Incydr

What do you like best about the product?

I appreciate that Incydr provides me with a good visual on the state of our systems. It's intuitive, easy to use, and easy to teach to new team members. It also has a great set of tools. The phishing simulator is particularly interesting as it allows us to see the extent to which a phishing attack has reached our university community. It's quite valuable because it helps map the whole attack.

What do you dislike about the product?

There was a small learning curve when initially setting up Incydr, but it wasn't too difficult and we got there pretty quickly, within a couple of weeks.

What problems is the product solving and how is that benefiting you?

I use Incydr to prevent cybersecurity attacks, get a good visual on our systems' state, and map cybersecurity issues, which is valuable for managing our large university community.

What do you like best about the product?

Honestly, the biggest thing for me is that the alerts aren’t garbage. When it flags something, it’s usually actually worth looking at, instead of being just another false positive I have to close out.

What do you dislike about the product?

The reporting could definitely be better. Pulling data for management takes more clicks than it should, and I wish there were more ways to customize the dashboards so the key information is easier to surface. Pricing also isn’t cheap, especially for a smaller team.

What problems is the product solving and how is that benefiting you?

Our main concern is insider risk,people leaving the company and taking files with them. Before Incydr, we honestly had no visibility into that. Now, when someone gives notice, we can actually see whether they moved anything to personal drives or a USB device before they left. It saves us a ton of guesswork and cuts down on awkward conversations.

What do you like best about the product?

We evaluated Incydr during a [X-week] trial to assess it for insider risk detection at our organization. The core monitoring was genuinely useful — it gave us clear visibility into data movement patterns (USB transfers, cloud uploads, unusual file activity) that we didn't have before, and the risk indicators helped us prioritize what actually needed attention instead of chasing every alert.

What do you dislike about the product?

The trial period felt too short to fully dial in the signal-to-noise ratio. We saw a fair number of alerts that needed manual review before we could tell what was actually risky versus normal file-sharing behavior, and getting the alert thresholds tuned to our environment took more trial and error than expected. Onboarding also could have been smoother — a longer guided ramp-up period would have helped us evaluate the platform more fairly in the time we had.

What problems is the product solving and how is that benefiting you?

Incydr is helping us address insider risk — specifically, understanding when and how sensitive data is moving in ways that could indicate accidental leaks or intentional exfiltration (USB transfers, cloud uploads, unusual file activity). Before the trial, we had limited visibility into this kind of activity across the organization. The benefit was being able to see and prioritize genuinely risky behavior instead of relying on blunt, all-or-nothing restrictions or hoping nothing slipped through unnoticed. Even in a short trial window, it gave us a clearer picture of where our actual exposure was, which is valuable input as we think about whether a longer-term insider risk tool is worth the investment.

What do you like best about the product?

Incydr is really practical and easy to use. I especially like how it provides useful insights and visibility into data security risks, making it easier to identify potential issues and take action quickly. The platform is straightforward, and the information it provides is valuable for improving overall security and protecting sensitive data.

What do you dislike about the product?

The main thing I dislike is that it can take some time to fully understand and navigate all the features. Some areas could be more intuitive, and having clearer guidance or simpler workflows would make the overall experience even better.

What problems is the product solving and how is that benefiting you?

Incydr benefits me by giving me better visibility into data activity and potential security risks. It helps me quickly identify unusual or risky behavior, prioritize issues, and take action before they become bigger problems. This saves time and gives me greater confidence that sensitive information is being protected.

I am using Mimecast Insider Risk Management and Data Protection, and I used it in my previous company for around two to three years.

We are leveraging Mimecast Insider Risk Management and Data Protection for email security, and it is acting as our primary email gateway, through which all our emails are entered. We have all the policies and security configuration implemented on Mimecast Insider Risk Management and Data Protection as our main gateway.

Mimecast Insider Risk Management and Data Protection is an email gateway, so all our email passes through our primary security device. It is used for all the security checks, policy checks, all the block checks, and URL rewriting. Our work mainly revolves around email work such as tracing emails and applying some blocking or remediation configurations.

