Check Point CloudGuard CNAPP Room for Improvement
Yokesh Mani
Deputy Manager at Computer Age Management Services Pvt. Ltd.
The user interface could be improved. Sometimes, the visibility is not immediately available for the environment. We have the native servers that come with the solutions, but we cannot see them in the Check Point log. Another issue is with the integrated file monitoring. It would make sense to have stuff like file integrity monitoring and malware scanning available within this module because we don't want to integrate another product.
For example, let's say it's showing a process violation. It should be able to do some additional malware scanning in that particular bucket to get some additional information. I don't want to integrate with another third-party tool or go to the native server to check something. It would be helpful to have integrated monitoring and malware scanning for the file types.
There are a few flaws with the security management portal where I have limited visibility into the workload protection features. There is no error visibility where I can see the communication and workflow between services. Some of the dashboards need to be fine-tuned if they are not customized. For example, I cannot customize anything on the effective risk management dashboard. Some of the information is not correct for my tenant. With respect to passwords and user management, there are no policies I can measure at the user level. If the user was created more than six months ago, you don't need to worry about that password or do anything like two-factor authentication associated with that user. They can still log in after six months or one year.
It's also a challenge to use CloudGuard's agentless workload posture with AWS. An Azure storage is summed up with a CNAPP encryption by default. We tried onboarding this data, but the problem is the attachment is not done. After a few days, we identified that it was impossible to do the encryption detection. But CloudGuard's default rules say that this has to be encrypted.
The AWS module says that we cannot access this volume with this encryption, so we cannot use an agentless workload posture with AWS because of this. It is a best practice to ensure that all the volumes are being encrypted. Without the encryption, how can I do this? It is a big challenge for CloudGuard.
reviewer1398609
Senior Manager at a financial services firm with 10,001+ employees
1) More number of Security Policy to have more number of detection
2) It should capture more information in metadata including communication detail. Also, Internal IP addresses should not be tracked as this might be having some compliance issues.
3) Should have support for VMware Pivotal Cloud Foundry
4) Should maintain configuration information which will help in case forensic need to be performed in term of changes
5) Should allow Policy to be deployed using a template and the same should be getting reviewed before deployment. This will help us to provide secure deployment CI/CD
View full review »
Ilaria Buonagurio
Head of Corporate Information Security Prevention at Luxottica Group
The service is already top-notch; both on the commercial side and on the technical side. I had the luck to be put in contact with a very talented and skilled technical after-sales team that guided us step by step through the configurations. Also, the commercial team was very comprehensive with our situation and allowed us to create a package that best fit our needs.
One feature of the product that I would like to enhance is the possibility to connect to vulnerability management platforms so that the issues that emerge from the scans can then be ingested directly into the vulnerability management process. It would be very nice to provide, on top of API connections, built-in plugins for the major ticketing systems.
View full review »Buyer's Guide
Check Point CloudGuard CNAPP
April 2024
Learn what your peers think about Check Point CloudGuard CNAPP. Get advice and tips from experienced pros sharing their opinions. Updated: April 2024.
767,847 professionals have used our research since 2012.
Matt Comstock
VP Service Delivery at Atlantic Data Security
I am not a technical person, but generically, the user interface can be a little more intuitive. Our staff has trained network security and cloud security professionals, and they get it, but when you are trying to get to the customers to be able to pick it up and maintain it, it can be a bit difficult, so the user interface can be a little better.
View full review »
Sailas Jose
Assistant Manager at Federal Bank Ltd
We have concerns regarding the pricing and would appreciate seeing some improvements.
View full review »SK
Salman Kaleem
Associate Director at Virtusa Global
The ability to help organizations modify their own policies is essential. For example, consider the CIS benchmark 1.5 for AWS. In the past, I would have added the CIS rulesets to my custom policy, along with my own rules for Internet requirements. This created a custom policy that was tailored to my specific needs. However, the CIS benchmark is constantly changing, and it can be difficult to keep my custom policy up-to-date. As a result, I now have to recreate my entire policy whenever the CIS benchmark is updated. This is a time-consuming and manual process. Adding a feature that allows me to easily identify the changes that have been made to the CIS benchmark and update my own policy accordingly would be a valuable addition to Check Point CloudGuard Posture Management. This would save me a significant amount of time and effort.
