BlackBerry CylancePROTECT

In the three years we've been protecting our endpoints with CylancePROTECT, we have had ZERO incidents across ~250 endpoints. I have tested the Cylance client against true zero day attacks, not recognized on VirusTotal, shared with me by an MSP friend. He has had many clients compromised by ransomware, several more than once, with nuke/pave/restore for the entire organization being the typical response. When I throw attacks against old-build agents, and those attacks are obliterated, it helps me sleep better at night. I don't see these attacks in my environment, hence the testing. The endpoint is the focus of the last line of defense, so PROTECT is critical in my security posture.

In comparison to traditional signature-based (useless) AV, CylancePROTECT and CylanceOPTICS seems expensive. That's why my MSP pal doesn't have his SMB clients on this product, they can't comprehend the value proposition of something so different to what they're familiar with. I guess that's why the marketing initiatives can seem a little over the top, it's hard to get the idea across when some hater says "doesn't detect EICAR!"

Easy to deploy and manage policies across 1000s of assets in the corporate network. Has coverage for various OS platforms, including Windows, Linux, and macOS. Can perform bulk quarantine across all hosts for a known threat. Whitelist or exclusion is easy to setup.

A user friendly console for reporting and oversight dashboard for threat trends and malware families.

Some times results in false positive for the script module and could get tricky to manage exceptions if one is not fully aware of the gaps they can introduce by simply whitelisting system paths where most malware run.

Could include real-time sandbox capabilities like other competing products in the market

Blackberry Cylance Protect is very light weight and very powerful.

does not offer any enhanced firewall settings