Incydr

What do you like best about the product?

I like the simplicity of using Incydr. The interface is intuitive, allowing me to quickly find the most important information without spending too much time navigating through menus or complex configurations. This speeds up event monitoring and the detection of any suspicious activities.

What do you dislike about the product?

Some functions and initial configurations may take a bit of time to understand, especially for those using Incydr for the first time. It would be helpful to have more immediate guidance directly in the interface, such as brief contextual explanations or tooltips for some less intuitive settings and options, so you can immediately understand what they do without having to consult the documentation.

What problems is the product solving and how is that benefiting you?

I use Incydr to monitor company data movements and identify risky behaviors or file transfers, helping to prevent data loss. It helps me quickly identify suspicious activities, reducing the risk of data exposure.

What do you like best about the product?

I find Incydr very quick and easy to use. Its integration process is super simple—it doesn't involve a lot of hassle, which is a big plus. The risk assessment dashboard is a standout feature for me; it prioritizes high-risk files at the top, which is great for risk reduction. Overall, Incydr makes my job a lot easier, especially when reporting back, and it does exactly what it promises without overcomplicating things.

What do you dislike about the product?

For the risk monitoring, it would be nice if the dashboard was a bit more accessible for people who aren't as technical. That would be really handy.

What problems is the product solving and how is that benefiting you?

Incydr simplifies my data loss prevention reporting and audit needs. It's quick to integrate and use, helping in our secure financial environment by prioritizing high-risk files for effective incident management.

What do you like best about the product?

What I like most about Incydr is that it gives you a clear picture of where company data is going without making you constantly dig through logs. It’s especially helpful for spotting unusual file activity and potential data leaks early. The main upside for me is having that visibility in one place and being able to investigate issues before they turn into bigger problems.

What do you dislike about the product?

The main thing I’d say is that it can take some time to get everything configured and tuned properly. There’s also a lot of information available, so it can feel a little overwhelming at first when you’re trying to figure out what’s actually important. Once it’s set up though, it becomes much easier to work with.

What problems is the product solving and how is that benefiting you?

Incydr helps us keep better visibility over how sensitive company data is being accessed and moved. It makes it easier to identify unusual activity and potential data leaks, and gives us a way to investigate those issues without having to piece everything together manually.

What do you like best about the product?

The real-time visibility into data movement has fundamentally changed how our security team approaches insider threat prevention. What impressed me most is the behavioral analytics engine it doesn't just flag suspicious activity; it surfaces patterns we wouldn't catch manually.

Specific example: One of our customers discovered that a departing employee was systematically downloading customer data files over three weeks. Incydr's timeline view let us see exactly which files, when, and flagged the escalating pattern automatically. That would have taken our customer's team 40+ hours to reconstruct from logs.

Workflow improvement: The customizable alert rules cut our false-positive noise by 70%. Instead of alert fatigue, our analysts now trust the system they know each notification matters. That's freed up 8-10 hours per week for actual threat investigation.

Unexpected benefit: The integration with Slack for incident notifications has been a game-changer for cross-team awareness. Security doesn't work in a vacuum, and having PMs and engineering see threats in real-time creates better buy-in for prevention measures.

Impact: For our customers, this translates to faster incident response and clearer compliance audit trails. For us as a PM, it validates that there's real market demand for accessible, intelligent endpoint security it's becoming table-stakes for enterprise customers.

What do you dislike about the product?

The onboarding and configuration complexity has been our biggest friction point. Getting agents deployed across a heterogeneous environment took longer than expected, and the policy setup requires deep security expertise, our ops team needed multiple escalations to get it right.

Specific example: Rolling out to 500+ endpoints, we had three failed deployment waves because the documentation on group policy templates for our mixed Windows/Mac environment was sparse. We ended up doing a custom scripting pass that should have been templated.

Workflow pain: The reporting interface feels disconnected from the alerting system. Our analysts live in the alerts dashboard, but executives need compliance reports. We're constantly context-switching between two interfaces and manually exporting data to build board-ready summaries. It's added ~5 hours/week of reporting overhead.

Unexpected limitation: Pricing scales aggressively with seat count. We expected per-endpoint licensing, but the cost model hit us hard when scaling from 50 to 500 users. It made the ROI conversation with finance much harder, especially for large enterprises.

What's missing: Better SOAR integration. We're running Jira + Slack for incident workflows, but Incydr's automation hooks are limited. We're writing custom webhooks instead of using native playbooks.

