Reco AI and Agent Security

My main use case for Reco is SaaS activity. I use Reco for security alerts, specifically for checking unfamiliar sign-ins, unusual geographical location sign-ins, and any unfamiliar downloads. Reco is primarily a security platform for identifying risks, monitoring user activity, detecting suspicious behavior, and discovering unauthorized applications across cloud and self-serve services.

Reco has had a positive impact on my organization primarily in terms of affected users and applications, such as identifying which SaaS application or platform is involved and understanding permissions related to data exposure and access. It has improved SaaS visibility, reduced security exposure, enabled faster investigations, and strengthened access governance.

The best features Reco offers include AI, which is useful for monitoring SaaS applications, identifying risks, identity threat detection, and auth risk detection. Reco's AI helps identify risks from endpoint alerts alone, especially for applications, permissions, and unmanaged SaaS applications or misconfigurations.

Reco's AI capabilities support a SaaS governance and security approach. I find Reco's AI capabilities in terms of accuracy and reliability of its output to be good.

My impression of Reco's use of eight different sensors for SaaS application discovery in my environment is that it is helpful. Reco's device management feature helps organizations identify security risks associated with SaaS applications, users and identities, permissions, and integrations, focusing on application discovery, shadow IT detection, SaaS identity risk scoring, device enrollment, device compliance enforcement, remote device wipe, and SaaS auth risk detection.

Reco can be improved because sometimes it gives false positives and I need more data about alert investigations, as it currently provides only a few details for faster investigation.

I have been using Reco for the past one year.

Reco appears to be a viable enterprise SaaS, but its stability should not be violated before relying on it, considering platform stability, detection stability, and integration stability.

Reco is designed to support enterprise-scale SaaS security, particularly for organizations managing hundreds of SaaS applications, thousands of users, and numerous third-party integrations.

The customer support I experience with Reco is good.

Before adopting Reco, I used multiple security tools for visibility, identity risk, and access governance. Reco brings several classic capabilities together but does not replace all existing security tools.

I would rate Reco an eight on a scale of one to ten. I choose eight because sometimes I receive many benign positive alerts from Reco; most of them are false and do not need investigation, while critical alerts are important. I currently have no idea which cloud provider I use. I would advise others looking into using Reco that they can use it for security purposes.

My main use case for Reco is that it has been a valuable part of our security and SaaS visibility stack. Over time, I have found its main value to be giving us better visibility into our SaaS environment and helping identify areas that require attention. Reco is relatively straightforward to work with, and its centralized view makes it easier to investigate issues compared with checking individual applications manually.

A specific example of how I used Reco to solve a problem and improve my workflow is when we were trying to understand an unfamiliar SaaS application in our environment. Instead of manually going through different systems to figure out who is using it and whether it needs attention, Reco gives a centralized place to start that investigation, which saves quite a bit of time, especially when dealing with a growing number of applications. For me, it is primarily the visibility that matters.

I think another benefit is the context around the visibility because it helps us decide which findings actually need attention, rather than treating everything the same.

The biggest positive impact Reco has had on our organization is improving our SaaS visibility and reducing the amount of manual work involved in security investigation. Previously, we had a lot of manual work going on in security audits. Before having this centralized visibility, understanding an application often means checking multiple systems, looking at access and permissions, and sometimes reaching out to different teams to understand who is using it and why. With Reco, we have a much more centralized view, allowing us to quickly investigate usage and identify the users or teams associated with an unfamiliar application instead of spending a lot of time gathering that information manually. This helps us reduce investigation time and prioritize our security efforts.

I can estimate that previously it was taking thirty minutes to forty-five minutes for messaging someone to check things, and now it reduces to five to six minutes, which is a reduction of around sixty to sixty-five percent. If we calculate it on a larger scale concerning fifteen to twenty hours, then it is a great estimation because fifty to sixty percent time saved is a lot.

