Cisco Secure Endpoint (formerly Cisco Advanced Malware Protection [AMP] for Endpoints) offers cloud-delivered next-generation antivirus, endpoint protection platform (EPP), and advanced endpoint detection and response (EDR).
N/A
Mimecast Advanced Email Security
Score 8.6 out of 10
N/A
The Mimecast Secure Email Gateway is a messaging security option with anti-spam / anti-malware, data loss prevention, large file send, and other features, from UK company Mimecast.
Cisco Secure Endpoint is well suited for keeping track of the many different and points that we have in our organization. All of these devices can easily be monitored with Cisco Secure Endpoint. It can monitor our servers and our desktops and laptops in our environment. It isn’t as appropriate for our student devices. However, those aren’t as critical since they are just Chromebooks.
Mimecast Advanced Email Security is good in the case when an email is coming from outside and it directly contain the malicious code, malicious URL or risky files. Then their process works well and they block the email or hold the email for review. Mimecast Advanced Email Security is good in the case of any mail bomb attack type scenarios where you can create content examination policies to protect the user from getting bulk spam email. Mimecast Advanced Email Security lack when email do not contain any malicious files or URLs, if you are receiving a phishing email with no URL/Files then Mimecast do not detect it but this email might have some normal conversation like CEO fraud where the malicious actor might be asking for some money transfer. So, in this case, Mimecast fails.
Once we, I guess one turned out that path because we have a small IT team, one of the big factors that came into play is how easy it was to deploy and the kind of security it provides for your endpoint devices. For us, it's got all those AI capabilities that really help. So traditionally when there was an incident on Alert on an antivirus program, you'd have a couple of guys run across the office to try to pull a plug. One of the awesome features with Secure Endpoint is its isolation mode that clamps down endpoint devices and then just isolate it. It's connected to, I think Cisco's tell us the threat intel environment. So they've got up-to-date metrics and fixes on threats out in the wild. And once they detect that, they apply it across your whole brand. So yeah, really effective for us.
One of the things that really stands out is the retrospective detections. So say something's detected two weeks later of a product that you had on your system. Initially it scanned it past, but then they discover vulnerability. The product has the ability to come back and retrospectively apply restrictions on specific applications you have on your environment. So I think that's one key winner.
The interface has many views that all look the same, except that functionalities are different. This makes it incredibly difficult to find the action you want to take.
Built-in exclusion sets are missing a number of notable Anti-Malware products and must be manually implemented.
High learning curve due to complexity of the solution and the range of features it contains. Provided documentation is hidden in a small icon at the top of the page which is often off-screen when needed.
Color choices lead to panic situations during deployment. 1 questionable file could lead to the main display showing a large, bright red alert which makes customers think their whole environment is compromised.
The Admin Management console is absurdly complicated. For every first time we wanted to setup we've had to call their support for assistance. Support is quick and fantastic but it's so difficult to do anything yourself. They seem to have gone out of their way to call features unique things instead of using standard language from other providers so you as an IT professional know what you're looking for to setup.
They have lots of KB articles, which their support will point you to. They are written on the most basic level and don't actually provide the help you need. For example, the KB page will tell you the list of options on the page... but not actually tell you what you do, why you might use them, or define their terminology.
Their email threat management system has several nice features. One of the features available is that it will rewrite links in emails so that users click the link and it sandboxes the link, testing it on their server space and the user sees it there. This means the actual link in the email gets changed to the address of one of their servers. As a law firm, the EXACT LINKS are important to maintain in our communications and editing actual data from our clients to point to a Mimecast server is an unacceptable practice. I wish they had an alternative that did not edit the link itself on the page.
AMP is very difficult to use compared to other products we've seen. It's hard to understand why there are so many different logins for the various products that supposedly integrate with AMP. We had weekly phone calls for months to implement the product yet none of the IT department really enjoys using this product or feels comfortable with the accuracy of detections. The number of false positives is high.
The UI went through an update in 2023, but it is still a pain to navigate. It is slow, sluggish, and sometimes kicks us out while performing tasks. Even with everything being in one dashboard, it felt like traversing numerous sites to get to certain settings. The ability to favorite certain admin menu items was extremely beneficial, however. It did allow navigating a little faster.
In terms of technical support for Cisco Secure Endpoint, the support has been pretty good. All the cases I submitted were solved in a reasonable time frame, and it was a good experience. However, I find that not as many vendors have the expertise I would expect.
When calling them you get best in the world customer services but as previously mentioned their online community and capabilities are a bit lacking. They want you to log into their portal to see updates on issues (vs. using a public facing service) and I rarely find the answers to my issues in electronic format. Their online presence is only helpful with the simplest of issues.
Cisco Secure Endpoint is an advanced EDR solution that is highly effective and scalable. Our experience previously with MalwareBytes and Microsoft Defender was not horrible, but these products were not as effective and did not integrate well with our other security products to allow us to monitor and react quickly to address threats that were within our network. Key to any security effort is mitigation and the ability to quickly identify and respond so any damage can be avoided or limited.
Previously we have only used the default on-premise exchange that comes with SBS. This was very simple and only provided basic filtering of spam and junk mail. We weren't able to filter impersonation mail or emails with malicious code
AMP has been able to catch some serious infections and stop them from doing huge damage in our environment.
The overall cost of AMP vs the cost of not having this protection and getting hit with malware, or other nefarious damage to your environment is well worth the money.
Reasonably priced solution, even for a small business like ours.
It's hard to put a figure on our ROI - I would just say we feel like we've gotten our money's worth with the advanced email protection we receive. We have definitely avoided many potentially dangerous emails since we've implemented this solution.
