Cisco Web Security Appliance (WSA) or IronPort, your one-stop email solution
February 25, 2020

Cisco Web Security Appliance (WSA) or IronPort, your one-stop email solution

Kuntal Das | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Review Source

Overall Satisfaction with Cisco Web Security Appliance (WSA)

Cisco Web Security Appliance (WSA) or Ironport is our primary email security tool. All emails that are sent to our users pass through a server running Cisco Web Security Appliance (WSA) or Ironport. The security team uses this tool in accordance with the email management team. However, we serve all the departments of our organization. The main objective of this software is to drop emails with malicious attachments, low reputation IP, banned senders, globally blacklisted emails based on their signatures, etc. Although it doesn't ensure flawless detection, it does a great job at the initial phase of narrowing down our hunt for malicious emails. It led to almost a 60% reduction of attachments containing malware, thereby helping us in securing our assets.
  • It does a great job of filtering emails based on IP reputation. This feature works particularly very well. Cisco has a vast database of IP reputation scores and therefore offers very few false positives and negatives.
  • It checks each email thoroughly without any compromise of privacy. Any malicious link present in the body of the email makes its way to the quarantine. The IP reputation scores also help in this case.
  • The default metrics on the dashboard visualization are not that useful. It is not much customizable too. Some of the dashboard features like load, volume, etc. can have a hide option.
  • The false negatives are more than false positives. A lot of the times, it verdicts the same email as malicious and non-malicious. This can be reduced.
  • The machine infection rate by downloading malicious attachments went down by 60%.
  • Phishing went down by 25%. This directly reduced user account compromise by 30%.
Cisco Web Security Appliance (WSA) is a potent tool. When it comes to handling emails and links from blacklisted IP, Cisco Web Security Appliance (WSA) does a better job. However, considering the price to performance ratio, Mimecast is way ahead of Cisco Web Security Appliance (WSA). Mimecast has an excellent spam filter, unlike the Cisco Web Security Appliance (WSA). However, as said, Cisco Web Security Appliance (WSA) or Ironport has been chosen for our organization due to its tenacity and the power to handle a very high volume of email.
Our experience with Cisco's support was terrible. Other than the fact that they don't respond to service-related emails with urgency, they also keep on changing the policies that affected us. Recently, they came up with a new look for the same software, which was insanely slow. Renewal of keys for the old interface took months. Overall, the support was not very friendly from the users' point of view.

Do you think Cisco Secure Web Appliance (formerly Cisco WSA) delivers good value for the price?

No

Are you happy with Cisco Secure Web Appliance (formerly Cisco WSA)'s feature set?

Yes

Did Cisco Secure Web Appliance (formerly Cisco WSA) live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Cisco Secure Web Appliance (formerly Cisco WSA) go as expected?

I wasn't involved with the implementation phase

Would you buy Cisco Secure Web Appliance (formerly Cisco WSA) again?

No

Cisco Web Security Appliance (WSA) or Ironport is well suited for large organizations with a high volume of email flow and a high budget. For low or mid-scale industries, it is not that useful as the email client's own security solution like Office 365 or Gmail can do the job. Although quite accurate, email security needs to be flawless as it marks the beginning of every cyber attack. Cisco Web Security Appliance (WSA) or Ironport does narrow down the search space by dropping emails. But, skillful workers are still needed to ensure the verdict. In the case of spam, it is often not detected. An organization with a high budget, that can afford several employees too along with the tool is a good fit for it