The best features that Reco offers, in my opinion, are the centralized view of the SaaS applications being used across our organization. For example, if a new SaaS application starts being used by an employee, Reco helps us identify it and investigate things such as who is using it, how widely it is being used, and whether it needs to be reviewed from a security perspective. This is particularly useful because manually tracking every application across a growing organization would be time-consuming. We also use the visibility to prioritize applications or users that require attention rather than manually reviewing everything. For us, the biggest value is having centralized SaaS visibility combined with security context, which helps us reduce manual investigations and gives our security team a better understanding of our SaaS environment.

I had one incident approximately six months ago when our security team noticed that a new SaaS application, such as a project management or AI productivity tool, was being used by an employee. Previously, to investigate it, we might have had to check our identity providers to see which employees have access, look at application logs to understand usage, check with the application owner, and then manually determine whether the application should be approved. With Reco, we can start from a centralized view and quickly understand the application, who is using it, how broadly it is being used, and what security information is available around it. Instead of spending thirty or forty-five minutes collecting information from several places, we get the initial context much faster and focus on deciding whether there is an actual risk. I think this is the biggest time saving for us. It is not just that Reco puts information on one screen; it reduces the back and forth between different tools and teams during an investigation.

Whenever I use Reco, I feel safe. Governance and security are definitely important considerations, especially because SaaS environments can contain sensitive organizational user data. Understanding what data is being processed is crucial.

The breadth of coverage Reco offers for SaaS operations is strong, particularly around SaaS visibility, application discovery, and user and access context. Reco is not just showing us a list of applications; it gives us additional context that helps us understand how those applications are being used and where we may need to investigate further. For example, identifying applications across the organization to understand associated users and access helps prioritize potential security or governance issues, which becomes particularly valuable as our SaaS environment grows.

The use of eight different sensors for SaaS application discovery has made a noticeable difference for us. The main benefit is that we are not relying on a single source of information to discover SaaS applications, as different applications can show up through different signals, giving us broader coverage and making the discovery process more reliable. Having multiple sensors feed into Reco and provides a more complete picture of what is actually being used in the organization, reducing blind spots and the amount of manual discovery work for our team.

The LLM integration is interesting because the knowledge graph gives context about the relationships between users, application access, and security signals. Instead of an analyst manually connecting those dots, the AI can help explain what is happening and why something might deserve attention, significantly speeding up investigation. This is probably the biggest differentiator compared with more traditional SaaS visibility tools.

The AI agent security capability is particularly useful because AI agents are becoming another category of SaaS technology users that security teams need to understand. The biggest challenge is that agents can be connected to applications, APIs, and data sources, and sometimes have permissions to take actions on behalf of users. Discovering those connected AI agents and bringing them into the same governance process as the rest of our SaaS is quite valuable because we need to understand what is connected to what permission it has, what data it can access, and who owns it.

My impression of Reco's Device Management feature when it comes to discovering every device in our organization is quite positive, particularly from a visibility perspective. One of the challenges with device management is getting a complete and up-to-date picture of what devices are present. Reco provides centralized device visibility without maintaining separate inventories and correlating devices with users and SaaS applications manually.

I think overall Reco works well for our use case, but there are a few areas where it could become even more valuable. The biggest one would be more customizations and automations, such as having more flexibility in creating organization-specific dashboards and reports, because different security teams have different priorities. Being able to customize which metrics, applications, risks, and users we want to track would be helpful. I would also like to see more automations around remediation, such as triggering actions automatically based on predefined policies without human dependency to avoid delays.

Another improvement I wish to see is deeper integration with other security and identity tools, because the more information Reco can correlate automatically, the less time the security team has to spend moving between different systems. Overall, I would not say there is a major gap; it is more about enhancing the strong visibility Reco already provides by adding more customization, automation, and integrations.

My impression of the accuracy and reliability of Reco's AI output is that there is a lot of manual analysis the security team has to do.

I have been using Reco for the last one year, and I value this service highly.

Before using Reco, we were actually using a combination of existing identity and security tools. The main limitation was that the information was fragmented, so we could not get a complete picture from different tools, which forced us to rely on a mix of Wiz, Okta, Zscaler, and Microsoft Defender.

