Cofense Triage vs. FireMon

The tool is very helpful in improving Phishing detection capabilities as it streamlines the process of analyzing user reports a lot. Besides it has a built-in mechanism of rating reporters(end-users) based on their historical performance. Downside - tool requires continuous resource investment to deliver best result. Tool is not helping too much in improving user-education, because automated response process is not immediate and is prone to errors

Incentivized

FireMon is best used in a large environment (for example, I have >100
firewalls in my environment). It's best used when trying to improve
security posture and showing changes in firewall security over time. It
might not be the best choice for smaller environments or those that aren't concerned about security management.

Incentivized

• Separating links and attachments contained in the email, and checking to see if they are known malicious.
• Clustering like emails to save time when responding.
• Providing risks scores with each cluster to give an estimate on which clusters should be addressed first.

Incentivized

• Give good real time reporting for anyone making a change to any of our firewalls
• Provides good reporting tools that are out of box
• Provide good customization tools that is specific to our needs
• Upgrades are a simple process and support does relatively well with assisting us.

Incentivized

• There are too many interdependent pieces which you have to acquire separately.
• I think Cofense has a lot of capabilities and usefulness, but I think it's too a la carte.
• We own Cofense and PhishMe currently and there are some gaping holes that require additional licensing to close.

Incentivized

• Some features could be added to the existing functionality which include NAT rules usage
• Rule expiration normalization from firewalls rather than entering them in rule documentation
• .csv exports of the files from the firewall pane only gives usage for 30 days by default and that should be increased

Incentivized

Cofense is stable and provides easy to use solution to aid the investigation of emails as well as managing simulated phishing campaigns.

Incentivized

The shell is locked out and we can't run any general centos commands. The implementation and maintainence of the arch is very complex. Even with the right identifiers on log messages the log collection keeps failing. The warning messages on the device are ambiguous. The log messages on firemon are a bit confusing and don't show the exact issue.

Incentivized

The interface is easy and intuitive.

Incentivized

It save me time and I'm able to have the review - review the rule independently with using my time.

Incentivized

We've experienced zero downtime.

Incentivized

FireMon has been relatively stable overall. However, there have been a handful of times where we had issues with the console. For example, we couldn't update which devices to include in a security assessment. The initial suggestion from support was to just reboot it. It seems like there weren't many other options available such as to restart services before going to the extreme of a complete reboot.

Incentivized

No slowness seen.

Incentivized

I'm not sure we have the largest implementation of FireMon out there but we do have a few 1000 devices being probed by FireMon. Overall, the system's performance has been rock solid. The console refreshes quickly and reports are generated within an expected timeframe.

Incentivized

FireMon technical support is awesome! They respond quickly to our requests and they are well trained and very knowledgeable about the tool. Some issues have to be referred to the development team, but technical support largely provides solutions for any issues that we may have.

Incentivized

Training was through, relevant and easy to follow.

Incentivized

Implementation is fairly simple. Most issues can be resolved by referencing manuals.

Incentivized

The other product had a lot of fails on the auto-processing and did not integrate well with our current environment. One issue had to do with the way it sends the submissions to its processing engine—our email gateway configuration would have blocked this traffic. I also did not like the user interface.

Incentivized

I has worked with AlgoSec and while they are very similar product, I find the FireMon is easier to understand and get rolling with. While both require some learning, FireMon is by far the easier one. Once you have an understanding of how things are arranged and labeled you can easily import firewalls and begin to work on them to improve them

Incentivized

We've experienced zero downtime

Incentivized

Firemon Is easily scalable and maintainable with any size team. Although it requires some tech debt, it is well worth the time to invest to ensure compliance is visible and reports are accurate. Although our environment is very large we do not fully utilize the scalability of the Firemon product.

Incentivized

• Due to the integration potential, large amounts of time are saved on a daily basis.
• Incident response time has dropped due to the increased information available by having access to phishing emails directly.
• Staff are able to effectively learn how multiple tools in our environment are used by mastering Triage. This has decreased training time greatly and increased the effectiveness of each associate.

Incentivized

• FireMon's Compliance Reporting provided an immediate and tangible benefit
• FireMon helps identify egregious or erroneous rules quickly across multiple platforms
• FireMon took our audit process from an Excel spreadsheet into a far more advanced process with readily available context for reviewers

Incentivized