Carbon Black App Control vs. Symantec Endpoint Security

It is more suited to lock down critical systems and servers to prevent unwanted changes, although you can use it on daily basis on laptops and desktops, it needs constant attention and events analysis. For some scenarios i.e. financial institutions it is a must-have solution, as App Control now is a requirement 5 of PCI DSS.

Incentivized

We have found that Symantec Endpoint Security is better suited to newer systems running faster processors and more than 8GB RAM otherwise the client agent takes up too many resources and slows the system down. However, if you have a reasonably modern fleet of systems it does everything you would expect from an Endpoint Protection solution and works well as part of a multi-layered cybersecurity policy.

Incentivized

• Device Control - you can view and allow/disallow the ability for certain devices to be used in your environment. Specifically we used this with USB drives. If you have one you want to use - whitelist the serial number. The rest can't be used. Simple and easy.
• Software blocking. If you have an extremely dynamic software base (I doubt this is likely) this could get a bit annoying, but for most organizations like ours where we have specific applications that are required, and then the rest are a bit of an afterthought, it's easy to whitelist the correct applications that you want to be able to run in your environment. The rest can't run (in high enforcement). Users are able to easily request new applications, and you can set certain groups to be able to approve it on their own.
• Solid platform - with few exceptions setting up new software was very easy (Dragon Medical was a bit tricky, but worked through it with support). Once you have your rules set up and the initial setup done, you tend not to have to do much of anything except to update on occasion and deal with a few requests for applications to be unblocked, or publishes approved.

Incentivized

• The virus and spyware protection has worked well for us, catching several things and quarantining the items or cleaning them.
• The virus definitions very rarely fail to update for the users, so I feel confident that my client machines are kept up to date.
• I like the report I get daily telling me about threats found and action taken without having to login to the console to look it up myself.

Incentivized

• More frequently updates of "Software Updaters".
• Possibilities to tag within Yara rules.
• Overall it is the best whitelisting solution I have used.

Incentivized

• Removing dead clients from the console. This is nearly impossible to do, and makes keeping the console clean a very difficult task.
• Poorly tested versions are sometimes released that cause serious issues for users. This ranges from browsers malfunctioning to BSOD errors.
• Malware detection is good but not great. We are not confident in SEP by itself to neutralize malware threats. It's detection rate just isn't high enough for next generation and zero day threats.

Continued satisfied support. The saying "if it ain't broke, don't fix it..." comes to mind. It works, and we'll continue to use it and support Symantec.

Incentivized

The rating reflects Symantec Endpoint Security's ability to balance enterprise grade security with user-friendly workflows or advanced configurations require extra effort. For most organizations, the streamlined management and robust automation justify the high score. Management GUI is old fashined and need to be improve. Older devices may experience slowdowns during full scans without careful configuration.

Incentivized

We've used it for years and the software is easy to use. The dashboard is easy to read, and you can easily figure out where to go to troubleshoot or deploy software. Symantec is there for emergencies like backup restoration or file retrieval. It's pretty low maintenance. Symantec is there when your IT infrastructure needs it

Incentivized

Support is completely awful! You can never get anyone to help if you can even find a number to call. The support web portal is a joke and their response time if you're even able to submit a ticket is ridiculously slow.

Incentivized

Use a third party deployment tool and not the deployment option within the SEP Manager itself.

Incentivized

The big difference between Protect and Barkly/AMP is how exactly it goes about what it's doing. Protect is application whitelisting and program reputation. So the way it's protecting you is using a proprietary reputation service, and hash values to identify applications, and then hitting a list of whitelisted programs to decide if you are able to run that or not, based on the policy you are in. There is a LOT of value in that. We actually are working on transitioning to Cisco Advanced Malware Protection (AMP). The main reason is cost (about the same cost as Cb Protect, but with (most of) the featureset of all 3 Carbon Black products for less than 1/3 of the total spend. AMP works differently, looking at a reputation service powered by Cisco's Talos cloud. You don't really have application whitelisting, but that also reduces how many "requests" you get for applications. So I'll have to find a different way to do whitelisting and USB blocking and the like, but I'm getting more visibility across my network and also built in antivirus (TETRA engine - ClamAV with some work). Barkly is an add that we are looking to put in as it looks at behavior of programs. So specifically it watches for privilege elevation and the like. Thus far all the big name problem children (WannaCry, other ransomware problems) have been caught natively in Barkly day 0.

Incentivized

Symantec Endpoint Security seems to be a more mature solution compared with CrowdStrike, particularly when CS was just recently getting their USB blocking functionality rolled out for macOS endpoints this year. Another differentiator with CrowdStrike is that Symantec ES still provides both on-demand scanning & real-time signature-based detection in addition to solely real-time machine learning detection whereas on-demand scanning and signatures are not available on CrowdStrike. This means there is a doubt as to whether we can use CS to comply with some of our PCI DSS obligations which specifically require the use of signature-based antivirus solutions.

Incentivized

• Dashboards are easy to understand for management
• We feel more secure than we were on our previous platform

Incentivized

• Symantec [Endpoint Security] cost 50k less than other options while providing similar benefits over the last year
• Cylance conflicted with Symantec [Endpoint Security] and Cisco Umbrella Client (All 3 at the same time) causing us to rebuild many desktops
• Symantec [Endpoint Security] made it easy to detect where issues were and repair them

Incentivized