"The visibility and insight this solution gives you into threats is pretty granular. It has constant monitoring. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. You can see what happened after the threat. You can see what other applications were incorporated into the execution of the threat. For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. Then, after the event, something else was launched by whatever the threat was. Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. This helps you understand and nail down what the threat is and how to fix it."
"Integration is a key selling factor for Cisco security products. We have a Cisco Enterprise Agreement with access to Cisco Email Security, Cisco Firepower, Cisco Stealthwatch, Cisco Talos, Cisco Threat Grid, Cisco Umbrella, and also third-party solutions. This is key to our security and maximizing operations. Because we do have the Email Security appliance and it is integrated with Threat Response, we have everything tied together. Additionally, we are using the Cisco SecureX platform, as we were a beta test for that new solution. With SecureX, we are able to pull all those applications into one pane for visibility and maintenance. This greatly maximizes our security operations."
"Among the most valuable features are the exclusions. And on the scalability side, we can integrate well with the SIEM orchestration engine and a number of applications that are proprietary or open source."
"One of the best features of AMP is its cloud feature. It doesn't matter where the device is in regards to whether it's inside or outside of your network environment, especially right now when everybody's remote and taken their laptops home. You don't have to be VPNed into the environment for AMP to work. AMP will work anywhere in the world, as long as it has an Internet connection. You get protection and reporting with it. No matter where the device is, AMP has still got coverage on it and is protecting it. You still have the ability to manage and remediate things. The cloud feature is the magic bullet. This is what makes the solution a valuable tool as far as I'm concerned."
"The ability to detonate a particular problem in a sandbox environment and understand what the effects are, is helpful. We're trying, for example, to determine, when people send information in, if an attachment is legitimate or not. You just have to open it. If you can do that in a secure sandbox environment, that's an invaluable feature. What you would do otherwise would be very risky and tedious."
"The threat Grid with the ability to observe the sandboxing, analyze, and perform investigations of different malicious files has been great."
"The most valuable feature is signature-based malware detection."
"If somebody has been compromised, the question always is: How has it affected other devices in the network? Cisco AMP gives you a very neat view of that."
"Offers network security protection. Management and maintenance of this solution is easy."
"It really protects and does its job. It totally blocked every attack attempt, and no attack attempt was successful."
"They offer the whole package. Remote monitoring and management (RMM) is included with it, which is pretty nice. They also have Windows patching and third-party patching. It was easy to use for protection. The containment engine was pretty nice for securing our environment."
"The most valuable feature is the management of end-user machines."
"It's a very easy-to-use product."
"In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through."
"I would like to see integration with Cisco Analytics."
"We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment."
"The connector updates are very easily done now, and that's improving. Previously, the connector had an issue, where almost every time it needed to be updated, it required a machine reboot. This was always a bit of an inconvenience and a bug. Because with a lot of software now, you don't need to do that and shouldn't need to be rebooting all the time."
"The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications."
"The one challenge that I see is the use of multiple endpoint protection platforms. For instance, we have AMP, but we also have Microsoft Windows Defender, System Center Endpoint Protection, and Microsoft Malware Protection Engine deployed. So, we have a bunch of different things that do the same thing. What winds up happening is, e.g., if I get an alert for a potential incident or malware and want to pull the file, I'll go to fetch the file to analyze it. But, one of these other programs has already gotten it, so the file has already been quarantined by another endpoint protection system. AMP doesn't realize that and the file fetch fails, then you're left wondering what's going on."
"The GUI needs improvement, it's not good."
"Maybe there is room for improvement in some of the automated remediation. We have other tools in place that AMP feeds into that allow for that to happen, so I look at it as one seamless solution. But if you're buying AMP all by itself, I don't know if it can remove malicious software after the fact or if it requires the other tools that we use to do some of that."
"Upgrades are heavy and require back up, making you feel like you're doing a fresh installation of this solution. Configuration can also be quite tedious if you want it to be configured based on your needs."
"They need to enhance the performance of the agents. Currently, the performance is going low when the agent starts a full scan. The agent is consuming a lot of resources while scanning. When there are a lot of documents to check, it slows down the endpoint. This is the only thing that worries me about Comodo, but this issue is also there in other products. It is missing DLP, and I know that they are working on adding some data loss prevention capabilities. They have added some capabilities, but these capabilities are not yet mature. I hope they will enhance these capabilities because it is important to prevent the data from going out from inside. We are protected from the outside, but we also have to be protected from the inside out."
"The licensing fees are high. The company should work to try to lower them for the customer."
"Their support is not very good because they are very late to reply."
"They need to just modernize the infrastructure with something that is next-generation. We have recently moved to SentinelOne. It had been doing good for us for a while, but we needed something modern with new technology."
Earn 20 points
Advanced Malware Protection (AMP) is subscription-based, managed through a web-based management console, and deployed on a variety of platforms that protects endpoints, network, email and web Traffic. AMP key features include the following: Global threat intelligence to proactively defend against known and emerging threats, Advanced sandboxing that performs automated static and dynamic analysis of files against more than 700 behavioral indicators, Point-in-time malware detection and blocking in real time and Continuous analysis and retrospective security regardless of the file's disposition and Continuous analysis and retrospective security.
GravityZone Elite safeguards your organization from a full spectrum of sophisticated cyber threats. With more than 30 machine learning-driven security technologies, GravityZone provides multiple layers of defense that consistently outperforms conventional endpoint security, as proven in independent tests.
Comodo Advanced Endpoint Protection (AEP) delivers patent-pending auto-containment, where unknown executables and other files that request runtime privileges are automatically run in a virtual contain that does not have access to the host system's resources or user data.
Bitdefender GravityZone Elite is ranked 44th in Endpoint Protection for Business (EPP) with 1 review while Comodo Advanced Endpoint Protection is ranked 35th in Endpoint Protection for Business (EPP) with 4 reviews. Bitdefender GravityZone Elite is rated 9.0, while Comodo Advanced Endpoint Protection is rated 7.2. The top reviewer of Bitdefender GravityZone Elite writes "Has easy management and maintenance and offers network security protection". On the other hand, the top reviewer of Comodo Advanced Endpoint Protection writes "Flexible, easy-to-use, and scales well". Bitdefender GravityZone Elite is most compared with Bitdefender GravityZone Enterprise Security, Trend Micro Apex One, Webroot Business Endpoint Protection and SentinelOne, whereas Comodo Advanced Endpoint Protection is most compared with Symantec End-User Endpoint Security, Sophos Intercept X, CrowdStrike Falcon, SentinelOne and Cortex XDR by Palo Alto Networks.
See our list of best Endpoint Protection for Business (EPP) vendors.
We monitor all Endpoint Protection for Business (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.