Frank Titze
Works at Kreiskrankenhaus Grünstadt with 201-500 employees
USE CASE
Our primary use case is to secure our endpoints and servers via Managed Detection. We secure them using XDA and Trend Micro’s SOC. We secure it based on behavior so that we have someone to respond if there are unusual issues with PCs, even on weekends and holidays when we’re not onsite, and then they inform us. That’s why we chose Trend Vision One™.
We have it deployed on all of our PCs, both Windows and Linux laptops.
The security coverage is very important for my company's network. It is a requirement under the NIS2 directive, which is now coming into effect in the EU. The coverage is also important for us because we operate 24/7, but our IT staff is not available around the clock. To fill this gap, we opted for Trend Micro’s XDR solution. Trend Micro’s SOC team can respond even when no one from our team is available.
They also make sure we are properly notified because if an email comes in at 3 AM on a Sunday, no one will read it but if Trend Micro's SOC team calls, someone will check immediately. That’s why we chose this solution.
The security coverage is also particularly important for us because, as a hospital running 24/7, we must ensure the security of patient data and maintain the IT infrastructure's operational capability. If our systems go down, it could directly impact patient treatment. Around 10 years ago, before we had Trend Micro, we experienced an attack and our IT systems were down for an entire week. That was incredibly difficult.
With increasing digitalization and more medical processes relying on computers, doctors need easy access to X-rays, prior medical examinations, and other records. Since all of this data is stored digitally, solutions like Trend Vision One become even more essential. Availability must be guaranteed, and we cannot afford a situation where a system gets attacked and taken down. That’s why it is crucial for us to have this protection in place.
The biggest security challenges in my organization are:
- Preventing unauthorized external access.
- Reducing the risk of employees unknowingly giving attackers access to the network due to inexperience.
That’s why we use these solutions, in combination with Apex One and Deep Security, to prevent such incidents. If a user mistakenly clicks on something they shouldn’t, the system can respond immediately and prevent damage before it occurs.
Our primary use case is to secure our endpoints and servers via Managed Detection... if there are unusual issues with PCs, even on weekends and holidays when we’re not onsite, and then they inform us. That’s why we chose Trend Vision One.
HOW HAS IT HELPED MY ORGANIZATION?
With Trend Micro Vision One we now have a comprehensive overview of our entire network of all of our endpoints and Active Directory. We also have an industry comparison feature that allows us to gauge our security status.
For example, our advisor recently reviewed our security score and confirmed that we are in a good position. That gives us peace of mind.
VALUABLE FEATURES
The SOC team is the most valuable feature for us. Having experts who monitor global threat landscapes and can respond accordingly is incredibly helpful. They keep an eye on our system and can intervene if necessary to prevent significant damage. That is the most important aspect for us.
That’s a bit tricky to answer. Trend Vision One is a powerful tool that provides a vast amount of information. It requires some practice to filter out the most relevant insights and respond accordingly like investigating specific endpoints when necessary.
Since we are still relatively new to the platform and have a small IT team, we haven’t been able to fully explore all of Vision One’s capabilities. However, the data we do utilize helps us react appropriately and address potential threats before they escalate.
A major advantage is that we can integrate Active Directory into Vision One. This means we get alerts if something unusual happens in AD, and these notifications appear directly in Vision One. I believe firewalls can also be integrated, though we haven’t done that yet as we are currently upgrading our firewall infrastructure.
Having a centralized platform where logs and security alerts from multiple systems converge is a huge benefit, as it allows us to react efficiently from a single interface. AI is beneficial because it can operate independently of predefined patterns, reacting based on behavior rather than fixed rules. It continuously learns and can detect threats that might not yet be covered by existing security protocols. This is a major step forward in cybersecurity.We realized Trend Vision One's benefits quite quickly. Within one to two weeks, we already saw improvements. We really noticed the full impact after receiving our first report. That allowed us to analyze incidents, track past threats, and understand what was happening within our network. After about four weeks, we fully realized the platform's value.
It does save time when searching for an incident because you can simply display the incidents in the Vision One console. You can drill down to the task level and see which file was affected on which endpoint.
That makes things much easier when tracking a specific incident. It saves more than fifty percent of the time because, as mentioned, you can drill down directly from the endpoint in the console, down to the task, down to the file, the DLL, or whatever it is. And you also get a display of what it is without having to access the computer and search on Google. As mentioned, everything is displayed clearly and neatly in the Vision One console, sometimes even with suggestions on what to do.
