We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
"One of the best features of AMP is its cloud feature. It doesn't matter where the device is in regards to whether it's inside or outside of your network environment, especially right now when everybody's remote and taken their laptops home. You don't have to be VPNed into the environment for AMP to work. AMP will work anywhere in the world, as long as it has an Internet connection. You get protection and reporting with it. No matter where the device is, AMP has still got coverage on it and is protecting it. You still have the ability to manage and remediate things. The cloud feature is the magic bullet. This is what makes the solution a valuable tool as far as I'm concerned."
"It is extensive in terms of providing visibility and insights into threats. It allows for research into a threat, and you can chart your progress on how you're resolving it."
"Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."
"The most valuable feature is signature-based malware detection."
"It is a very stable program."
"The solution's integration capabilities are excellent. It's one of the best features."
"It doesn't impact the devices. It is an agent-based solution, and we see no performance knock on cell phones. That was a big thing for us, especially in the mobile world. We don't see battery degradation like you do with other solutions which really drain the battery, as they're constantly doing things. That can shorten the useful life of a device."
"The ability to detonate a particular problem in a sandbox environment and understand what the effects are, is helpful. We're trying, for example, to determine, when people send information in, if an attachment is legitimate or not. You just have to open it. If you can do that in a secure sandbox environment, that's an invaluable feature. What you would do otherwise would be very risky and tedious."
"It is easy to use."
"The dashboard is customizable."
"Threat identification and detection are the most valuable features of this solution."
"It collects and caches and the knowledge of machine learning from different customers to take to the cloud. It makes it better to use for everybody. It allows for quick learning and updates and can, therefore, offer zero-day malware security. This sharing of metadata helps make the solution very safe."
"The management capabilities, allow an IT organization to get quite a good picture of attempted cyber attacks."
"Stability is a primary factor, and then there's the ease of distribution and policy management."
"Its interface and pricing are most valuable. It is better than other vendors in terms of security."
"They did what they said. This solution could apply to any scenario."
"It's good at detecting signature-based stuff and stopping that."
"The single-pane management is the solution's most valuable feature. It makes administrative control very easy."
"It seems to be user-friendly. Our users seem to like it for the most part."
"It is very easy to managing everything in relation to the implementation and processing. The initial setup is very easy."
"The solution can scale."
"The solution is easy to use"
"The installation was very easy."
"It's a robust product."
"...the greatest value of all, would be to make the security into a single pane of glass. Whilst these products are largely integrated from a Talos perspective, they're not integrated from a portal perspective. For example, we have to look at an Umbrella portal and a separate AMP portal. We also have to look at a separate portal for the firewalls. If I could wave a magic wand and have one thing, I would put all the Cisco products into one, simple management portal."
"We had a lot of noise at the beginning, and we had to turn it down based on exclusions, application whitelisting, and excluding unknown benign applications. Cisco should understand the need for continuous updates on the custom Cisco exclusions and the custom applications that come out-of-the-box with the AMP for Endpoints."
"We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment."
"I would recommend that the solution offer more availability in terms of the product portfolio and integration with third-party products."
"The technical support is very slow."
"The thing I hate the most, which they have not fixed, is when it creates duplicate entries within a console. If you have a computer and you upgrade from Windows 7 to Windows 10, or you upgrade your agent from version 6 to 7, it creates a new instance in there instead of updating the information. Instead of paying a license for one computer, I have to license two computers until I manually go in, search for all the duplicate entries, and clean them out myself."
"Maybe there is room for improvement in some of the automated remediation. We have other tools in place that AMP feeds into that allow for that to happen, so I look at it as one seamless solution. But if you're buying AMP all by itself, I don't know if it can remove malicious software after the fact or if it requires the other tools that we use to do some of that."
"In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through."
"The dashboard could use some significant improvement, just making it more useful with more information. It has a limited amount of information right now. It is customizable, but I'd love to see a better out-of-box dashboard."
"The solution can never really be an on-premises solution based simply on the way it is set up. It needs metadata to run and improve. Having an on-premises solution would cut it off from making improvements."
"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."
"Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"There's an overall lack of features."
"I would like to see them include NDR (Network Detection Response)."
"The connection to the internet has not performed as expected."
"If the agent can be minimized so that it can work with in-memory concepts, that would be ideal. As of now, it is file-based, signature-based."
"Symantec End-point production doesn't support the EDR function."
"I know they were just bought out by Broadcom and there have been some difficulties with Broadcom as far as getting license renewals, etc. Mostly, due to the fact that it's confusing, even for the vendor, people are turned off by it. The vendors are telling us that it can take weeks for them to get a renewal quote, nevermind the actual renewal."
"Is not a full anti-ransomware solution."
"Technical support could be more responsive."