View full review »VD
Vijay Devnath
CIFO at Crisp System India Pvt Ltd
Check Point must provide a multi-cloud facility where AWS, Azure, and GCP can seamlessly work together and display posture in an integrated manner. Instead of showing separate AWS, Azure, and GCP environments, the solution should provide a single integrated view. This will make it easier to decide which issues to fix first and will reduce the amount of technical work required.
Check Point is always adding new features. However, we are sometimes confused about how to use the features that are already available. There are so many features and we are unable to use all of them.
AC
reviewer2379078
Senior Cybersecurity Architect at a manufacturing company with 10,001+ employees
Down the road, we would like to see automation. That is probably a feature that most people want. If they can automate patching a vulnerability, it will be much easier.
Nagendra Nekkala.
Senior Manager ICT & Innovations at Bangalore International Airport Limited
Automation and advanced threat prevention have room for improvement. I would like the rules configuration which are manually reviewed to be automated according to the defined rules.
View full review »
reviewer2054484
Cybersecurity Architect at a manufacturing company with 10,001+ employees
CloudGuard's effective risk management only scans accounts every hour. We have more than 150 AWS accounts and 20 Azure accounts. We sent Check Point a request asking them to increase the frequency to five to fifteen minutes. I want the flexibility to scan it as often as possible based on the account's importance. That part is lacking.
When rules change, it messes up the remediation. They haven't found a fix for that yet. The remediation rule goes into limbo. It's an architectural design flaw within their end compliance engine—a serious bug. We must spend extra time reapplying the rule when they periodically update the compliance presets. Auto-remediation breaks if you're using that particular out-of-the-box rule. I haven't experienced this recently, so maybe they fixed that part. However, that's what it did in the past.
Check Point is slow to respond to bugs. They resolve bugs maybe once every two weeks, and their R&D is slow. They're in Israel, and it's not just the Israeli holidays. I would probably pick a large US company if we did this over again.
They don't give us continuous feedback. I want live feedback when they change something. Stop breaking things. The company should let us know what they're doing when they add new features. They don't have an official beta program, so you can't test the new features.
That's the other bad thing about this product, but I don't know about other Check Point products. They're a firewall company but not a software company. If you put out a beta, customers should have the option to test it and give feedback. I've been putting a lot of work into CloudGuard to fix all the bugs. They should have paid me to fix their bugs for them.
They need to decrease their bug resolution time. Anything longer than two weeks is problematic. It's why we don't jump into the deep end with all these other features they've added. Our primary feature is the CSPM cloud part. The solution is useless if the reporting or remediation breaks, as it has in the past. It requires an SME for CloudGuard to dig in deeper, which takes time away from our SecOps folks.
Fabian Miranda
Cloud computing at Tech Data Limited
The tool works perfectly and improvements should be made, if any, in various technical and administrative aspects.
DN
reviewer2379465
Software Development Manager- Cybersecurity at a retailer with 10,001+ employees
One area where CloudGuard CNAPP could be improved is in its reporting capabilities. Customization options for building tailored reports would be beneficial, as it would allow for different views on vulnerabilities based on specific criteria such as tags or dimensions. Currently, the reporting features have some limitations in providing the level of customization we require.
RD
reviewer2386959
Senior Security Consultant with 5,001-10,000 employees
The setup can be better. With every other Check Point SaaS product, the setup is scripted. You just approve deployment scripts, and then you are off. The setup for this solution is still very much manual. I would like to see that transition to more of a scripted setup. That has been an issue when I set up a client because every client has different skill sets.
The general reporting also needs improvement. It is very cumbersome to pull the reports for big environments. I had a client environment with 50 tenants, and I had to manually run a CIS report for each tenant and download it. There were 50 different reports. I wish there was a way to get the reports for all 50 tenants in one report and not 50 different reports.
BD
Basil Dange
Senior Manager at a financial services firm with 10,001+ employees
There are several things in need of improvement, including:
- Policy validation should be available before it is deployed in a production environment using a cloud template.
- Auto remediation requires read/write access. As providing read/write access to third-party applications can add risk, it should have some option of triggering API calls to the cloud platform, which in turn makes the required changes.
- A number of security rules need to be added in order to identify more issues.
- Reporting should have more options.
- It should support all container platforms for visibility of complete infrastructure using a single console such as PCF .
