Fortinet FortiEDR Reviews

The primary use case of the solution is to help protect our components.

Forensics is a valuable feature of Fortinet FortiEDR.

When the Fortinet FortiEDR is enabled sometimes our applications stop. The solution causes our applications to crash. There is room for better integration to prevent stability.

The exception handling for the on-prem version has a cap compared to the cloud version and can be improved.

I have been using the solution for ten months.

The solution is not stable. I give the stability a two out of ten.

The solution is scalable.

We have 2,000 people using the solution.

We have a premium technical support service through Fortinet.

The initial setup is complex. I give the deployment a three out of ten.

We are still in the process of deploying the solution.

The price is comprable to other endpoint security solutions.

I give the solution a five out of ten.

Three dedicated people are required for maintenance.

I do not recommend the on-premise version of the Fortinet FortiEDR. I recommend people use the cloud version instead because it is more stable.

It is mostly used according to client’s need. 

I believe that easy deployment is primarily used to facilitate client learning. Additionally, when it comes to EDR, there are more tools available to assist with client work. 

We've encountered challenges during API deployment, occasionally resulting in unstable environments. Deployment can be a bit tricky at times. In terms of pricing, EDR tends to be more costly than FortiClient. In some cases, we opt for FortiClient because clients may not have the resources or time to invest in EDR.

I have experience with Fortinet FortiEDR. 

It is a stable solution.

It is a scalable solution.

The customer service is very good.

Positive

The initial setup is pretty easy and I would rate it an eight out of ten. 

It is expensive and I would rate it an eight out of ten.

I would overall rate it an eight out of ten. 

NGAV and EDR features are outstanding.

We saw Lockey very early on and caught it via behavioral signatures on the traditional AV. We already had parts of the payload downloaded because the traditional AV behavioral signatures were not blocking everything. We had removed the endpoint from the network to investigate and realized the standard AV would have failed. Adding enSilo blocked Lockey immediately and allow no parts of it through. We have found errors in other applications and used enSilo findings to improve the operation of our systems. enSilo also provides a forensic service, which we have leveraged to validate files are malicious or not.

One of the key features to enSilo is it does not block/delete entire executables. Instead, it blocks malicious functions. This allows users to be unaffected if the file is useful but has bad components. FoxIt is a good example of this. Not a malicious tool but has vulnerable behaviors that enSilo can block.

The engineering team continues to add useful features, like the ability to search for files and hashes across the environment. At the moment, I am very happy with the product. Not a deal killer, but making the portal mobile friendly would be helpful when I am out of office.

Almost two years.

Endpoint agent is incredibly small (<2MB), so it is very easy to deploy.

Product has been rock solid from its earliest versions until now. Seems the engineers do a good amount of QA and testing, so they do not release half-baked software.

Recently tripled our deployment size over a weekend without issue.

enSilo team is super responsive. From the tier 1 support to the advanced malware researchers, they all understand customer service. I have been called and emailed at 1AM with high-risk events, and also when I reach out at 2PM, they respond just as fast.

The team is not hesitant to escalate an issue to development/engineering. Unlike a lot of companies, they are quick to modify the application to fix an issue.

Used Tanium and other EDR/Forensics tools at previous employers. Those tools are great at managing overwhelming information but do not necessarily help with visualizing real threats occurring in the environment. enSilo quickly provides a visualization of what has happened and where the malicious behavior occurred. You can then dive down to a full memory dump without having to dig through other useless screens.

The management is cloud-based so it was easy to just install agents and go after opening a firewall to our dedicated IP.

In-house. No real need to go external.

I avoid this question with security tools as there is no real return on this, just a lowered burden to manage risk. I will say the tool requires maybe 2 hours of actual focus a week, so much less noise than other tools. enSilo also reduces our risk more than any other tool we have (firewall, web filter, email filter, etc.). From that perspective, we get the most risk reduction with the least burden from enSilo.

