Forcepoint Secure Web Gateway Reviews

Our primary use case is to control internet access based on security profiles. Users are restricted to legitimate sites and then, based on the business use case, we provide access to streaming sites and the like. We are customers and resellers of Secure Web Gateway and I'm a company director.

All the secure gateways are more or less the same. The value of Secure Web Gateway is the visibility it offers and the ease by which we can put controls in place. We enabled the cloud DLP so we can see what's happening to the data. The solution also provides good filtering features. 

One improvement I'd like to see would be to simplify managing the endpoint for both DLP and web security, so that endpoint management becomes easier. The dashboard is a little old so a new GUI would be helpful as well as updated reporting tools. It currently lacks some features that other solutions have. 

I've been using this solution for over eight years. 

It's reasonably stable but sometimes there are issues in the cloud. 

The scalability is good, our entire organization uses this product including engineers, marketing and administration. 

I'd say that customer service is above average.

The initial setup is straightforward, we deployed in-house and implementation required one person. The initial setup takes two or three days, but rolling it out and making sure that everybody has the required access, and that business applications are accessible, can take a month or so. 

The ROI is like insurance, it's the knowledge that you're protected. The fact that it's taking care of my security needs, is a return.

I'm unaware of licensing costs but there is an extra cost for additional reporting.

It's important to test any solution before making a decision to purchase it. Evaluate your needs and expectations, and carry out a POC. 

I rate this solution eight out of 10. 

My position means that I'm focused on functionalities and the happiness of the users of this solution. I am the CTO of sales and we are a customer of Forcepoint. 

I think the antiviral sandboxing is a valuable feature. 

The issues we have are more around organizational issues between us and Forcepoint. We don't have problems with the solution although sometimes attacks or new ransomware gets through. Sometimes we need to work together with Forcepoint in order to change the setup and to block it. It would be great if Forcepoint was able to do this without our knowledge and, even better before those mails ever reach us.

The improvement needs to come on both sides – not only from ForcePoint, but the idea is to work on few points:

• The idea is to set up on the ForcePoint side TAM that could help us in the tuning the configuration.
• At the same time we need to work on improving the expertise and increase the number of FTE that will work on the platform (internal or external) in order to be able to really have the benefit of TAM.
• 3^rd point is that some of the attacks come through and after we report it to ForcePoint they manage to improve the environment, while my experience with some other solutons is that the provider is more proactive and does the change/improvement even before we notice it.

I've been using this solution for three years.

The stability of the solution is fine. 

The scalability of the solution is fine. 

We are not so satisfied with the technical support but not because of Forcepoint, rather because of the organization on both sides. We need to work on that.

The initial setup is relatively straightforward. You need to spend some time defining the template of the environment that you would like. After that, the deployment in different domains is pretty easy.

The pricing of the solution is okay. We pay licensing fees but the cost depends on the package that we take. There are no other hidden costs. 

We are happy with the solution for now. One of the reasons we took it is that it gives us the flexibility to change if we do not like it or we are not happy. To be honest, once we made the decision, I didn't look at the marketplace anymore. It's possible that there are better products out there today.

I would rate this solution an eight out of 10. 

Our customers' primary use case in the banking sector is for URL history.

Forcepoint Secure Web Gateway has a lot of issues like troubleshooting and massive troubleshooting which require technical support. A lot of the product is not accessible. You must ask the tech support to communicate to open the root of the product - so that's an issue. But with Cisco you can access the product and troubleshoot.

To access the root of the product for troubleshooting you must have a data engineer. This is the big issue with Forcepoint. The support community is not good. 

The management should be directed to the object itself. They have to make a more flexible management so you can access a device using a normal web browser or you can access a device using a management tool.

Our company has been working with this product for about four years.

Our company prefers Forcepoint, but I prefer Cisco.

There is one issue with Forcepoint that you can't communicate directly with the update. You must have something called the management center to communicate. For Cisco you can communicate directly. With Forcepoint you cannot communicate directly

Scaling is not good with Forcepoint. Even high availability with Forcepoint is not good.

We do have a lot of customers using Forcepoint.

Yes, we have a lot of plans to increase usage because it's the only product we have. There is no other.

The initial setup is not complex, but requires being setup from the beginning. There is no default setting, so you must go to the console and configure the product from the beginning. It takes about 10 days.

This product, especially Web Gateway, has only a small vendor working with it.

On a scale of one to ten, I would give Forcepoint Secure Web Gateway a five.

I use this product for email filtering.

The spam filter is very effective.

It does a good job of detecting ransomware links in email and then blocking them.

We have a lot of false positives, which is one area that can be improved. At the same time, there is a lot of spam that still gets by the filter.

The engine should be enhanced because some malware still gets by the filter.