Christopher Federico
VP Sales, MSSP and MDR at Torq
The reporting has a lot of opportunities to continuously improve so that we can continue to show value.
I would love to see more ability to automate and integrate into even more systems for automatic remediation.
View full review »
SHRINKHALA SINGH
Senior Manager at Advertising Standards Council of India
I strongly advise that the multi-layered security system of Check Point often undergoes updates and new versions keep coming. It is absolutely fantastic and is worth admiring. Every now and then, we feel that their team's training and orientation process on orienting the clients and partners is low and needs to be strengthened so that every single individual is completely aware and informed of the features and their utilities. They are not clueless in utilizing the services to their maximum. We just need more focused training.
View full review »
Mantu Shaw
Project Manager at Incedo Inc.
Almost all features are good, however, they still require improvements to the code security portion on which integration with the major source code repository is required.
Integration with CI/CD is an important aspect as it is needed to secure the environment. Having it will help a lot.
Integration with Docker is also a key feature that needs some improvements.
Integration with other third parties and with SIEM is an important aspect that should be addressed.
Currently, it provides integration with Tenable, but it would be good if it had support other VAPT software as well.
View full review »BD
BasilDange
Sr Manager IT Security at a financial services firm with 10,001+ employees
- Policy validation should be available before it is deployed in a production environment using a cloud template.
- Automatic remediation requires read/write access. When providing read/write access to third-party applications, this can add risk. It should have some options of triggering API calls to the cloud platform, which in turn, can make the required changes.
- A number of security rules need to be added in order to identify more issues.
- The reporting should have more options. The reports should be more granular.
- It should support all container platforms for visibility of a complete infrastructure single console, such as, PCF.
KS
Kuber Shukla
Senior Security Specialist at Tech Mahindra Limited
Their service needs improvement. Their vendor doesn't provide good support. Also, there is no way to escalate it to Check Point so that Check Point can take action against their partner. I don't have direct support with Check Point. We have collaborative support with one of the Check Point partners who do not provide good support. When we reached out to Check Point to escalate; they denied taking any action against the vendor.
View full review »AB
reviewer2119419
Senior Accountant at SORECO
The security investigation features that are present have been performing excellently since we deployed this application. There are few licensing and network coverage cases, however, the customer service team is always ready to solve any problem.
Timely updates and upgrades to meet modern technological changes could help improve performance and limit the chances of downtime.
The performance has been stable for a long time since we deployed it. The few hitches which we have experienced can be solved without affecting the workflow performance.
The Check Point team has done a great job, and I recommend their products to other companies.
View full review »
Emanuel Kjellin
Cloud Analyst at Cloud2Go
The license cost is expensive and has room for improvement.
View full review »KP
Kirtikumar Patel
Network Engineer at LTTS
In Dome9, there should be a policy validation option where we can validate the policy before we push it into production. This option is very important, as we are working in a critical and complex environment. This option would give us more confidence in our activities or policy pushing.
We could see the option is available for on-premises devices.
Automatic remediation requires read/write access.
Otherwise, overall this product is very good for our cloud environment, and we are satisfied with this.
View full review »
Gian Marco De Cola
IT Security Specialist at Unipol Assicurazioni S.p.A.
The costs are really high if you want the entire capabilities of the platform. However, it is really motivated by the great value of the product. Moreover, you can buy individual licenses for the different modules if you don't need some of them.
View full review »AH
Abdul Hanif
Cloud Security SME at a computer software company with 1-10 employees
The integration process could be enhanced by enabling integration at the organizational level rather than requiring the manual setup of individual accounts. The current workflow of creating and linking each role is time-consuming and labor-intensive. Streamlining account onboarding by allowing CloudGuard to identify and integrate at the organizational level would significantly simplify the process.
View full review »
Adrian Cambronero
Consultant at ITQS
The service is very complete for the functionality that it was created for, however, they can make a couple of improvements such as the validation of policies that must be available before they are implemented in the production environment. It should have some options to activate API calls to the platform in the cloud, another improvement would be that when the rules are colonized and they want to be published. They do not update as they should and the new rules are not applied. They can also try to reduce the false positives generated by the tool.
View full review »Adrian Cambronero
Consultant at ITQS
It cost us a little to find some information about CloudGuard Workload Protection. It cost us to find information about the tool and recommendations.