I know it is tough to get big budget additions up front, but I highly recommend deploying environment wide and adding the forensic service. Prioritize your most at risk assets, e.g., users with unrestricted browsing or access to sensitive data.

Yes:

Carbon Black - Too much noise and time to configure policy. Also, it had too many disparate components to manage/up-sell.

Tanium - Would not talk to us, because we are under 5000 endpoints.

Cylance - Not mature enough at the time of our initial purchase in early 2016.

Confer - Lots of promise, but got purchased by Carbon Black.

Check it out, it is definitely worth your time. They have a unique approach and will let you sleep at night.

It is stable and scalable.

Comparatively, it works fine, but the amount of usage, the number of details we get, or the number of options that can be tweaked is limited in comparison to that with other EDR solutions. The ability to make certain changes or investigate is also limited.

Also, the investigation and the details, which I would get when I'm looking into it, and the ways I could configure or white list or black list a few things are also limited. It is not up to an extent where it can give me granular options to do that.

I've been using it for about a year.

The stability is pretty good.

It is scalable.

For some organizations, FortiEDR is good enough, but for others, it's not. It depends on the organization's infrastructure.

I would rate Fortinet FortiEDR at six on a scale from one to ten.

The ease of deployment and configuration is valuable. It's very easy compared to other vendors like Sophos. Sophos' configuration is complex. Fortinet is a lot easier to understand. You don't need a lot of admin knowledge to do the configuration. 

The security is also very good and the firewall response is good. 

Clients want to be in a hybrid mix and match mode. The security needs to be relevant in that way as well. It has to be online, on the cloud and on-premises. This is the customer's mindset. They don't want to go for user applications on the cloud. They think it will fail and the data will be inaccessible. They don't want to go to the cloud platform. The security should be strong for the cloud. Some applications are on-prem and some are on the cloud. Fortinet should also have strong security for the cloud. There should be more security for the cloud. 

I have been using FortiEDR for the last year. 

It runs constantly, 24/7. It is quite stable. We haven't had any stability issues. 

It is scalable. It is good for both small and large companies. Security has to be strong, it should be at the same standard. It's suitable for all business sizes. 

We haven't needed to contact support for EDR. 

The deployment can be done in one week. We have configured it within a week. It takes generally three people to set it up. I supervise the team. 

There are no additional costs. 

As of now, it's very good. We don't have a lot of challenges. The EDR concept is new to the market. It doesn't have a lot of competition. As of now, we don't have a lot of user input. If it's on the market for a few more years, I'm sure people will have more feedback.

We do our own documentation and share the whitepapers with our clients. I don't find Fortinet to be a difficult tool. The reporting is good and designed in a way that even a newcomer can use it easily. As of now those clients who have migrated from other security vendors don't have a lot of challenges. The clients appreciate the technology and report that they have tangible benefits.

I would rate it a nine out of ten. All of the requirements are addressed nicely and the security is covered. It has everything it needs. 

We use this product to deploy to all the clients we have to monitor any kind of suspicious activities occurring on the end points besides antivirus. This will kind of automate their response basically with the EDR. I'm a security analyst and we are customers of Fortinet. 

Since we've had this solution we've been able to monitor different hosts of services and different devices effectively. We can also automate to save a lot of time instead of doing things manually.

The most valuable features would be the ability to get forensics details and also memory exfiltration so we can analyze them separately after an incident.

Detections could definitely be improved. It's still detecting some things that it shouldn't be like Microsoft Intune and 365 devices as well.

I'd like to see an improvement in the reporting. There are currently no reporting capabilities so I would definitely want to see that.

I've been using this solution for 18 months. 

The solution is stable.

We haven't had issues with scalability and we have over 5,000 endpoints. In the security team we have four people who use the solution daily. The others use it in case of emergency.

The initial setup was very straightforward. 

This is definitely a good product and will make your life easier. 

I would rate this solution a seven out of 10.