Cisco IPS Sensor (Discontinued) vs. Microsoft Defender for Identity

IPS sensors are more suited for companies that do not have visibility into their network with third-party analyzing tools. Scenarios would be to place IPS sensors at the perimeter firewalls mainly. IPS sensors are less appropriate for companies that have third-party analyzing tools that will mitigate vulnerabilities and malicious traffic and activities already.

Incentivized

Microsoft Defender for Identity is a great solution for each company that has an Active Directory. It fills in the blanks for Identity related incidents that are being missed in the XDR platform. To get a full view on identity risks it is an essential component

• Identifies and blocks malicious traffic.
• Detects unwanted traffic and allows your company to be proactive, let alone reactive.
• Comprehensive Threat protection allows companies to adjust thresholds and policies at will.

Incentivized

• detect threats and suspicious activities
• pro-active measurements on possible breaches
• identity security posture

• The web GUI is somewhat slow.
• Sometimes difficult to adjust policies.
• Fail open feature may not work properly all the time.

Incentivized

• setup can be complicated, with AD complexity
• Sometimes the load on DCs is pretty high, leading to performance issues
• Better tuning options for preventing false-positive/bening alerts

Cisco TAC has been great at helping with configurations and issues that may arise

Incentivized

IPS sensors provides the necessary network visibility my company needs to satisfy its security appetite. By doing so, we have been able to stay compliant and up to date with today's network security requirements and procedures. We are able to be proactive with vulnerabilities and reactive to malicious traffic and intrusions in our day to day operations.

Incentivized

Microsoft Defender for Identity is more specialized on the Identity platform, it is a single solution compared to a multi-solution. The integration is better when using the XDR suite in combination with Sentinel. Microsoft Defender for Identity gives a better overview of the security posture

• Provided less need to purchase third party analyzing tools.
• Needed more dedicated staff to build/review/and maintain policies and such.
• Answers companies need for network security.

Incentivized

• Cost impact was pretty high
• Learning curve, needed time (money) for training
• Greatly improved detections and gives more insights