Endpoint Protector by CoSoSys vs. OpenText EnCase Endpoint Security

Endpoint Protector [by CoSoSys] is well suited for an environment where a data loss prevention solution is required and many different operating system types are used. It is also well suited for an organization that has a need to deploy a solution quickly. Endpoint Protector is not well suited for companies that need to have an API or other integrations with other IT tools.

Incentivized

It is more suited to environments that have a large internal user base since there will be more incidents that require forensic analysis. It will be less suited for environments that have a small internal user base due to the fact that there would be fewer incidents that require forensic analysis, but it really depends on the industry that a small internal user base is a part of.

Incentivized

• Can be used remotely via public IP or VPN
• Integrates well with Active Directory
• Easy to deploy

Incentivized

• Functionality meets minimal requirements, since it performs forensic investigations as advertised.

Incentivized

• App integration - CoSoSys supports a lot of industry standard apps but fails to provide protection on 3rd party applications.
• Complete disk encryption.
• Web filtering features.

Incentivized

• Their UI definitely needs to be more user-friendly, right now it is very cumbersome to run and view investigations.
• Authentication mechanism should be a simple username/password, not certificate-based which is difficult to manage.
• Needs better support documentation for the product, it is difficult to find solutions to issues that we run into.

Incentivized

Because support is non-existent whenever you have a functionality issue using the product. Also since the UI is so cumbersome to use we could use as much support as possible. Whenever we ask for support we are told to take the training which costs us more money. I believe that support should be easily accessible and affordable for the client

Incentivized

Endpoint Protector [by CoSoSys] was able to be installed on all major operating systems. Endpoint Protector was also able to perform block actions and do it at a granular level among the endpoints. Business needs required a traditional data loss prevention and Endpoint Protector met those needs. We had a need to block some USB storage events and Endpoint Protector met those needs.

Incentivized

The other forensic tool that is a direct competitor to EnCase and wasn't listed above is the Forensic Toolkit or FTK. I believe that FTK is a better tool overall simply because it is easier to manage and use when it comes to investigations. Unfortunately, I wasn't part of the decision process and EnCase was the tool selected, otherwise, I would have recommended FTK.

Incentivized

• Didn’t work as expected
• Not sure yet if we are going to renew it, thankfully we didn’t make a 3 year contract required by them.
• The are not many options in the market for source code detection, so we may have to stick with it

Incentivized

• One negative impact would be that since the UI is cumbersome to use we would need to spend more money on training which is not always feasible.
• Another negative impact would be that since there is not much support available this slows down investigations due to finding out how to troubleshoot and fix functionality issues.
• One positive impact would be that since it meets minimal requirements when it comes to forensic analysis it gives us visibility on any malicious activity occurring on a user's endpoint.

Incentivized