The configuration administration documentation is not very available on the web, or it is not completely updated. They should also improve the support so that we can create a case and they can respond faster. They take time to respond or coordinate a meeting since they maintain a schedule that does not fit Latin America very well. It is sometimes difficult to coordinate support hours.
They do not provide a concrete and rapid solution which causes security implementations to be delayed.
View full review »Adrian Cambronero
Consultant at ITQS
Check Point tools need to improve the latency in the portal since they take a long time to load.
They also need to improve the support a little or hire more staff since the response time is slow or the solutions take a long time to implement.
Check Point should give added value to all those customers who purchase their product by providing training so that they can certify in the tool. That way, the customer stops depending so much on support and can solve incidents themselves.
View full review »TG
reviewer2085951
Cloud Security Architect with 51-200 employees
Making basic rules is easy, but it's complex if you want to do something a little more nuanced. I've been unable to make some rules that I wanted. I couldn't evaluate some values or parameters of the components I look for. I haven't always been able to assess them.
It feels like some attributes of resources can't be interrogated through the GSL the way I would like. For example, I wanted to figure out all the systems launched with a particular image that had been running for 31 days or more. Until I talked to the Dome9 people and the support team, I didn't understand how to frame that query in GSL. The support team told me how to do it, but I couldn't figure it out alone. The documentation is a little unclear about how to do some of those configurations. More tutorials and examples on the blogs and support pages would be helpful.
I had another problem when we tried to encrypt all of our storage volumes. There is a feature called batch jobs or Elastic MapReduce jobs. CloudGuard sometimes can't detect the encryption status of the underlying disks of those systems that process my workloads. It pops up with a bunch of alerts that say, "Non-encrypted volumes have been found in your account."
Those jobs are dynamic, so they spin up, run for an hour or two, and all the systems are destroyed. By the time I checked it, all the systems were gone. CloudGuard threw a bunch of alerts in the middle of the night when all these things happened, and I went back to evaluate the configuration. I know they were all encrypted because I can see how it was deployed. It didn't have a great insight into my actual workload, but it generally tells me when people launch unencrypted things. It isn't perfect, but it's okay.
View full review »JH
reviewer2029350
Database Administrator at Ordina
The entire system is complicated, and the setup process may not cater to the company's demands.
Tiny misconfigurations may not be detected in advance and can easily affect performance from some cloud servers.
When the platform is overloaded with a lot of tasks at the same time, it can delay results and lead to poor security responses.
The cost is high for small businesses that have no stable revenue-generation assets.
Security and compliance posture reports created from the audited results have confirmed that we are doing well and the organization has stable security tools.
View full review »
Jonathan Ramos G.
Cloud Engineer at ITQS
I would like an interface more adapted to cell phones or tablets. In its web version, it is quite efficient, however, I would like this improvement and the possibility of action to be able to enjoy and manage even the identity and administration under applications optimized in said function - whether they are iOS or Android.
Another feature that I would like is being able to carry out more frequent assessments on the solution with direct Check Point teams.
View full review »SB
Schillebeeks Bart
Owner at AD Internet Consulting
The false positives can be annoying at times.
Mohan Janarthanan
Assistant General Manager- IT Security at a tech services company with 1,001-5,000 employees
Compliance checks on cloud resources against various industry standards and compliance framework templates need to be improved, to ensure that organizations meet regulatory requirements with clear visibility action controls. This can make it difficult to create and manage custom security policies.
Cloud security posture management is a proprietary solution, which means that there is no open-source community to support it. This can make it difficult to get help with troubleshooting and other issues.
View full review »Jonathan Ramos G.
Cloud Engineer at ITQS
Currently, I would like this solution extended to cellular devices or tablets. This will be able to allow us to be more efficient.
RR
reviewer1440831
Senior Security Engineer at a insurance company with 10,001+ employees
The accuracy of its remediation is a 7.5 out of 10. Before, I would have given it a ten but now, to handle remediation for fully qualified domain names, it's not working as it did in the past. We're finding some difficulties there.
Also, as soon as Check Point took over the solution, the feature that identifies and creates security groups based on fully qualified domain names, instead of IP addresses, was degraded.
View full review »
Nagendra Nekkala
Senior Manager ICT & Innovations at Bangalore International Airport Limited
The tool should incorporate more use cases like improving security scores. It should also improve documentation.