We are leveraging Mimecast Insider Risk Management and Data Protection for email security, which includes URL sandboxing, URL shorteners, URL sand details, and headers.

Mimecast Insider Risk Management and Data Protection is a very robust and highly reliable gateway. We are very satisfied with its excellency with the anti-spam and URL rewriting feature. We are also leveraging it to stop phishing and malware attempts that our company receives. It has a good capability to deal with day-to-day trends and also has a good interface.

Regarding the best features Mimecast Insider Risk Management and Data Protection offers, it has highly customizable policies. It also has reliable, dynamic rewriting and blocking of URLs. Additionally, it provides instant threat remediation and is very good in identifying impersonation and BEC attacks. We have good admin visibility.

Mimecast Insider Risk Management and Data Protection has impacted our organization positively in several ways. It has good threat remediation and good attachment protection. It also has good impersonation and BEC protection. For our organization, these three are the most critical threat vectors that an attacker can leverage to enter the company. Mimecast Insider Risk Management and Data Protection has good control over these threat vectors. Apart from that, it has a good interface and good integration with other tools.

Regarding improvement for Mimecast Insider Risk Management and Data Protection, I believe there is one area that needs attention: QR code phishing. I can see it is still allowing some emails that have phishing QR codes inside them or some phishing attachments. It needs to slightly improve on the QR-ishing side.

I have been in this field for around six years and am working as a SOC incident responder.

Mimecast Insider Risk Management and Data Protection is stable.

Regarding Mimecast Insider Risk Management and Data Protection's scalability, as we have a public cloud, there should not be an issue with scalability.

Customer support for Mimecast Insider Risk Management and Data Protection is good. I have interacted with them multiple times regarding any kind of ongoing issues, and I can confirm that customer support is good.

I am using only Mimecast Insider Risk Management and Data Protection because I am working in an incident response team where we need to work for different clients. The choice of devices totally depends on what the client is using.

I am not the implementer; Mimecast Insider Risk Management and Data Protection was already there at the customer premises. We learned it, applied it, and used it.

The accuracy of Mimecast Insider Risk Management and Data Protection is good. We do not see any kind of mis-data or misinterpretation. From the accuracy side, I can confirm that it is reliable and there are no issues.

Mimecast Insider Risk Management and Data Protection is time-saving. From the employee perspective, it is neutral. From the security perspective, Mimecast Insider Risk Management and Data Protection is helping in reducing the ongoing threats for the organization.

I am from the incident response team, and regarding pricing and cost, I am not very familiar with this. I cannot comment on the pricing part.

We do not have a business relationship with this vendor other than being a customer.

I will give one piece of advice regarding Mimecast Insider Risk Management and Data Protection: be sure about zero-day attacks because it might be missing in applying any remediation or security controls on any kind of zero-days. This is applicable for all the security equipment we are using on a daily basis. Just be assured if there is a zero-day. I gave this review a rating of 8.

Public Cloud

Amazon Web Services (AWS)

I use Mimecast Insider Risk Management and Data Protection primarily to identify and investigate risky user behavior involving sensitive information, whether the action is malicious, negligent, or compromised. The goal is to detect situations where employees, contractors, or privileged users may be exposing company data before it becomes a breach.

A typical use case would include email forwarding by an employee containing confidential information to their personal accounts. Another example is a large or unusual amount of downloads of sensitive data just before a user is either terminated or they resign. Additionally, I monitor sharing of any company IP data, customer data, or financial information such as PII or PCI information, which is regulated data not supposed to be outside the organization.

I also use it to detect compromised accounts that are behaving differently from normal user accounts. We also use it to support HR with security investigations based on support tickets that come up when they feel that something appears malicious or they report something that seems malicious.

There was one example where an employee who had recently submitted their resignation began forwarding documents they created with the company to their personal email ID so that they could use those as templates with the new organization they would join. The problem was that they did not realize that all of our documents have the company's digital signature and the company's logo on them. They were trying to exfiltrate data which they had created while they were employed with us, which got flagged.