The login for emails should be more advanced.

I have been using Forcepoint Web Security for four years.

This service is very stable.

It is easy to scale. I can set up more than one Exchange server and more than one domain. We have about 600 users in the company and we do not plan on increasing at this time.

We obtain support from the local partner, rather than from Forcepoint directly.

Prior to this, I was working with Websense. 

It is a cloud-based deployment so the initial setup is not complex. There are a couple of things to configure, pointing them to your mail servers, but it is easy and straightforward. 

We only require a single person for maintenance.

The price of this product should be reduced to make it more competitive.

In summary, this is a good product and I highly recommend it. However, it is important to remember that suitability will vary depending on the environment.

I would rate this solution a nine out of ten.

The biggest issues within the product were that it had become stagnant. For about four or five years, there was very little real innovation going on.

It felt as if they were just sitting back. They were lacking in regards to keeping up with the developments within the cloud. 

Overall, I think they had a good, solid product. I think they failed to add features. It was not as feature-rich as other products. I would say the biggest problem was the lack of features, they just hadn't kept up. Under Raytheon, they were starting to correct this, but it was a work in progress. Overall, the biggest problem with the product itself was the lack of features.

I knew that they needed to handle web sockets in some way, all we could do was effectively bypass it. There were too many times when the connections just didn't work right through the proxy. Our customers would have to bypass and basically go around the product. There were various levels to this and it was a real pain for our customers to diagnose those problems. There needed to be an end-product protocol analyzer output (for lack of a better way to put it), that would help administrators understand why the connection wasn't working.

There was so much legwork involved: someone would have to take a laptop and set up in front of the proxy; then they would have to load Wireshark (as I used to call it) and pull their captures; then they would have to give that to Forcepoint, or they would have to try to reason it out themselves. That caused a lot of problems because most administrations weren't confident or competent enough to do it.

They didn't have the skill-set needed to make proper use of those tools in the first place for analysis. There were a lot of customers who could've gotten value from the product but who were put in a position where they had to basically bypass the product because of certain connections. Some form of connection-troubleshooting should be included within the product, more than just looking at a log that nobody knows how to read except for support. 
There was no way to troubleshoot connections in an effective manner that didn't require a lot of legwork by the user. Whenever you ask a user to do that, nine out of 10 times, they're not going to do it. They're just going to take the easy way out, bypass it, and then they'll bitch about the product, but they won't actually fix it. They won't want to make the extra effort. The problem just remains unsolved. They needed something like a connection analyzer tool to explain why, or at least give a better indication of why this was failing.

Again, it was the lack of development. The GUI is quite nice. I think it's very natural for people once they get used to it. Ironically, the company I'm working for now is actually POCing the DOV product and one of the things they like is the interface. They had a lot of good synergy with their other products. They failed to capitalize on it, ultimately. They're getting there. They got better, but it might be too little too late. That's the problem.

I have been using this solution for nine and a half years.

Forcepoint Secure Web Gateway was pretty stable.

Scalability-wise, It was pretty good. We had deployments that were easily over 10,000 — it could handle it if you scaled it properly with the right hardware. There were deployments that were 34,000 at that point. Now, with very large enterprises (with over 60,000 employees), that's where it starts to get a little tricky. They managed to get the product to that point but it was not cheap either, but it was achieved on the scale pretty well.

The biggest issue that hampered Forcepoint was the lack of development and good consistent support. Because of this, they went from 50,000 to 60,000 customers, down to 16,000 in the space of about three years.

That's a huge drop. A lot of that came down to Palo Alto and a couple of others jumping in the game with filtering but at the same time, Forcepoint had people who were loyal, but they were giving up because of the support situation. 

I constantly dealt with customer support. There wasn't a week that went by where I didn't have to talk to somebody.

They knew me by name and I knew them by name and we were all one big happy family, but when they moved from San Diego to Austin, they lost people.

They gave good, consistent support for about a year, but then they began losing staff because they weren't paying enough. They hired a bunch of people and claimed that they adjusted their wages, but then the same cycle occurred another year later.

That's been the biggest problem. It wasn't the product that caused them to lose people (even though they had some innovation issues), it was the support. At the end of the day, the innovation was causing them to look weak in customers' eyes; when you couple that with the support problems, that's when they started really losing customers.

The initial setup was pretty straightforward.

In fact, you could literally load it, install it, and have it up and working in no time. All you had to do was point a browser to it and you could prove it worked. Now, if we wanted to take it and fully integrate it onto the network, then nine times out of ten, we used one particular method called WCCP.

Overall, on a scale from one to ten, I would give this solution a rating of seven. 

The product was sitting at about a seven. Support was dragging it down to a six. So, if I had to be honest, they had some very good analytics — just counting the product itself, I would say it's a seven.