Setting up Reco agents for automating tasks in our business processes is relatively straightforward, especially once the integrations and permissions are already in place. An agent could detect a SaaS application that meets certain risk criteria and then automatically notify the user owner or initiate a security review. The main thing we focus on is permission and guardrails for higher impact actions, wanting approval and auditability rather than giving the agent complete autonomy.

We have seen a positive return on investment, estimating that the initial investigation effort has dropped by roughly fifty percent. Something that previously took thirty to forty minutes might now take fifteen to twenty minutes, providing the biggest measurable efficiency gain by saving twenty to forty hours of team time to focus on something more complex or prioritized.

We have purchased Reco through the Google Cloud Marketplace. Overall, the setup cost was straightforward because it is a SaaS, and we did not have major infrastructure costs. Most of our effort was configuring integrations, permissions, and workflows. From a licensing perspective, the main thing I look for is predictable pricing as the number of users and applications grows.

We evaluated several options before choosing Reco, which included comparing solutions such as Wiz, Netscope, Microsoft Defender, and assessing what we could have accomplished with our existing tools. Ultimately, we compared how well each solution could provide complete SaaS visibility.

Reco is not deployed in a completely private cloud environment for my organization. The cloud provider we use with Reco is Google Cloud Platform, or GCP. I did not find any much deviations since our organization is a long-term user of this Google Cloud provider, and most of the services are from Google Cloud, which we trust.

My advice for others looking into using Reco is to consider that we evaluated a few alternatives before selecting it, focusing on SaaS discovery, visibility into users and access, security context, and the potential to eliminate manual investigations, which is why Reco stood out with its centralized view across different signals.

I would rate Reco around eight out of ten. I choose this rating because of the improvements I am expecting, particularly more automations and customizations. The majority of things are correct, but I think in this AI era, everything is automated, and those two things would significantly reduce time. Regarding how Reco is deployed in my organization, I took the plan.

I used Reco when I worked at the company as a software security tool that monitored all the software the company was using. Reco functioned as a detection tool that identified any type of malicious event occurring within the software environment for users.

What I appreciated most about Reco was its strong detection capability. It detected when we received a large volume of critical alerts and displayed those at the top, alerting us that it was urgent to investigate them.

What I disliked about Reco was, I remember the system didn't have tickets #'s and it was hard to keep up with sometimes. I would have to save the incident as web link to keep up. Its sometimes produced a lot of false positives. There were things that were not really alerts but triggered anyway, and we had to go through many of them even though nothing was actually wrong. But, then they found a way fine-tune it more later.

I have been using Reco for about a year overall in my career.

I have seen some lagging and downtime with Reco. There were times when there were glitches, when dealing with logs pages, but they fixed them, even though it took a while to address them. They would either fix them or tell you how to work around them.

Regarding Reco's scalability, I think they can add more to it, but I'm not entirely sure how to phrase this.

I did not have to contact Reco's customer support because the client took care of that issue, but we did have team meetings with Reco sometimes. Sometimes we discussed any problems and concerns we had during live Reco tech support calls.

We used alternatives such as Gurucul, which allows you to see malicious things triggering on a network basis instead of just the software, and we also had CrowdStrike. Those are a few alternatives we used.

The initial deployment of Reco was not difficult.

Maintenance for Reco was being taken care of by them.

Of all the alternatives, I preferred Reco more because it was easier.

Reco is spelled R E C O. If Reco had a system for setting up agents to automate tasks in our business processes, that would be beneficial and would make things go much faster. Regarding Reco's use of eight different sensors for SaaS application discovery in our environment, I do not understand what they mean by that. I would rate this review a 7.

I implemented Reco for cybersecurity posture management for SaaS applications, and also for AI agents posture, so SaaS security posture management and agent posture management. I am using Reco for detecting attacks and generating alerts on bad behavior in SaaS applications, not only posture.

I am using the eight different sensors for SaaS application discovery in my environment, and it works well. To be honest, I am not using that in depth, the discovery module; I know the SaaS applications that I have and I integrate them directly. I see that it's discovering applications through these sensors, and I am using the email one, which works well; it checks on the emails and sees if someone is using a SaaS application. But besides that one, I am not using the other sensors. That sensor is working well, but I am not, let's say, taking advantage of that module yet, the discovery module.

