Verdict: FTK will continue to be our computer forensic workhorse and we make it SC Lab Approved for another year.
Verdict: This belongs in every lab doing mobile device forensics. Not only is it a solid tool, it is perfect for triage. We make this our Best Buy this month.
Verdict: We wish that we could afford this tool for our lab but, as powerful as it is, it is far out of the range of any but large organizations with significant investment in forensics and DFIR.
Verdict: This has become a mainstay in the lab for tracking research projects, all of which behave a lot like digital forensic investigations. Over the past year we have not retained our research records because there was no need to. This year, need or not, we will. We make this ...
Verdict: While monitoring remote sessions may not be the first thing you consider when you are planning DFIR, if you are accessing servers and critical/sensitive workstations remotely you should consider this product strongly, no matter what the size of your enterprise is. This is our Recommended product for this month.
Verdict: This is probably the best analytics tool we've seen and the notion of feeding with a SIEM is intriguing for its significant possibilities. We certainly will be doing that here in the Labs. NIKSUN has been SC Lab Approved since we started the program and we continue that for another ...
Verdict: Solid malware analysis tool, especially good for engineers just getting started with malware analysis. We make this our Recommended tool for this month.
Verdict: Since this is SC Lab Approved, the obvious verdict is that it is a first-rate tool and merits examination if you are looking at doing in-house malware analysis (and you should be). We continue to rate this one SC Lab Approved for its heavy utility in our lab and superior ...
Verdict: We have gushed about this tool enough in the review so we’ll simply offer a verdict of Best Buy for this month.
Verdict: For a mix of threat analysis and incident response – where the core of the alert is malware-based – this one demands your attention. The Carbon Black experience is obvious.
Verdict: This is a strong product under the covers but with a few warts for users. None of those are show-stoppers, though, and you would do well to take a close look at it.
Verdict: This is a very sophisticated but rather specialized tool for the endpoint. If you are a large organization or one with high-value information assets, this is well worth your time. For what it does, we know of no better tool available. We make this our cloud-based Recommended product.
Verdict: If you are using CylancePROTECT this is a no-brainer. If you are not, it’s a good reason to consider it. Because CylancePROTECT is one of our SC Lab Approved products, it already has our highest rating, but we are naming the OPTICS add-on Recommended for the value that it adds ...
Verdict: If you’re looking for a threat-focused endpoint tool at an attractive price point this is worth your attention. For its ease of use and deployment, we make this our on-premises Recommended tool.
Verdict: This is one of the strong players in this field. Although it shows, clearly, a legacy of anti-malware (to the point where it still refers to “anti-virus,” even though it really addresses all malicious software), this tool is a capable contender for endpoint security in general.
Verdict: An exceptional effort on behalf of the McAfee technical support team that provided the SC Lab with the opportunity to dedicate more time to testing the product package. Overall, an excellent product, but you’ll get the most out of it as part of the entire McAfee suite managed, as ours ...
Verdict: Don’t pass this one by if you are looking at anti-malware. In our view, it certainly ranks in the top five such products we’ve seen over the past couple of years.
Verdict: You cannot make an informed endpoint decision without taking a look at this. Of course, if you already are a Symantec shop this will fit right in.
Verdict: Solid vulnerability management tool that could become a bit pricey in a large environment.
Verdict: This one demands your attention. At a very reasonable price point, we make this our Best Buy this month.
Verdict: This is a tool that you can add to your environment almost regardless of what else you are using. It not only plays well with others, such as risk management tools, it is a powerhouse in its own right. Recommended.
Verdict: Well worth your time. This is a company with solid experience in the technology – and it shows.
Verdict: We weren’t sure about this one until we acclimated to how it really works (as opposed to how we thought that it should work). Given that this truly is a beast of a different color, we are classing it by itself and a vulnerability analytics and workflow management tool and ...
Verdict: This one demands your attention. With its ability to cut through vulnerability noise, using its analytics and configuration options to its massive scalability, this works for just about any size enterprise.
Verdict: Not much to say here besides that this product is SC Lab Approved and that is our highest award. This is one of the best UTMs we’ve tested and over long periods of use it has delivered very well. We make it SC Lab Approved for another year.
Verdict: Especially for organizations with limited expertise in applying all of the things a SIEM can do to protect their enterprises, this product is a must-see. However, any size organization can benefit by considering this as part of its security stack.
Verdict: There is a lot to getting this one up and running, but once it’s up and you have the things you want to monitor plugged in, this one of the most complete SIEMs we’ve seen.
Verdict: We like this a lot, especially for SMBs, although larger organizations certainly should not rule it out as too small. It’s not. For its value and feature set, as well as the efforts to improve and keep the product ahead of the curve, we make this our Best Buy.