View full review »SM
reviewer2173374
DevOps and Security Engineer at a financial services firm with 5,001-10,000 employees
Especially with cloud security, there's too much clutter on the screen and too many things going on.
In a future release, we'd like to have the ability to see if there is abnormal data being transferred. We'd like to see more features coming through that allow us to act more proactively and act against vulnerabilities effectively.
View full review »
Edwin Solano Salmeron
Soporte técnico superior at Acobo
The tool has several specific characteristics at the Microsoft 365 or Exchange level.
The solution could be improved with a greater analysis of its Microsoft Security score. They should be improving the visualization of data and greater coverage in Sharepoint or Teams. Its posture analysis is currently low. There could be improvement or capacity to be more efficient if we managed to achieve greater integration with Microsoft Security score, improvements in data visualization,, and greater coverage of Microsoft 365 resources.
View full review »
Hugo Alexis Espinoza Naranjo
Perimeter Security Administrator at a security firm with 51-200 employees
We want to optimize the tool in the future. They should allow us to have greater integration with other security solutions and third-party tools so that the organization can take advantage of and improve the protection of all the company infrastructure.
We would like to optimize and improve its high demand for customization, which allows us to adapt to specific necessary security solutions. We want to be able to customize the solution more in order to meet the needs of our company. Currently, the solution is quite rigid and complies only with standards.
View full review »SF
reviewer2008410
Software Engineer at Doddle
The software configurations theory is complicated, and without proper planning and a well-skilled technical team, it cannot perform its tasks properly. Without effective mapping of critical areas, the platform cannot provide very good results.
The maintenance cost is high after deployment, and it requires close monitoring for effective results.
This version performs effectively when it is channeled to the right network infrastructure. It has created a centralized operation system that can comprehensively monitor and manage security for all connecting systems.
View full review »SW
reviewer2000268
Human Resources Executive at Randstad Nederland
There is no full support for bot management, and the company can work on that to enhance faster service delivery and enhance reliable security checkups.
The reporting dashboard responds slowly, which leads to late report compilation. The next release can be equipped with robust dashboards and highly responsive data models.
The performance was more stable compared to a few challenges we faced, but with new upgrades, it could be even more stable.
The enhancement of cloud servers' security and management of dataflows has been a great achievement, and I highly recommend this solution.
View full review »
Shay Zer
Presale security at a comms service provider with 5,001-10,000 employees
There are regulatory requirements. I would like to be able to pick the regulation I would like to scheck compliance with and it would tell you where you stand on that regulation and what you are missing to reach compliance. And it shouldn't matter which cloud we're dealing with; we would have these possibilities.
View full review »RN
RonnieNunn
Freelancer at a consultancy with 51-200 employees
Having additional documentation on how to use CloudGuard CNAPP would be advantageous, especially if it were made more user-friendly. The application's structure seems to lead users down one path, then into another, making it difficult to backtrack or navigate seamlessly between different components. Streamlining the user interface would greatly improve the user experience.
View full review »
SANDRA SUAREZ
CEO at SAFEID
The solution needs to improve remediation. We need to reduce risk by remediating gaps in security.
You do need to pay extra in order to get better support.
View full review »BW
reviewer2104284
Java Application Developer at Oesia
No improvements are needed. The current version has great and powerful features that take care of most sets of demands. The cloud-integrated network system can be upgraded to meet company requirements on intelligence information and for customization purposes. The set features have stable performance capability with the modern threat management network infrastructure.
This system has a capable data orchestration system that can access data from various centers. The customer support channels are reliable, with great services when contacted.
View full review »LD
Leo Diaz
Cloud Support at a tech company with 1-10 employees
Some general improvement characteristics can be made, including the following:
1- Cost improvement. Some tools are quite expensive, and some non-equal manufacturers offer more comfortable capabilities at the cost level.
2- The guidelines to implement or to link with the clouds are not complete. Following them sometimes the task of implementing under the best practices of the manufacturer is not achieved.
3- Many Check Point guides are only available to partners and not to the general public. They can make a better impression by having them public and thereby helping the client.
View full review »LD
Leo Diaz
Cloud Support at a tech company with 1-10 employees
Some possibilities of improvements for Check Point include:
1- Improving or creating best practices that can be generated publicly so that customers can have a package of policies, for example, that the manufacturer provides in addition to easy access to this material.