Another instance occurred when we had a compromised mailbox where an attacker gained access through credential theft. Mimecast Insider Risk Management and Data Protection identified unusual outbound email activity and anomalous user behavior that did not match the employee's normal patterns of how they would send emails. This helped us contain that account and prevent sensitive information from being shared externally.

The best features of Mimecast Insider Risk Management and Data Protection are, first, the ability to catch anomalous behavior. We did not know we had a compromised account until the user behavior was tracked, especially because the user in question was on leave and themselves were not actively looking at their email accounts to realize that their account had been compromised. This was one of the best features where it caught onto pattern recognition.

Secondly, it is heavily useful for creating DLP-aided rules where it ensures that our data protection policies kick in by scanning documents and figuring out what documents should actually leave the company and what should not. It added a second guard rail layer other than our Purview DLP, which enabled us with a second form factor for checking that no sensitive information is going outside the company.

It has been an enabling tool where it has enabled us to not be actively involved with going through emails and understanding user behavior to sit and determine what kind of user behavioral metrics we should be looking at to catch threat vectors. This has been really valuable where it is able to automate that entire process. The AI layers ensure that we have an end-to-end clarity on what is happening, and the way they enrich our data set in terms of the classifications they provide for why they have flagged it for DLP add value to what they actually do.

Improvement-wise, just because I have other clients who use Abnormal and Material Security, I can say Mimecast Insider Risk Management and Data Protection's dashboard is not that user-appealing, where someone would actually go through their dashboard and figure out metrics. Additionally, navigating their platform is not the top product. These are things they could improve on and that would add really value.

I have been using Mimecast Insider Risk Management and Data Protection for around four and a half years. It started with CWG, but I am currently using it as a client.

Mimecast Insider Risk Management and Data Protection is pretty scalable, especially the way it is deployed.

They have a really good response time. The mean time to detect to mean time to respond from their end is somewhere between 15 minutes to 20 minutes. I would rate the customer support a 10.

We were using Trend Micro and the client wanted us to move away from it.

Two things stand out: money saved and time saved. We were always a smaller team, but time saved and money saved is where I can provide ROI. I would say somewhere around 5% ROI. In terms of the time complexity saved, probably around a day of an analyst looking at data has turned into only 15 minutes of the analyst looking at data.

It is not caught something per se that Purview DLP missed, but because Purview DLP is set in a way where we go into the portal and we look at alerts as compared to getting actively notified for it, we tend to not get to it until a certain point of the day when we open and go through those tickets, which leads us to look at DLP related emails. That said, Mimecast Insider Risk Management and Data Protection did catch onto that in parallel to Purview, and it immediately notified us of it. That is where I would say it had the edge over Purview, just because we have not configured Purview in a way where we have active notification set up.

Fewer incidents in terms of actual exploits going through as compared to detections stand out. We still get a lot of detections, but that is the best feature, where it is making sure those do not come through. It is keeping domain knowledge of which domain should be blocked because they are carrying malicious payloads. Another thing that got us was that it has the ability to check that even if some vendor has been marked safe, it still goes through vendor behavior as well. It has an understanding of how a vendor communicates with us. Because of that, it is able to catch onto some alerts which would have gotten missed otherwise.

I would rate Mimecast Insider Risk Management and Data Protection around an eight. The dashboard is the only piece that would take it to a 10. I would recommend people to take the product based on what their needs are and what their budget requirements are, because that is what finally comes down to getting this product. My overall review rating for this product is 8.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Mimecast Insider Risk Management and Data Protection includes blacklisting the domain, privacy suppression, creating new groups, creating new rules, checking the domain, checking the conflict of the mails, and managing spam mails.

In my current organization, we receive a lot of spam mails and phishing mails, so we blacklist the domain name by going into Mimecast Insider Risk Management and Data Protection, accessing the privacy suppression feature, and adding that domain. Once we add that domain, it is blacklisted, and we will not receive any mails from that particular domain in our tenant.