My organization has reduced its cybersecurity risk. We have a centralized view of where the risks are, you can specifically access individual endpoints, and as mentioned, the SOC in the background immediately reports unusual behavior even when you’re not around. If it’s high-risk, we get a call.
In this regard, cybersecurity has improved significantly because a lot of things that previously went unnoticed are now detected.
WHAT NEEDS IMPROVEMENT?
Trend Vision One is already very powerful. The clarity and usability could be improved a bit. Sometimes it’s difficult to find your way around.
It’s such an important tool, and you can do a lot with it. With some practice and proper training, you can manage quite well.
We are currently implementing, as a pilot hospital, an ICAP virus scanner through the Service Gateway via Vision One, which scans our KIM emails. This was an important feature and Trend Micro has now implemented it.
FOR HOW LONG HAVE I USED THE SOLUTION?
I have been using Trend Vision One for about half a year.
Security coverage is very important for my company's network. It is a requirement under the NIS2 directive, which is now coming into effect in the EU. The coverage is also important for us because we operate 24/7, but our IT staff is not available around the clock...
WHAT DO I THINK ABOUT THE STABILITY OF THE SOLUTION?
I would rate the stability a nine out of ten.
WHAT DO I THINK ABOUT THE SCALABILITY OF THE SOLUTION?
We are currently working on scaling. We are integrating with ICAP functionality.
The scalability is very good. You can integrate almost everything you need, including mail security, etc. I’d give scalability a 10 because nearly everything is integrated.
HOW ARE CUSTOMER SERVICE AND SUPPORT?
The staff we have dealt with were always very competent. What I find a bit difficult is that there is no German support. Since my English isn’t the best, we usually go through our consultant, as he knows the Trend Micro support team well and handles these things daily. So, we rely on our partner for that.
In terms of knowledge, the support is competent. The language barrier is just a bit challenging because when they speak fast in English and I don’t understand much.
To fill this gap, we opted for Trend Micro’s XDR solution. Trend Micro’s SOC team can respond even when no one from our team is available.
HOW WOULD YOU RATE CUSTOMER SERVICE AND SUPPORT?
Positive.
WHAT ABOUT THE IMPLEMENTATION TEAM?
The initial setup was done by a consultant from SoftwareOne. He did a really good job, and everything went smoothly except for the hybrid installation with Deep Security.
That went quite smoothly. Apex One had some issues, and we had to keep a support case open for a long time before it worked properly. But now, everything works fine.
We are only four people in IT here, and everyone does a bit of everything for the setup.
We install the agents ourselves, meaning we have to manually set them up on each computer or server.
The clients are already rolled out, and everyone contributes when needed like whenever we work on something, another sensor gets installed, etc.
We have around 400 endpoints and approximately 600 users with a Windows environment and a virtualized setup using VMware.
Our server environment also includes VMware View in some areas.
In terms of maintenance, I have to regularly check reports and see what needs to be done. Otherwise, everything updates itself in Vision One.
Since Vision One is cloud-based, the console updates itself, as do the agents. Once everything is installed, there’s little to do.
WHAT'S MY EXPERIENCE WITH PRICING, SETUP COST, AND LICENSING?
There are additional costs.
Overall, the price-performance ratio is okay.
WHICH OTHER SOLUTIONS DID I EVALUATE?
We looked at Sophos beforehand because we use it as a firewall. Since Vision One integrates well with existing solutions like Deep Security and Apex One, we chose an integrated solution and decided to go with Trend Vision One.
We also deliberately opted against a purely web-based solution. We run a hybrid installation, meaning that Apex One and Deep Security are still managed locally and connected to Vision One.
This is because we have been hacked before, and if I cut off internet access to our firewall, I wouldn’t be able to administer my security suite. With this setup, I can still manage and configure it before reconnecting to the internet.
WHAT OTHER ADVICE DO I HAVE?
I would rate Trend Vision One a nine out of ten.
My advice to anybody considering Trend Vision One is that the most important aspect is the integration with existing solutions like Apex One and Deep Security.
It’s stable and provides a lot of information. The only downside is that it can be a bit complex to navigate.
Join 500K+ Global Customers
Get started with Trend today