2- Improvement at the support level for management, handling and solution of cases in a better, faster, and more effective way. Sometimes the cases take a long time to be able to schedule a session and solve together with the client and support.
3- The costs are high. They could provide better costs for the client to make a simpler decision and not be affected by this issue.
View full review »CF
reviewer2092263
Software Engineer at iDeals
Effects on the network can slow down performance and lead to data leakages that can expose confidential information to cyber attacks.
The UI can be upgraded to be more presentable and solve most challenges that affect users when there are inefficiencies.
It does not support on-premise deployments such as VMware Tanzu, and this has been a major drawback when it comes to integrations with some applications.
The majority of the features have been performing efficiently, and we are happy. The development can keep on updating the platform to meet daily changes and organizational demands.
View full review »KW
reviewer1459770
Advisory Information Security Analyst at a financial services firm with 501-1,000 employees
The biggest thing is the documentation aspect of Dome9 is a little lacking. They were purchased by Check Point about a year and a half to two years ago. When they integrated into Check Point's support system, a lot of the documentation that they had previously got mangled in the transition, e.g., linking to stuff on the Dome9 website that no longer exists. There are still a lot of spaces with incomplete links and stuff that is not as fully explained as it could be. However, the product itself is really easy to use, so there is not too much of an issue with that. Also, it's not too hard to get on with the actual Check Point support to go over this stuff.
Diana Alvarado
Security Admin at a tech services company with 51-200 employees
Areas that can be improved are few. However, some can be mentioned, such as the costs for this solution going down a bit. Not all clients, despite the great power of the tool, can afford it.
The support must be more effective. Sometimes they take several days to resolve an issue. However, it must be mentioned, they always resolve it correctly.
Finally, I think that the solution meets all expectations but can also improve the performance of the administrator portal a little so that it does not sometimes stop.
View full review »LD
Leo Diaz
Cloud Support at a tech company with 1-10 employees
Some improvements that can be made to Check Point CloudGuard are the following:
1. Cost improvement. Currently, this solution is somewhat expensive. We have not really seen a solution with these characteristics and so complete. However, the cost is high.
2. There is very little Check Point documentation as it is a very new tool. Sometimes we followed the documentation, yet it was not possible to implement it in the tool, for which we had to verify with the executive of our partner to request help.
3. Support is very slow.
View full review »Diana Alvarado
Security Admin at a tech services company with 51-200 employees
Something that needs to be improved little by little in tools like Check Point CloudGuard Intelligence is the lowering of costs as some customers can't buy such a solution. They could also sell it based on various versions for different customers and various business needs.
It is also important to improve performance issues at the Infinity Portal level, which is sometimes slow, yet not always.
We would like there to be more public documentation to generate implementations with best practices.
View full review »Diana Alvarado
Security Admin at a tech services company with 51-200 employees
Check Point CloudGuard Workload Protection is a very powerful, comprehensive, centralized tool but also a very expensive solution. It is worth it, however, it is not available to everyone.
The Check Point Infinity admin portal sometimes freezes.
There is little documentation for the implementation and start-up of some configurations. They could improve the public documentation to be able to generate the help that the client requires to be able to generate the correct and effective provisioning.
View full review »RH
reviewer2173383
Founder
The rules are not well-tuned, and many of them generate false positives or nonsensical results. For example, they might flag port 443 as open, even though it is supposed to be open for a public web server. There needs to be a better way to exclude certain hosts that are compliant and are supposed to be open.
NG
N Guzman
Support at a security firm with 51-200 employees
I would like them to include support for their products in languages other than English in order to have easier contact with Check Point support. This would make management easier.
The costs of latest cloud solutions are very expensive. Some of them are only for large companies, and they should make cost improvements.
Response times for support or problem cases sometimes take a long time to be addressed.
The documentation can be easier with more public documents and accessibility to the client. Currently, it is difficult to find documentation for new products.
View full review »Basilio Alcantara
IT Security Engineer at Bayview
The tool has a lot of potential, but today, it lacks a lot of Scripts/Bots for Azure. This is one of the main cloud providers, so it's imperative to make this a priority in order to bring a lot of value to this tool.
The idea is to leverage Dome9 as the main central place for auto-remediation of all cloud environments so that customers don't have to spend a lot of time manually remediating. Manual remediation is very challenging once you have so many cloud accounts to support on a regular basis, and Dome9 can help do part of the job.