It wasn't perfectly stable, but it was pretty good. I would say it would need to be more feature-rich. It would need to be more helpful for troubleshooting problems with connections and it would need more stability — then I would give it a higher rating. Under all of those things, it's the support that's the problem because that's a different question from the product itself — it's the Achilles heel.

• Reporting
• Custom Block Pages
• AD integration

It allowed our company to not worry about the security of a page, but talk more about the content and the productivity of specific types of web categories.

Allow for faster exemption of websites or the ability to reclassify websites.

Five years.

None.

None.

None.

Great. They made sure that we were choosing the right version and helped us understand the tradeoffs between their different deployment strategies.

Great. I had only a few issues after rollout and their tech support was quick to help.

Cisco Web Security. The AD integration was lacking. The speed was also lacking.

It was straightforward, since I had deployed it at my previous company. The engineer assigned to our deployment was also on hand to make sure that I followed the updated best practices.

In-house with vendor support.

It is a well-priced option.

Zscaler, Barracuda, Sophos, and Cisco Web Security.

For the most part, the solution, when set up correctly, works fine.

Sometimes we find the solution behaves erratically. It may be related to our configuration, which may be incorrect. We are using desktops, laptops, and workstations and the laptops are set to mobile status. We do make connections outside the office premises as well, and desktops or workstations are predominantly located in the same place. 

Overall the software is occupying too much memory space. If they could remedy that, it would be a better experience, because today Windows is occupying too much memory space as well (in terms of the RAM), and this software has also started occupying all the memory. Due to this, I have less space for my other office products and data. I can't, for example, operate a huge Excel sheet or other datasets. 

Product grouping should be made more flexible. We should be in a position to define the product groupings. Also, sometimes the standard product grouping that they are using is not applicable in this part of the world. If they could move it, if they could make it more flexible, it would make our life easier. Otherwise, we are forced to use our own definitions a lot. This sometimes causes problems with performance. The product grouping really should concentrate more on this particular geographic region.

I've been using the solution for about five years.

In my opinion, it's a very stable product.

Companies really have to know how their organization will scale before purchasing the solution. Otherwise, they will be limited. In our case, we've grown far beyond our expectations, and are now facing issues. These products are not that scalable even though the company claims that they are.

The solution is used quite regularly. On average, we use it up to eight hours a day.

We've used technical support in the past. We are one of the major clients for most of these products in India, so we get proper attention from the company. We've been satisfied with the level of support we've received.

We didn't face any major issues at the time of implementation. We were using the facility management of both HP and IBM. They each have their own in-house capability to manage the software. Also, the OEM would have supported them well. As such, we didn't see major issues on any of the software implementation. There were just a few initial hiccups that can happen on any major project.

The version I'm currently using is about four years old.

My recommendation to other companies would be that they should spend more time analyzing their workload including access approvals and whitelisting/blacklisting. They should have a very clear way of defining the blacklist or whitelist.

Companies should also spend more time on sizing the product and considering how they will grow in the future when sizing it. That clarity is a must to decide the proper product size that will last over years as a company potentially grows. 

I'd rate the solution seven out of ten.

We have found the ease of administration most valuable. The policies are category-based, so knowledge of another content URL is not compulsory. In addition, it is a bit granular. For example, if we accept a policy on a social media platform like Facebook we have the option to limit what can be done on the platform.

The product could be improved by including a consolidated product that can carry on Forcepoint Secure Web Gateway product email, web, and DLP. It's a single licensing suite that carries all the features instead of having a product. Additionally, a consolidated approach to their products would be excellent, and Forcepoint Secure Web Gateway should be on the same path to work with peers looking at cloud adoption entirely.

We have been using this solution for approximately six years.

The solution is stable with hybrid as it provides high availability. For example, if your on-premises gateways and your data centers have disconnectivity of power, the cloud gateway still enforces web traffic if you have a hybrid version.

The solution is scalable. For example, if you have between 2,000 to 4,000 users, they advise you to choose a specific size of an appliance, and then you have scalability. Additionally, if you intend to expand, you can add a second device or get a more significant single device.

Hence, you can increase the number of devices to accommodate your scalability or choose a more significant device for scalability. Approximately 4,000 users access this solution in our organization.

We have had a good experience with customer service and support. For example, we have support from the EMEA, APAC and the North American region. So, it depends on the time you're logging the call. If you log support calls during the EMEA work time, then you're bound to get engineers from that region.

The initial setup is complex, it requires an expert engineer to complete but managing the solution afterwards is not complex.

I rate licensing costs an eight out of ten.

I rate this solution a nine out of ten. The solution is good but can be improved by including a consolidated product that will carry on Forcepoint product email, web, and DLP.