Verdict: Since this already is SC Lab Approved, we can’t give it a higher rating. We like this well enough that we are extending its SC Lab Approved designation for another year. It continues to be our key analysis tool.
Verdict: This is an important contender for your SOC SIEM. It will take data from just about anything you need to monitor and it includes solid third-party threat feed access. This is our Recommended product.
Verdict: This demands your attention no matter what size your organization. There are models to cover most requirements.
Verdict: This is a product with which you pretty much can’t go wrong, especially since it integrates with most products that need the log management and analysis that it does. It is sort of a SIEM’s SIEM.
Verdict: This is an excellent approach to first phase interdiction for ransomware attacks and shows a solid understanding of the ransomware process and how to manage its delivery through phishing.
Verdict: This is a solid anti-ransomware tool, priced right and well-supported. It certainly deserves your attention. We make this our Recommended product for multi-featured products this month.
Verdict: This is absolutely a world-class anti-ransomware product in a world-class ecosystem. Using the associated products, you can build out a solid security framework in your enterprise. For its completeness and solid competence, we make this our Best Buy this month.
Verdict: A promising product not quite ready for prime time.
Verdict: This is not for the faint-hearted, but if you opt for this you can be assured that it and Barracuda will serve you very well, indeed.
Verdict: Because this is a rather specialized approach to the ransomware problem and, in our experience, one of a very small handful of services that get this right, we make this one our Recommend product for specialized products this month.
Verdict: Solid threat intelligence product with a prodigious collection of resources. Fits well into just about threat and intelligence analysis tool set. At a price that is hard to beat, we make this our best Buy.
Verdict: In a sensitive environment – such as a financial institution that can afford the resource – this is a very solid contender. There is a whole lot to like about it and it may be one of the most powerful tools on the market.
Verdict: This is a good tool and certainly has a place in your analysis stack.
Verdict: We wish that Cyjax would use humans instead of computers to probe underground forums. Also, this is a bit pricey for what it offers. However, if you need open source intelligence with a bit of closed source thrown in, this is well worth your time to examine.
Verdict: If you need this level of analysis and if you can afford it, this is a solid choice for your cyber intel arsenal. We make it our Recommended choice.
Verdict: This has long been one of our favorite products and it is well worth considering.
Verdict: Good, well though-out tool and, if you are looking for out-of-the-box compliance capabilities, this one demands your attention.
Verdict: A powerful tool with a clear and important mission that it fulfills well. We make this our Recommended product this month.
Verdict: This is one of the best tools of its type that we’ve seen. It is comprehensive, reliable and easy to use. We make it our Best Buy.
Verdict: For the change management required for compliance in just about all regulatory requirements, this is a very strong contender.
Verdict: Well worth looking at for those with a need for a complete risk management tool.
Verdict: We would like to see some form of auto discovery beyond what is available currently. Verdict This one is well worth your time, but be sure that you have everything on your enterprise identified so that the Suite can access it and collect data.
Verdict: This is a gold standard of GRC systems. It has all of the bells and whistles that you need and just about nothing that you don’t.
Verdict: Solid, hard-core GRC.
Verdict: Solid, versatile risk management tool that can fit organizations of just about any size – from the single consultant to large enterprises.
Verdict: This is an excellent tool, especially for mid- to large-sized organizations. It has everything you need and is comfortably manageable. We compare it to a sailboat – even though it’s fairly large and complex, can be sailed effectively by a single person.
Verdict: This is a first-class product, straightforward to use and very flexible in its functionality.
Verdict: For its clean, bare-bones, well-targeted functionality, extensive reporting and remediation capability at a very low cost of ownership, we make this one our Best Buy this month.
Verdict: If your GRC program is missing the “R,” this tool may be for you. It handles risk as well as any tool we’ve seen – and is better than most. At $25,000, it’s going to appeal to medium to large organizations. We certainly think it will scale nicely for the ...
Verdict: Very good product for detecting changes in configuration or files and reporting in a way friendly to regulatory requirements. Closed loop remediation adds to the value.
Verdict: This is a heavyweight general-purpose cyberforensic tool with a lot of features, add-ons and built-in power. It has been SC Lab Approved for the past two years and we continue that for another year. Next year, at the end of its current tenure in the lab, we will present a ...
Verdict: Cellebrite’s UFED Analytics Enterprise is for larger organizations, but organizations of all sizes can benefit from Workgroup and Desktop versions. If you have a reasonably heavy digital case load – especially if you already are a Cellebrite shop – this is for you. We have made various Cellebrite products ...
Verdict: This is the 800-pound gorilla of over-the-network digital forensic tools. Today – and for the functionality required for the types of investigations for which it is intended – if it doesn’t have it, you probably don’t need it. It’s our Recommended product.