View full review »JM
Jose Mendes
Network Security Engineer/Architect at Euronext Technologies SAS
The main issue that we found with Dome9 is that we have a default rule set with better recommendations that we want to use. So, you do a clone of that rule set, then you do some tweaks and customizations, but there is a problem. When they activate the default rule set with the recommendations and new security measures, it doesn't apply the new security measures to your clones profile. Therefore, you need to clone the profile again. We are already writing a report to Check Point. I think they have solution to this issue.
View full review »OP
Oleg Pekar
Senior Network/Security Engineer at Skywind Group
We were demotivated by the lack of native automation modules for the Terraform and Ansible tools. We think that in the era of the DevOps approach and practices, all the new products need to be released with such support, mandatorily.
In addition, we also hope that the Dome9 will eventually support the other Public Cloud platforms, like Alibaba, since we are planning to expand to the Asian market. Alibaba is the big player in this region due to the fact that Google Cloud and AWS are almost banned.
LucianoMiguel
Security Consultant at a consultancy with 501-1,000 employees
The dashboard customization has room for improvement.
View full review »MS
reviewer1761732
CEO at a tech vendor with 11-50 employees
CloudGuard CNAPP is a great tool that justifies its investment. Like any other tool, there are opportunities for improvement that can be addressed through a roadmap.
SJ
reviewer910575
Chief Technical Officer at a government with 1,001-5,000 employees
CloudGuard could be more customizable. It has built-in standards for things like GDPR compliance. But depending on your business lane, you might want to build your own controls based on your own standards.
it_user810990
Director, Information Security & Service Transformation at a insurance company with 1,001-5,000 employees
Dome9 continues to enrich its features at a blazingly fast pace. I would like to see tighter integration with other compliance tools, like Chef Compliance, in addition to Inspector. Also, I would love to add more richness to the Splunk add-on for Dome9.
NG
N Guzman
Support at a security firm with 51-200 employees
Some CloudGuard Check Point positions are not required by the company, however, if we do not apply it, it affects our score.
The support SLA is not met. Sometimes they don't seem to like solving cloud issues or modern security applications.
The Check Point solution is somewhat expensive. It must be validated first before purchasing it.
Hazel Zuñiga Rojas
Administrative Assistant at Tecapro
When it comes to validating the power, security, implementation, and management, I would like to also have the capacity more easily on-premise as well as the cloud. Some problems have been found in analysis at the time of execution, and local install revision agents have generated management incompatibility. It is important to evaluate the applications that are on-site since they are needed in the organization. We're looking for a solution that can incorporate legacy infrastructure for some of our business needs.
View full review »Hazel Zuñiga Rojas
Administrative Assistant at Tecapro
I'd like to see more advanced encryption for local features, which is not present right now. We'd like to have more defined control when implementing intelligent analysis on the cloud. We'd like to extend analysis not just to crowds but to local teams for more granular analysis and advanced searchability.
Myrian Medina
Head of Technology and Systems at Simed
The product must provide different features like antivirus.
View full review »HS
reviewer1663263
Security Engineer at a tech company with 1,001-5,000 employees
The following things can be improved:
- Reporting should have more options.
- Investigation of security events should be more comprehensive be it for cloud activity or traffic activity.
- The false positives can be annoying at times.
- We do not use remediation at the moment. We do the remediation manually, since we are still using Dome9 in read-only mode. I don't know if we will use the remediation in the future as we prefer to do it ourselves.
- The price of this solution should be reduced so that it is more affordable to scale.
JP
Javier Puerta
Cloud Solution Architect at Network Thinking Solutions
Today, globally, there are many companies of all sizes that do not understand the value of their data, but even with all the existing clouds, they also do not understand what the shared responsibility model is. They only assume that by having a cloud, the provider must ensure security, when the truth is that providers only protect their sites. Everything we do in the cloud and how we configure it is actually our responsibility, in this sense we can evaluate many solutions that help us protect our clouds, however, and after trying 5 different solutions, the checkpoint solution is by far The most complete
View full review »
VV
reviewer1666944
Cloud Security Lead at a computer software company with 5,001-10,000 employees
In general, we abandoned this solution this year.
Each component of this solution, in my opinion, could be improved.
Integration with ticketing systems, as well as the most important noise and completeness over findings, are definitely in need of improvement. They didn't take into account some additional context.
