was difficult to understand some alerts. However, as time goes by, we differentiate better between them, and the AI feature is an extremely good tool that explains things that are gibberish to the regular user. The learning curve is quite steep.
What was our ROI?
It has helped us understand some of the alerts that we did not comprehend.
What other advice do I have?
It is an all-around solution that includes various modules for comprehensive security monitoring and alerting. This solution is particularly effective when integrated with other hardware or on-premises solutions, such as Deep Discovery Inspector, which monitors your network.
The interface is adequate, but it is constantly changing. New features are being added, and items are being rearranged almost daily. We might have missed some announcements regarding these frequent updates. As it is an evolving solution, such changes are to be expected. However, there are still features that are buried within menus, which previously required extensive searching to locate. For instance, until last year, isolating endpoints was only possible through the search function. Now, they have added a feature within the endpoint inventory that allows you to select devices and isolate them immediately, rather than having to jump through multiple hoops to access that option.
The application has also become slightly more responsive. Regarding its functionality, the insights it provides are quite useful. The application displays various actions, and you can drill down into alerts to view the execution path associated with them. For example, if an application triggers an alert, you can right-click on that alert and select "Check Execution Profile." This feature shows you where the process started, what actions it took, and where it ended. This improvement is beneficial for understanding how tasks are executed.
I would rate Trend Vision One an eight out of ten.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Security Engineer at Payatu
Centralized management enhances threat response with automation and comprehensive insights
Pros and Cons
- "The workbench alerts provide valuable insights into attack chains and relevant information, while Observer techniques give a comprehensive overview of ongoing activities."
- "Trend Vision One requires several enhancements for optimal performance."
What is our primary use case?
As a cybersecurity analyst at a managed security service provider, I use Trend Vision One for two of my clients. My primary use cases involve standard XDR functions, such as anomaly monitoring, alert analysis, and incident response. To streamline these processes, I've configured automated response playbooks within Trend Vision One. The insights provided by the platform, mainly through the Workbench and Observe Auto module, are invaluable for understanding my clients' environments and identifying vulnerabilities that need to be addressed.
I work with clients across various industries, including education and power. My education client utilizes Trend Vision One for specific security needs, while my power industry client, an electricity board, has a comprehensive Trend Micro solution in place, including Vision One, Apex One, and Deep Security Manager. With Vision One, I've successfully detected and addressed numerous web attacks, malware attacks, and unauthorized access attempts on production servers in the education sector. For the power client, the solution has effectively detected and blocked multiple ransomware attacks. These are common occurrences and demonstrate the value of Trend Micro's security solutions.
We use Trend Vision One on all endpoints in two scenarios. For one client with on-premises servers and endpoints, we use Trend Vision One as a comprehensive solution. For another client in the education sector, we use Trend Micro Deep Security Management alongside the Vision One XDR platform on their cloud-based Linux servers.
How has it helped my organization?
Trend Vision One provides centralized visibility and management across all protection layers. This is crucial for efficiently sharing data with management, both internally and client-side. The platform avoids technical jargon, offering executive summary dashboards and summarized incident reports that clearly communicate security status. This allows for concise and effective communication with non-technical stakeholders, assuring them of their security posture. Trend Vision One's automated dashboards streamline reporting, eliminating the need for extensive manual documentation, which is especially valuable for technical users.
I use executive dashboards to build on threat detection, check for vulnerabilities, and create appropriate responses for individuals or groups of endpoints.
We use the risk index to assess and enroll our risk score. We maintain a low-risk index, which helps both management and me understand our score in relation to global risk factors.
Although I inherited Vision One as a service provider from another team, I eventually began utilizing its full potential and reaping its benefits.
Trend Vision One offers a phishing simulation feature in its cyber risk assessment. I frequently use this tool with my clients to evaluate employee email awareness. It generates comprehensive reports and provides functionalities for easy management.
Attack surface risk management helps identify vulnerabilities and high-risk threats in an environment, but it may also generate some false positives.
Trend Vision One significantly reduces MTTD and MTTR by approximately 50 percent. Its automated playbooks enable an immediate response to detected threats, providing near-instantaneous protection. While manual analysis and reporting of critical errors typically take an analyst up to 15 minutes, Trend Vision One's configured playbooks can automatically complete the same task within two minutes.
I have configured some playbooks to take automated actions on Trend Vision One while detecting some specific alerts or while detecting some specific playbook alerts.
What is most valuable?
Trend Vision One offers several features that I appreciate. The workbench alerts provide valuable insights into attack chains and relevant information, while Observer techniques give a comprehensive overview of ongoing activities. The platform's automated playbooks streamline incident response, significantly reducing MTTD and MTTR. Additionally, the ability to integrate with various firewalls and data sources, including Trend Micro's suspicious object management, centralizes threat management and simplifies daily security operations and incident response tasks.