Verdict: Case management is a task that digital investigators tend to relegate to spreadsheets or whatever notebooks they can find. Something far more rigorous is needed and this is it. Again this year. we make Lima SC Lab Approved. We will be using it over the next year in our research ...
Verdict: NetDetector always has been a good series for NIKSUN, but this new version tops everything they’ve done so far – except, perhaps, for the Supreme Eagle (see our First Look review, October 2015). Again this year, we bring the NetDetectorLive into the lab as SC Lab Approved, our highest award. ...
Verdict: We liked this one a lot. We’re intrigued by how it has taken forensics to the endpoint and then added next-generation analytics along with lots of conveniences, such as string and binary downloads.
Verdict: For a simple, well thought-out and executed mobile device forensics tool this one is at the top of the heap. Its capabilities are narrow and very deep. It does one thing – mobile device forensics – and it does that extremely well. We make the Paraben DS our Best Buy.
Verdict: If you are using remote terminal services of any kind in a Microsoft network – and most businesses are – you should take a close look at this (or its larger, beefier, siblings).
Verdict: Solid, simple product that will fit well in large or small enterprises.
Verdict: This one is very much worth your consideration.
Verdict: This is a very strong solution to endpoint DLP challenges.
Verdict: This is a very powerful tool and certainly deserves your consideration. Administrators should be trained and understand what is involved with deploying and where caution areas exist.
Verdict: For large enterprises, this really needs to be on your short list of potential products for DLP and endpoint protection. Kaspersky is noted for its anti-malware and this overall system carries that reputation forward.
Verdict: This is a good DLP tool, but is not trivial to deploy. Over the next release we expect a lot of the rough edges to be smoothed out. Excellent support.
Verdict: We love this product, even with the support cost wart. There is a misconception among everyone – except security/IT engineers – that they all are geeks and love to spend their time tinkering, writing code and manually configuring. Nothing could be farther from the truth. These folks are so overloaded ...
Verdict: This has pretty much all one needs in an endpoint protection tool. And, with its attractive pricing and low cost of ownership, we have to make this our Best Buy this month.
Verdict: Good pure-play DLP with the added advantage of being a SaaS offering (there is an on-premises offering as well, but that is a different product). This is well worth looking at.
Verdict: First-rate product for mobile application management (MAM), easy on users in a BYOD environment.
Verdict: This is a real powerhouse, but it is not for the faint-hearted. Best for organizations with an IT force experienced in enterprise-level mobile device management.
Verdict: For its strong feature set, value for money, ease of use and deployment, we make this our Best Buy.
Verdict: Strong product with the backing of a venerable player in the IT and security community.
Verdict: Solid vulnerability management system, especially at home in large environments.
Verdict: This takes vulnerability management into the next generation and combines vulnerability assessment and pen testing along with attack simulation in a single tool.
Verdict: Very interesting tool and, for large organizations that need to validate whether their vulnerability and penetration testing tools are doing the job, it’s a must-have.
Verdict: LOGICnow MAX Risk Intelligence is one of the cleverest vulnerability assessment tools we’ve seen. For its straight-to-the-point functionality and its exceptional value for the money we designate this our Best Buy.
Verdict: For a large enterprise – really, no matter how large – this product is well worth your consideration. It brings the power of significant functionality with a history of reliability and excellent support options.
Verdict: The SAINT Security Suite is a venerable system that in the past we have called a great work-horse. Now we see it as much more than that so we make it our Recommended product.
Verdict: While we are unsure of the actual performance – since we saw only a canned demo – this looks like a solid enterprise tool. This should not be passed over if you are considering a vulnerability management application. It is slick and very comprehensive.
Verdict: This is not expensive and one might want to consider it as a second scanning tool if one already has something else. For smaller organizations, it’s all that is needed. Nessus, the core of this product, probably is the best-known vulnerability scanner in the world.
Verdict: If you are a Tripwire shop, this is a no-brainer. If not, it still can do a lot for you and you might want to take a close look. We advise some detailed discussions with Tripwire as you select, though, to make sure that you will be able to deploy ...
Verdict: For its powerful, mature feature set, performance and superior value we make this our Best Buy.
Verdict: Depending on the use to which you intend to put it, this one certainly requires your consideration. There is a full-featured, 30-day downloadable trial and we highly recommend getting it and seeing if the product fits in your environment.
Verdict: If you are a small-to-medium business this product is a no-brainer. With a strong feature set for a modest price it is an excellent choice. If you are a larger organization, by no means should you discount this one.
Verdict: This is a heavy duty tool made for a demanding large environment. It is scalable and complete with the largest list of supported connectors we’ve yet seen. For all of that we make it our Recommended product.
Verdict: For its performance, functionality and value, we are pleased to make Intel-McAfee one of our SC Lab Approved products and look forward to having in the SC Lab for a year’s worth of evaluation.