Cisco Secure Endpoint (formerly Cisco AMP) vs VMware Carbon Black EDR

• Identifies malware, malicious processes/services and other events well
• Great automated actions features such as host isolation
• Detailed threat visibility such as file trajectory
• Integration with other Cisco suite of security products
• Great value
• Low false positive rate
• Lightweight agent
• Variety of reporting
• Stable agent

Read full review

• Process tree view of endpoint activity
• Ability to pull files from host
• Threat Intelligence integration
• Isolate a host

Read full review

• Event search function. The searching is very limited and allows for poor filtering choices.
• Slowness. The web GUI is far slower than most Cisco products.
• Sync issues. When attempting to move a device from one group to another or start isolation on a device, there is a sizable delay in communication with the device that can cause operations to fail.

Read full review

• Number of false positive which are triggered due to threat feeds are sometimes more needs to be fine tuned by the client.
• In very rare scenarios processes are not captured properly.

Read full review

• AMP has been able to catch some serious infections and stop them from doing huge damage in our environment.
• The overall cost of AMP vs the cost of not having this protection and getting hit with malware, or other nefarious damage to your environment is well worth the money.

Read full review

• It is helping to protect us from potential loss of revenue that would be caused by malware or a compromised account.
• It took some time in deploying in the environment , but that time is much worth it because of the results we are getting now.
• It helps in hunting, which help us check and protect our environment from any cyber attacks.

Read full review