BlackBerry CylancePROTECT

Ignore the marketing hype, for endpoint protection this is the real deal

Opmerkingen: I have a significant number of users out in the field with limited or no edge protection, so a cloud based endpoint solution is an obvious first step. With a traditional AV client that includes web filtering, which we also have, I would consider those endpoints EXTREMELY vulnerable. Even with excellent email filtering, which we also have, there are just too many things that can go horribly wrong. With three years experience and NO compromised endpoints, I can focus on other security layers instead of faffing around fixing endpoints.

Pluspunten:

In the three years we've been protecting our endpoints with CylancePROTECT, we have had ZERO incidents across ~250 endpoints. I have tested the Cylance client against true zero day attacks, not recognized on VirusTotal, shared with me by an MSP friend. He has had many clients compromised by ransomware, several more than once, with nuke/pave/restore for the entire organization being the typical response. When I throw attacks against old-build agents, and those attacks are obliterated, it helps me sleep better at night. I don't see these attacks in my environment, hence the testing. The endpoint is the focus of the last line of defense, so PROTECT is critical in my security posture.

Minpunten:

In comparison to traditional signature-based (useless) AV, CylancePROTECT and CylanceOPTICS seems expensive. That's why my MSP pal doesn't have his SMB clients on this product, they can't comprehend the value proposition of something so different to what they're familiar with. I guess that's why the marketing initiatives can seem a little over the top, it's hard to get the idea across when some hater says "doesn't detect EICAR!"

Script Blocking and Machine Learning is CylancePROTECT's Strength

Opmerkingen: Very pleased.

Pluspunten:

Easy to deploy and manage policies across 1000s of assets in the corporate network. Has coverage for various OS platforms, including Windows, Linux, and macOS. Can perform bulk quarantine across all hosts for a known threat. Whitelist or exclusion is easy to setup. A user friendly console for reporting and oversight dashboard for threat trends and malware families.

Minpunten:

Some times results in false positive for the script module and could get tricky to manage exceptions if one is not fully aware of the gaps they can introduce by simply whitelisting system paths where most malware run. Could include real-time sandbox capabilities like other competing products in the market

CylanceProtect was great. Blackberry Protect? Not so much.

Pluspunten:

CylanceProtect was by all accounts, the best endpoint protection on the market. It provided outstanding protection for all our Windows and Mac endpoints.

Minpunten:

Since Blackberry bought them in 2019, the "merging" of the two companies has been clumsy. The Cylance website dashboard was clean and somewhat easy to use. The Blackberry website looks like it was designed by someone who still uses a Blackberry mobile phone. Mac OS Big Sur is being released this week, and the endpoint client for it (that really should have been released with Catalina) is still not available. False positives for Adobe CS updates seem endless. I'll be looking at alternative options when our licensing expires next summer.

Cylance Review

Opmerkingen: Blackberry Cylance Protect is very light weight and does not impact the PC's performance. It uses AI and seems to do a great job. It would be nice if they also had a feature for the Firewall settings.

Pluspunten:

Blackberry Cylance Protect is very light weight and very powerful.

Minpunten:

does not offer any enhanced firewall settings

This product will save your backside!

Opmerkingen: Extremely positive. We recommend using a MSSP to help manage the product (EDR service) for best protection.

Pluspunten:

Very easy to deploy the application to endpoints, cloud management is easy to use and mange deployment. The product is very configurable to customize to your needs. Malware detection and removal is outstanding.

Minpunten:

Trying to configure the policies on your own can be a challenge, be sure to acquire the product from a MSSP to ensure you set it up right and have ongoing support.