Jamf Protect vs. OpenText EnCase Endpoint Security

Jamf Protect will always have day 1 support for new OS updates, which is an amazing feature. The reporting could use a bit more work and the actions it captures are far beyond anything we would need, but it does that really well too. There are plenty of scenarios where I will gladly recommend this to other institutions. There are not many where I wouldn't. Maybe only if you have a hybrid environment, where licensing another endpoint protection may be beneficial to the budget.

Incentivized

It is more suited to environments that have a large internal user base since there will be more incidents that require forensic analysis. It will be less suited for environments that have a small internal user base due to the fact that there would be fewer incidents that require forensic analysis, but it really depends on the industry that a small internal user base is a part of.

Incentivized

• Security--it scans processes for 'bad stuff'
• Notifies admins of any issues or potential issues; entirely customizable and we create many custom notifications and groups.
• Integrates with Jamf Pro
• Monitor CIS benchmarks via a clean and nice looking dashboard

Incentivized

• Functionality meets minimal requirements, since it performs forensic investigations as advertised.

Incentivized

• The cloud GUI. It can be confusing at times.

Incentivized

• Their UI definitely needs to be more user-friendly, right now it is very cumbersome to run and view investigations.
• Authentication mechanism should be a simple username/password, not certificate-based which is difficult to manage.
• Needs better support documentation for the product, it is difficult to find solutions to issues that we run into.

Incentivized

Because support is non-existent whenever you have a functionality issue using the product. Also since the UI is so cumbersome to use we could use as much support as possible. Whenever we ask for support we are told to take the training which costs us more money. I believe that support should be easily accessible and affordable for the client

Incentivized

Jamf Protect is much lighter on system usage. It also has exclusive access to the threat protection baked into macOS. This lets Jamf Protect leverage the great work Apple is doing, and gives admins a way to extend that as well as view reports. Webroot was often missing things that were threats. SentinelOne was a bit more resource heavy. Solarwinds...err..."N-Able"...do I really need to say anything?

Incentivized

The other forensic tool that is a direct competitor to EnCase and wasn't listed above is the Forensic Toolkit or FTK. I believe that FTK is a better tool overall simply because it is easier to manage and use when it comes to investigations. Unfortunately, I wasn't part of the decision process and EnCase was the tool selected, otherwise, I would have recommended FTK.

Incentivized

• Positive: It allowed us to deploy machines that were not deployable before due to compliance issues.
• Positive: Easy to implement in the shortest amount of time needed.
• Negative: Could be costly if you have a big environment

Incentivized

• One negative impact would be that since the UI is cumbersome to use we would need to spend more money on training which is not always feasible.
• Another negative impact would be that since there is not much support available this slows down investigations due to finding out how to troubleshoot and fix functionality issues.
• One positive impact would be that since it meets minimal requirements when it comes to forensic analysis it gives us visibility on any malicious activity occurring on a user's endpoint.

Incentivized