BlackBerry CylancePROTECT

Easy to deploy and manage policies across 1000s of assets in the corporate network. Has coverage for various OS platforms, including Windows, Linux, and macOS. Can perform bulk quarantine across all hosts for a known threat. Whitelist or exclusion is easy to setup.

A user friendly console for reporting and oversight dashboard for threat trends and malware families.

Some times results in false positive for the script module and could get tricky to manage exceptions if one is not fully aware of the gaps they can introduce by simply whitelisting system paths where most malware run.

Could include real-time sandbox capabilities like other competing products in the market

Very easy to deploy the application to endpoints, cloud management is easy to use and mange deployment. The product is very configurable to customize to your needs. Malware detection and removal is outstanding.

Trying to configure the policies on your own can be a challenge, be sure to acquire the product from a MSSP to ensure you set it up right and have ongoing support.

With Cylance I feel that my organization is safely protected against all threats and we have never had an issue in three plus years using this. It is very easy to install and has a very small footprint which makes it nice for our PCs.

Creating policies and exclusions is a bit clunky but once you figure it out it's okay. It can also have many false positives which are easily maintained through the portal.

In the three years we've been protecting our endpoints with CylancePROTECT, we have had ZERO incidents across ~250 endpoints. I have tested the Cylance client against true zero day attacks, not recognized on VirusTotal, shared with me by an MSP friend. He has had many clients compromised by ransomware, several more than once, with nuke/pave/restore for the entire organization being the typical response. When I throw attacks against old-build agents, and those attacks are obliterated, it helps me sleep better at night. I don't see these attacks in my environment, hence the testing. The endpoint is the focus of the last line of defense, so PROTECT is critical in my security posture.

In comparison to traditional signature-based (useless) AV, CylancePROTECT and CylanceOPTICS seems expensive. That's why my MSP pal doesn't have his SMB clients on this product, they can't comprehend the value proposition of something so different to what they're familiar with. I guess that's why the marketing initiatives can seem a little over the top, it's hard to get the idea across when some hater says "doesn't detect EICAR!"