What problems is the product solving and how is that benefiting you?

Problems Incydr solves & benefits we're seeing:

Before: Our security team was operating reactively. We had a SIEM, but insider threat detection was manual analysts reviewing logs after incidents were reported by other departments. We struggled with:

Late detection (threats were often discovered after damage occurred)
No visibility into lateral movement or data exfiltration patterns
Compliance audits required weeks of log reconstruction
Alert fatigue from false positives buried real threats

After implementation:

We deployed Incydr across 800 endpoints and tuned behavioral analytics to our environment. Now we can do:

Detect threats in real-time as they're happening, not after the fact
Automate routine investigations with automated alerting to Slack + Jira
Generate compliance reports in hours instead of weeks pre-built templates handle HIPAA/SOC2 requirements
Reduce analyst time per incident from 6-8 hours to 2-3 hours

Measurable results:

40% reduction in incident response time detection to containment now averages 90 minutes vs. 5+ hours
65% fewer false positives better signal-to-noise ratio lets our team focus on real threats
2 incidents prevented that would have resulted in data loss (caught during the investigation phase)
Compliance audit cycle reduced from 6 weeks to 10 days examiners trust our automated reporting

Strategic benefit: This has shifted our narrative from "We detect breaches after they happen" to "We prevent them." That's a huge differentiator for customer trust.

What do you like best about the product?

What I like most about Incydr is the clear visibility it provides into data activity, along with its ability to quickly surface potential security risks without adding unnecessary complexity.

What do you dislike about the product?

One area that could be improved is offering more customization options for dashboards and alerts. It would also help if certain insights were easier to find and interpret, so day-to-day monitoring can be faster and more straightforward.

What problems is the product solving and how is that benefiting you?

Incydr helps us identify and prevent potential data leaks and insider threats by giving us clear visibility into risky user activity and the movement of sensitive data.

What do you like best about the product?

I appreciate that Incydr provides me with a good visual on the state of our systems. It's intuitive, easy to use, and easy to teach to new team members. It also has a great set of tools. The phishing simulator is particularly interesting as it allows us to see the extent to which a phishing attack has reached our university community. It's quite valuable because it helps map the whole attack.

What do you dislike about the product?

There was a small learning curve when initially setting up Incydr, but it wasn't too difficult and we got there pretty quickly, within a couple of weeks.

What problems is the product solving and how is that benefiting you?

I use Incydr to prevent cybersecurity attacks, get a good visual on our systems' state, and map cybersecurity issues, which is valuable for managing our large university community.

What do you like best about the product?

Honestly, the biggest thing for me is that the alerts aren’t garbage. When it flags something, it’s usually actually worth looking at, instead of being just another false positive I have to close out.

What do you dislike about the product?

The reporting could definitely be better. Pulling data for management takes more clicks than it should, and I wish there were more ways to customize the dashboards so the key information is easier to surface. Pricing also isn’t cheap, especially for a smaller team.

What problems is the product solving and how is that benefiting you?

Our main concern is insider risk,people leaving the company and taking files with them. Before Incydr, we honestly had no visibility into that. Now, when someone gives notice, we can actually see whether they moved anything to personal drives or a USB device before they left. It saves us a ton of guesswork and cuts down on awkward conversations.

What do you like best about the product?

We evaluated Incydr during a [X-week] trial to assess it for insider risk detection at our organization. The core monitoring was genuinely useful — it gave us clear visibility into data movement patterns (USB transfers, cloud uploads, unusual file activity) that we didn't have before, and the risk indicators helped us prioritize what actually needed attention instead of chasing every alert.

What do you dislike about the product?

The trial period felt too short to fully dial in the signal-to-noise ratio. We saw a fair number of alerts that needed manual review before we could tell what was actually risky versus normal file-sharing behavior, and getting the alert thresholds tuned to our environment took more trial and error than expected. Onboarding also could have been smoother — a longer guided ramp-up period would have helped us evaluate the platform more fairly in the time we had.

What problems is the product solving and how is that benefiting you?

Incydr is helping us address insider risk — specifically, understanding when and how sensitive data is moving in ways that could indicate accidental leaks or intentional exfiltration (USB transfers, cloud uploads, unusual file activity). Before the trial, we had limited visibility into this kind of activity across the organization. The benefit was being able to see and prioritize genuinely risky behavior instead of relying on blunt, all-or-nothing restrictions or hoping nothing slipped through unnoticed. Even in a short trial window, it gave us a clearer picture of where our actual exposure was, which is valuable input as we think about whether a longer-term insider risk tool is worth the investment.