"The monitoring capabilities could be further developed."
"It would be perfect if it is capable of detecting or checking ransomware."
"The whitelisting feature does not work as expected."
"There are a couple of different consumption models: Pay up front, or if you have an enterprise agreement, you can do a monthly thing. Check your licensing possibilities and see what's best for your organization."
"The Enterprise Agreement is like an all-you-can-eat buffet of Cisco products. In that vein, it was very affordable."
"In our case, it is a straightforward annual payment through our Enterprise Agreement."
"Licensing fees are on a yearly basis and I am happy with the pricing."
"There is also the Cisco annual subscription plus my management time in terms of what I do with the Cisco product. I spend a minimal amount of time on it though, just rolling out updates as they need them and monitoring the console a couple of times a day to ensure nothing is out of control. Cost-wise, we are quite happy with it."
"The visibility that we have into the endpoint and the forensics that we're able to collect give us value for the price. This is not an overly expensive solution, considering all the things that are provided. You get great performance and value for the cost."
"The pricing and licensing are reasonable. The cost of AMP for Endpoints is inline with all the other software that has a monthly endpoint cost. It might be a little bit higher than other antivirus type products, but we're only talking about a dollar a month per user. I don't see that cost as being an issue if it's going to give us the confidence and security that we're looking for. We have had a lot of success and happiness with what we're using, so there's no point in changing."
"Whenever you are doing the licensing process, I would highly advise to look at what other Cisco solutions you have in your organization, then evaluate if an Enterprise Agreement is the best way to go. In our case, it was the best way to go. Since we had so many other Cisco products, we were able to tie those in. We were actually able to get several Cisco security solutions for less than if we had bought three or four Cisco security solutions independently or ad hoc."
"This is an expensive solution."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."
"Its pricing is kind of in line with its competitors and everybody else out there."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"Our customers have expressed that the price is high."
"It has a yearly renewal."
"The pricing is okay, although direct support can be expensive."
"Licensing is based on a yearly subscription."
"We pay our licensing fees on a yearly basis, and everything is included in that price."
"Its price should be reasonable."
"When it comes to pricing, Sophos is preferrable to Symantec."
"When comparing this solution to others in the current market it is expensive."
"It is cheap. It is especially cheaper than Malwarebytes, which is three times higher than this. It is also cheaper than Cisco. Its price is almost similar to Bitdefender, Gravity, and CloudZone."
"The prices fluctuate, but this year I think it was maybe around $12,000."
"The licensing costs are huge compared to what is normally included in the licensing with other products such as the Microsoft products that we're using. We're paying between $300 and $400 per seat."
Advanced Malware Protection (AMP) is subscription-based, managed through a web-based management console, and deployed on a variety of platforms that protects endpoints, network, email and web Traffic. AMP key features include the following: Global threat intelligence to proactively defend against known and emerging threats, Advanced sandboxing that performs automated static and dynamic analysis of files against more than 700 behavioral indicators, Point-in-time malware detection and blocking in real time and Continuous analysis and retrospective security regardless of the file's disposition and Continuous analysis and retrospective security.
Cortex XDR by Palo Alto Networks is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks. Cortex XDR by Palo Alto Networks accurately detects threats with behavioral analytics and reveals the root cause to speed up investigations.
Unmatched Endpoint Safety for Your OrganizationAs an on-premises, hybrid, or cloud-based solution, the single-agent Symantec platform protects all your traditional and mobile endpoint devices, and uses artificial intelligence (AI) to optimize security decisions.
Cortex XDR by Palo Alto Networks is ranked 6th in Endpoint Protection for Business (EPP) with 28 reviews while Symantec End-User Endpoint Security is ranked 5th in Endpoint Protection for Business (EPP) with 51 reviews. Cortex XDR by Palo Alto Networks is rated 8.2, while Symantec End-User Endpoint Security is rated 7.2. The top reviewer of Cortex XDR by Palo Alto Networks writes "Has a centralized console and does predictive analysis of malware". On the other hand, the top reviewer of Symantec End-User Endpoint Security writes "Lacks next-generation behaviour-based detection, offers terrible technical support, and not as robust as competitors". Cortex XDR by Palo Alto Networks is most compared with CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Trend Micro Apex One and Check Point Harmony Endpoint, whereas Symantec End-User Endpoint Security is most compared with Microsoft Defender for Endpoint, Trend Micro Deep Security, CrowdStrike Falcon, McAfee Endpoint Security and Bitdefender GravityZone Ultra. See our Cortex XDR by Palo Alto Networks vs. Symantec End-User Endpoint Security report.
See our list of best Endpoint Protection for Business (EPP) vendors.
We monitor all Endpoint Protection for Business (EPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.