My impression of Reco's AI Agent Security features ability to discover and govern connected AI agents is that it works well; I am using that for my agents on Copilot Studio. I integrate Reco with Copilot Studio, and it's showing me the agents, the inventory of agents, and the posture of those agents. It's working well, but the only problem was with the integration with Copilot Studio because there was a centralized integration; I have to integrate with each environment in Copilot Studio, so it's not easy to integrate because I have to go one by one, one agent per agent. But once I am integrated, it's very good; it shows good information and posture risks on those agents, so it's working well.

I am aware of the pricing aspect of Reco.

I am not using Reco's agents for automating tasks in my business processes.

I do not use the device management feature in Reco.

What I like about Reco is that it's pretty easy to integrate with the applications; it's almost plug and play. The interface and the user experience of the interface are very good, and it's very easy to find the detections, alerts, to filter, and to navigate the interface. The support is also very good; I have been implementing the solution with them, and they have been helping me a lot. The support works well, and it's also very good at prioritizing the detections, so I don't see many false positives.

The key benefits that I have seen from using Reco are that it helps me to mitigate risks in SaaS applications; I have a lot of SaaS applications with many configurations inside. Without Reco, I am losing critical information to understand if I have risks in the cloud, so with Reco, I now have visibility. I am maybe not 100% sure, but in a high percentage, I can assure that I don't have high or critical risks in my SaaS applications, which are growing every day and becoming more important. It helped me to mitigate those risks, basically.

The coverage of SaaS applications is very good; they cover almost all of my SaaS applications, and they have a big list of SaaS applications supported.

I am not using the inclusion of LLMs in the knowledge graph yet; to be honest, I see that it's showing things, but until now, I don't see big value on that.

Apart from the integration with Copilot Studio that I mentioned, I would like to see more posture security controls added in some SaaS applications; I see a few of them, but it could have more.

I would like to see real-time detection in prompts included to Reco in the next releases, maybe in Copilot Studio to see if I have any attack or prompt injection or whatever in Copilot Studio and all the agent platforms to inspect those prompts.

I have been working with Reco for one year.

I haven't had any performance or stability issues with Reco; it is stable.

Regarding scalability, what I mean by scalable is that it scales in and out automatically, and I don't see that; it's transparent for me.

The support is very good; I have been implementing the solution with them, and they have been helping me a lot. The support works well, and it's also very good at prioritizing the detections, so I don't see many false positives.

I would evaluate customer service and technical support from Reco as very good.

Prior to adopting Reco, I had a feature that Netskope has for posture, SaaS posture management, which wasn't good; it was very immature.

The deployment process was pretty smooth; they were with me, the support helped me to deploy the solution, and they sent me all the step-by-step procedures for integrating with the SaaS applications. It was pretty smooth, and I didn't have any challenges there; the only challenge was the Copilot Studio integration that I had to do for each Copilot Studio environment.

I purchased Reco directly through the vendor.

It's difficult to find return on investment with Reco because it's more related to risk, to risk mitigation. I could say that maybe I have mitigated a couple of risks that could lead to money loss, but to be honest, I can't calculate that. Before Reco, I didn't have visibility on the posture of SaaS applications; it wasn't that I saved time with Reco; it was having more visibility and mitigating more risk, which is difficult to show as a return on investment.

My experience with the pricing was reasonable; it was okay for the features and what the product provides. The contract, the negotiation, and everything were okay.

I evaluated a couple of other options; I decided to go with Reco mostly because of the integrations, the supported integrations, and the user experience. How it shows the detections is pretty clear and organized, while the others either didn't integrate with some of my SaaS applications or they showed the posture detections very confusingly or were missing detections.

I am using Reco as a full SaaS.

The only disadvantage at that moment was that Reco wasn't so popular; it wasn't implemented in companies in my region, so that was the only risk; it was a new tool without experience in at least companies that I could ask for recommendations.

Based on my experience with Reco, I would say to test it, try it out, and see if it solves your problems. I have no advice to give except that it's a good product that has improved a lot over time. I would rate this review as a 9.