What do you like best about the product?

Incydr is really practical and easy to use. I especially like how it provides useful insights and visibility into data security risks, making it easier to identify potential issues and take action quickly. The platform is straightforward, and the information it provides is valuable for improving overall security and protecting sensitive data.

What do you dislike about the product?

The main thing I dislike is that it can take some time to fully understand and navigate all the features. Some areas could be more intuitive, and having clearer guidance or simpler workflows would make the overall experience even better.

What problems is the product solving and how is that benefiting you?

Incydr benefits me by giving me better visibility into data activity and potential security risks. It helps me quickly identify unusual or risky behavior, prioritize issues, and take action before they become bigger problems. This saves time and gives me greater confidence that sensitive information is being protected.

I am using Mimecast Insider Risk Management and Data Protection, and I used it in my previous company for around two to three years.

We are leveraging Mimecast Insider Risk Management and Data Protection for email security, and it is acting as our primary email gateway, through which all our emails are entered. We have all the policies and security configuration implemented on Mimecast Insider Risk Management and Data Protection as our main gateway.

Mimecast Insider Risk Management and Data Protection is an email gateway, so all our email passes through our primary security device. It is used for all the security checks, policy checks, all the block checks, and URL rewriting. Our work mainly revolves around email work such as tracing emails and applying some blocking or remediation configurations.

We are leveraging Mimecast Insider Risk Management and Data Protection for email security, which includes URL sandboxing, URL shorteners, URL sand details, and headers.

Mimecast Insider Risk Management and Data Protection is a very robust and highly reliable gateway. We are very satisfied with its excellency with the anti-spam and URL rewriting feature. We are also leveraging it to stop phishing and malware attempts that our company receives. It has a good capability to deal with day-to-day trends and also has a good interface.

Regarding the best features Mimecast Insider Risk Management and Data Protection offers, it has highly customizable policies. It also has reliable, dynamic rewriting and blocking of URLs. Additionally, it provides instant threat remediation and is very good in identifying impersonation and BEC attacks. We have good admin visibility.

Mimecast Insider Risk Management and Data Protection has impacted our organization positively in several ways. It has good threat remediation and good attachment protection. It also has good impersonation and BEC protection. For our organization, these three are the most critical threat vectors that an attacker can leverage to enter the company. Mimecast Insider Risk Management and Data Protection has good control over these threat vectors. Apart from that, it has a good interface and good integration with other tools.

Regarding improvement for Mimecast Insider Risk Management and Data Protection, I believe there is one area that needs attention: QR code phishing. I can see it is still allowing some emails that have phishing QR codes inside them or some phishing attachments. It needs to slightly improve on the QR-ishing side.

I have been in this field for around six years and am working as a SOC incident responder.

Mimecast Insider Risk Management and Data Protection is stable.

Regarding Mimecast Insider Risk Management and Data Protection's scalability, as we have a public cloud, there should not be an issue with scalability.

Customer support for Mimecast Insider Risk Management and Data Protection is good. I have interacted with them multiple times regarding any kind of ongoing issues, and I can confirm that customer support is good.

I am using only Mimecast Insider Risk Management and Data Protection because I am working in an incident response team where we need to work for different clients. The choice of devices totally depends on what the client is using.

I am not the implementer; Mimecast Insider Risk Management and Data Protection was already there at the customer premises. We learned it, applied it, and used it.

The accuracy of Mimecast Insider Risk Management and Data Protection is good. We do not see any kind of mis-data or misinterpretation. From the accuracy side, I can confirm that it is reliable and there are no issues.

Mimecast Insider Risk Management and Data Protection is time-saving. From the employee perspective, it is neutral. From the security perspective, Mimecast Insider Risk Management and Data Protection is helping in reducing the ongoing threats for the organization.

I am from the incident response team, and regarding pricing and cost, I am not very familiar with this. I cannot comment on the pricing part.

We do not have a business relationship with this vendor other than being a customer.

I will give one piece of advice regarding Mimecast Insider Risk Management and Data Protection: be sure about zero-day attacks because it might be missing in applying any remediation or security controls on any kind of zero-days. This is applicable for all the security equipment we are using on a daily basis. Just be assured if there is a zero-day. I gave this review a rating of 8.

Public Cloud

Amazon Web Services (AWS)