The UI is very slow.
There is room for improvement. Consider the entire context of the findings and try to avoid making a comparison between the rule and the entity's state. In general, for the product to be successful, they need to improve security, and configuration detection.
View full review »NG
Naveen Govindappa
Solution Architect Cloud Security at a tech vendor with 10,001+ employees
Dome9 should also support deployments that are on-premises and in a hybrid cloud.
This solution needs DLP support.
View full review »YY
Yasdy Yasin
Cloud Infrastructure Architect at Maxis Berhad
I would like to see Test B functions at the application access level.
DC
reviewer1416270
Managing Director at a tech services company with 5,001-10,000 employees
I'd like to see improvements with the configuration.
View full review »EI
ElieIfrah
Cloud & DevOps Team Leader at a tech company with 501-1,000 employees
I’d like to see more integration with third-party tools. For example, it would be helpful to have an integration between Dome9 and ServiceNow to manage security incidents and security changes.
View full review »it_user621555
President at a tech services company with 1-10 employees
The governance and compliance areas are becoming very useful, and continue to expand in very user-friendly ways. Addressing the large amount of compliance information and benchmarks we need to observe, the tools are becoming our goto dashboards.
View full review »CD
Chris Dagal
Senior Consultant at a tech services company with 11-50 employees
I would be great to have additional features when it comes to vulnerability assessments in terms of how the solution discovers vulnerabilities or compromised workloads and not just on security configurations with customizable reports would be nice.
View full review »RM
reviewer1854018
Implementer at a tech services company with 51-200 employees
CloudGuard could be improved by including integration with vendors other than AWS, especially Azure, especially in permissions. In the next release, I would like them to include some kind of online scanning on code in the development phase.
View full review »BM
reviewer1343916
Product Manager at a tech services company with 51-200 employees
GD
Gordan Daut-Kaiser
Cloud Security Architect at Kontex
The security of Check Point CloudGuard Posture Management could improve. There are always new security issues coming out.
View full review »it_user731871
Owner at Liversidge Consulting Ltd
Integration with other security tools would be of benefit.
I would like to see some AI on the back-end, just to assist with doing analysis and making recommendations.
View full review »
HariOmKanth MS
DevSecOps Engineer at a tech services company with 11-50 employees
The technical support could be better, but I do not know of any other needed improvements.
View full review »Buyer's Guide
Check Point CloudGuard CNAPP
April 2024
Learn what your peers think about Check Point CloudGuard CNAPP. Get advice and tips from experienced pros sharing their opinions. Updated: April 2024.
767,847 professionals have used our research since 2012.
Buyer's Guide
Download our free Check Point CloudGuard CNAPP Report and get advice and tips from experienced pros
sharing their opinions.
Updated: April 2024
Product Categories
Vulnerability Management Cloud and Data Center Security Container Management Cloud Workload Protection Platforms (CWPP) Cloud Security Posture Management (CSPM) Cloud-Native Application Protection Platforms (CNAPP) Data Security Posture Management (DSPM) Compliance ManagementPopular Comparisons
Cisco Umbrella
Prisma Cloud by Palo Alto Networks
Microsoft Defender for Cloud
Zscaler Internet Access
Prisma Access by Palo Alto Networks
Qualys VMDR
Tenable Security Center
Microsoft Defender for Cloud Apps
Fortinet FortiWeb
AWS Security Hub
Cato SASE Cloud Platform
Buyer's Guide
Download our free Check Point CloudGuard CNAPP Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More:
- Primary Use Case
- Valuable Features
- Room for Improvement
- Customer Service and Support
- Initial Setup
- ROI
- Pricing
- Other Advice
- What is the pricing for Check Point software?
- How inadvisable is it to use a single vulnerability analysis tool?
- What are the benefits of continuous scanning for vulnerability management?
- What is a more effective approach to cyber defense: risk-based vulnerability management or vulnerability assessment?
- When evaluating Vulnerability Management, what aspect do you think is the most important to look for?
- What are the main KPIs that need to be implemented to have better posture in vulnerability projects?
- How do you use the MITRE ATT&CK framework for improving enterprise security?
- What are your recommended automated penetration testing tools?
- Can you recommend API for Tenable Connector into ServiceNow
- What penetration testing tool (or tools) do you recommend for SMB/SME?