Whenever unwanted mail is sent to our tenant, we receive a ticket to action, which involves going into Mimecast Insider Risk Management and Data Protection to blacklist the domain or add it to privacy suppression.

The best feature of Mimecast Insider Risk Management and Data Protection is that once I add the domains to be blacklisted or create an exclusion list or add domains in the privacy suppression, I never receive mails from similar domains, which safeguards our tenant effectively. Additionally, we can whitelist specific users from blacklisted domains, which is a great and helpful feature.

The flexibility of Mimecast Insider Risk Management and Data Protection helps my organization by ensuring we do not receive mails from unwanted domains that often carry fraudulent offers or phishing attempts, like those with fake domain names. If we have blacklisted a domain but need to receive mail from a particular user, we add that user's email ID to the allowed user list.

Mimecast Insider Risk Management and Data Protection handles incident response effectively by integrating with our ticketing system, allowing for timely action when unwanted mails are received. It integrates well with other security tools like CrowdStrike, SentinelOne, and Microsoft Defender, providing in-depth insights while safeguarding against unwanted and suspicious mails.

Everything in Mimecast Insider Risk Management and Data Protection is good, and nothing requires improvement. However, I would suggest adding features like AI and automation, as this application is used by various teams, and automating processes like blacklisting unwanted email domains could greatly benefit users and customers.

Mimecast Insider Risk Management and Data Protection should provide the flexibility to customize the application features based on the company's needs.

I have been using Mimecast Insider Risk Management and Data Protection for four years.

Mimecast Insider Risk Management and Data Protection is stable.

I would rate the scalability of Mimecast Insider Risk Management and Data Protection around 9.5, as it is highly scalable and widely used by many organizations, including large enterprises.

The customer support for Mimecast Insider Risk Management and Data Protection is really good. I would rate the customer support a perfect 10.

I have never used a different solution; we have always been with Mimecast Insider Risk Management and Data Protection. Before choosing Mimecast Insider Risk Management and Data Protection, we evaluated options such as Defender and Sophos, but found Mimecast Insider Risk Management and Data Protection to be the best.

Integrating Mimecast Insider Risk Management and Data Protection with our existing systems was really easy and not difficult at all.

While I cannot quantify savings in money, Mimecast Insider Risk Management and Data Protection has significantly saved time and enhanced our environment's security from attacks and threats.

I find the pricing, setup cost, and licensing of Mimecast Insider Risk Management and Data Protection to be reasonable; it is not overly high or low, given the quality of service and customer support provided.

Mimecast Insider Risk Management and Data Protection is useful and beneficial for securing the environment and matching compliance policies, making it worth buying the license.

I find Mimecast Insider Risk Management and Data Protection to be a great application that safeguards the complete tenant and manages mail flow smoothly. Over the past four years of using this application, I have never encountered any conflicts between the mailing services and Mimecast Insider Risk Management and Data Protection, making it an excellent choice for security and threat intelligence.

Mimecast Insider Risk Management and Data Protection has positively impacted my organization by protecting us from a lot of unwanted spam and phishing mails, as users are often unaware of what to click on in emails. It has helped safeguard our complete tenant from these types of threats.

Since using Mimecast Insider Risk Management and Data Protection, the unwanted mails for our tenant have decreased by 95% compared to before we migrated to this application.

Currently, I work in a production company, and it is very useful in day-to-day life, such as blacklisting domains and safeguarding our tenant and users from spam mails, phishing mails, and vulnerability management. It quarantines unwanted mails quickly and easily, providing safety and protection from threat attacks.

Mimecast Insider Risk Management and Data Protection integrates well with other security tools like CrowdStrike, SentinelOne, and Microsoft Defender, providing in-depth insights while safeguarding against unwanted and suspicious mails.

I would rate Mimecast Insider Risk Management and Data Protection a nine out of ten.

Hybrid Cloud

Amazon Web Services (AWS)