What needs improvement?
Trend Vision One requires several enhancements for optimal performance. The platform should allow users to create custom phishing templates directly within the console and improve logging capabilities to facilitate seamless integration with SIEM solutions. Additionally, it should provide a mechanism for configuring Office 365 Advanced Threat Protection alerts to be displayed within the Workbench for streamlined threat management.
For how long have I used the solution?
I have been using Trend Vision One for about a year and a half.
What do I think about the stability of the solution?
Trend Vision One is a stable platform with no significant issues like lagging or crashing.
What do I think about the scalability of the solution?
Trend Vision One is easy to scale up by adding new agents, although the credit system for feature usage is confusing and could be simplified.
Which solution did I use previously and why did I switch?
I have experience with solutions like Sophos Central XDR and Wazuh, and while they have their strengths, I find Trend Vision One to be a competitive option with a comprehensive range of capabilities.
What other advice do I have?
I would rate Trend Vision One nine out of ten.
The on-premises Trend Micro solutions may require updates.
After deploying Trend Vision One on pilot devices, I recommend exploring the entire portal to familiarize yourself with its features and capabilities.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: My company has a business relationship with this vendor other than being a customer. MSP
System Engineer at a computer software company with 5,001-10,000 employees
Ransomware playbooks have strengthened protection and improve threat detection and response
Pros and Cons
- "TrendAI Vision One has positively impacted my organization by specifically helping improve security posture and response time for threat handling, as well as improving our cyber risk score."
- "The area where I think TrendAI Vision One can improve is the technical support."
What is our primary use case?
My main use case for TrendAI Vision One is for ransomware protection, user behavior analysis, and protection. I use TrendAI Vision One for threat detection and response, which helps me with investigation and response. It helps to integrate with the existing infrastructure as my main use case for TrendAI Vision One. Data loss prevention has been a valuable use case with the endpoint security as a feature that stands out to me. The top security challenges in my industry include improving the cyber risk posture and ransomware protection, and TrendAI Vision One is helping me address them, especially for ransomware protection.
What is most valuable?
I find threat detection and response and remediation using playbooks the most useful features TrendAI Vision One offers me.
In a case of a ransomware incident, the playbook in TrendAI Vision One immediately contained the infection by isolating the endpoint, demonstrating how those playbooks and the detection and response features help me in my day-to-day work.
TrendAI Vision One has positively impacted my organization by specifically helping improve security posture and response time for threat handling, as well as improving our cyber risk score.
TrendAI Vision One has made managing security easier for me compared to earlier by providing centralized visibility and management across protection layers.
What needs improvement?
The area where I think TrendAI Vision One can improve is the technical support. TrendAI Vision One should speed up the response time for the support tickets that have been opened regarding needed improvements.
For how long have I used the solution?
I have been using TrendAI Vision One for almost one year now.
What other advice do I have?
TrendAI Vision One should speed up the response time for the support tickets that have been opened regarding needed improvements. I rate TrendAI Vision One a nine out of ten because TrendAI Vision One can improve the technical support. I am using TrendAI Vision One sensors on the endpoint, as well as on the endpoint and workloads. Covering the endpoint is very critical for my organization's network because the endpoint is one of the most important areas to be protected. TrendAI Vision One has helped reduce my time to detect and respond to threats; in my previous studies, I found the detection and response has come down from weeks to only days. My overall review rating for TrendAI Vision One is nine.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Data Protection Officer at eComm
Centralized visibility enhances security posture with robust features
Pros and Cons
- "The Trend hunting feature is beneficial, providing the opportunity to investigate and see what's happening, using frameworks such as MITRE ATT&CK to analyze logs."
- "Trend Vision One provides centralized visibility and management across protection layers, which is crucial for compliance."
- "An easier way to understand the credit structure would be helpful."
What is our primary use case?
Our infrastructure utilizes Trend Vision One for endpoint and cloud-based security. While all our endpoints are cloud-based, allowing us to deploy Trend Vision One in the cloud, we also maintain endpoint-specific protection. Currently, our network infrastructure is not fully integrated with Trend Vision One. The platform primarily monitors our backend infrastructure and provides initial response capabilities.
I implemented Trend Vision One to consolidate log inspection, integrity monitoring, intrusion prevention, and application control into a single platform, eliminating the need to switch between multiple applications.
How has it helped my organization?
Trend Vision One provides centralized visibility and management across protection layers, which is crucial for compliance. It allows us to show audits of what’s going on and keep all evidence in one place. This centralized visibility has improved our efficiency, as it means just one login is needed to complete all necessary tasks, maintaining focus and reducing distractions resulting from multiple sources.
The Vision One executive dashboards effectively communicate our company's overall security posture by providing a clear risk overview. Executives appreciate the simple visual cues, with green indicating low risk and yellow signaling high risk, allowing for quick and easy understanding of our current security status.
I immediately recognized the benefits of Trend Vision One because, unlike our other security applications, it provides comprehensive visibility.
I utilize Vision One's risk index feature to assess our organization's risk level and benchmark it against our peers. This comprehensive evaluation allows us to understand our current risk profile, identify areas for mitigation, and determine acceptable risk thresholds. The risk index feature is essential to our business operations.
Attack surface risk management helped us identify blind spots in our environment and provided detailed remediation strategies. This works as a second pair of eyes that helps look for vulnerabilities, which in turn improves our security posture.
Trend Vision One improves our detection and response times by identifying vulnerabilities and summarizing mitigation strategies.
Trend Vision One helps reduce the amount of time we spend investigating false positive alerts by 80 percent.
What is most valuable?
I love Trend Vision One for its robustness, allowing us to deep dive into a lot of information. The Trend hunting feature is beneficial, providing the opportunity to investigate and see what's happening, using frameworks such as MITRE ATT&CK to analyze logs. Its risk index feature allows us to see risk status quickly and provides valuable insights into our security posture.
What needs improvement?
The only issue I have with Trend Vision One is the credit structure, which is confusing. An easier way to understand the credit structure would be helpful.
For how long have I used the solution?
I have been using Trend Vision One for over five years.
What do I think about the stability of the solution?
Trend Vision One is stable and does not crash. In my experience, it has not shown any instability issues.
What do I think about the scalability of the solution?
Trend Vision One is scalable. We can increase or decrease according to needs, although pricing changes when scaling.
How are customer service and support?
Trend Micro's support response time can be slow. The quality of assistance varies depending on the issue. However, reaching qualified technical engineers can be challenging due to lengthy escalation processes.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
I've used many alternatives before, like Avast, SonicWall, and Mimecast. These alternatives don't have all the integrated features of Trend Vision One, particularly the server and workload capabilities.
How was the initial setup?
The initial setup required deep diving and using resources such as help centers. Despite not being straightforward, it was manageable.
The deployment took three days.
What about the implementation team?
I implemented Trend Vision One in-house with the support of team members, using resources like software guides and videos.
What's my experience with pricing, setup cost, and licensing?
Trend Vision One is an expensive product.
What other advice do I have?
I would rate Trend Vision One eight out of ten.
The most significant security challenge we face is zero-day attacks, which exploit vulnerabilities unknown to us. While Trend Vision One provides some protection, it cannot catch all zero-day threats, leaving us potentially exposed. This inherent vulnerability in our security poses the greatest risk.
Trend Micro handles most maintenance, but we are responsible for installing agent patches on our servers.
New users should understand that Trend Vision One is different from other solutions they might have used. Reading and fact-finding are crucial. They must ask the right questions.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Buyer's Guide
Download our free TrendAI Vision One Report and get advice and tips from experienced pros
sharing their opinions.
Updated: September 2026
Product Categories
Endpoint Detection and Response (EDR) Network Detection and Response (NDR) Extended Detection and Response (XDR) Attack Surface Management (ASM) AI-Powered Cybersecurity Platforms AI SecurityPopular Comparisons
Cortex XDR by Palo Alto Networks
CrowdStrike Falcon
Microsoft Defender for Endpoint
SentinelOne Singularity Endpoint
Darktrace
Checkmarx One
IBM Security QRadar
Microsoft Sentinel
Elastic Security
Trellix Endpoint Security Platform
TrendAI Vision One – Cloud Security
Huntress Managed EDR
Buyer's Guide
Download our free TrendAI Vision One Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What is the biggest difference between EPP and EDR products?
- What is the difference between EDR and traditional antivirus?
- What is your recommendation for a 5-star EDR with low resource consumption for a financial services company?
- Which is the best EDR for a logistics company with 500-1000 employees?
- What is the best EDR or XDR product for a company with 9000 employees?
- What to choose: an endpoint antivirus, an EDR solution or both?
- Do we need to use both EDR and Antivirus (AV) solutions for better protection of IT assets?
- How does EternalBlue work?
- What are the best on-premise Endpoint Security solutions for a Tech Services company with 10,000 employees?
- Which is better for Endpoint Security: EDR or XDR solutions?


















