TrendAI Vision One™

My main use case for TrendAI Vision One is for incident triage and response management.

A specific example of how I use it for incident triage and response management is the elimination of collateral display and low log management from emails. This is how it helped.

The automated remediation triggers automated commitment actions, isolating infection of the endpoint. This is beneficial and helps significantly.

The best features TrendAI Vision One offers include the powerful threat hunting and AI security capabilities, among the top features mentioned. The AI security analysis allows input of plain language requests for effective endpoint command analysis. Threat hunting assists in identifying alerts. Additionally, real-time inspection of LLM interactions helps secure operations within private and public environments. The centralized Vision One console hosted in a cloud-native environment also contributes greatly by ensuring robust security coverage.

TrendAI Vision One can improve in control responsiveness, particularly in navigating through heavy analytics interfaces like workbench, where execution graphs can experience noticeable latency. This occurs during multi-complex layers correlation and high volume of queries load. Secondly, I suggest improving license and credit allocation transparency.

A deep ecosystem integration with deeper non-Trend native telemetry ingestion would help significantly.

I have used TrendAI Vision One for almost two years.

TrendAI Vision One is stable.

TrendAI Vision One's scalability is quite good; it benefits from cloud-native elasticity, which I use most often. The centralized Vision One console runs in the cloud-native environment, hosted on a public backbone like AWS and Azure. It is very easy for me to automatically scale based on log flow.

The customer support has been acceptable.

I previously used a different solution, Sophos, but it was too costly and very limited compared to TrendAI Vision One.

I have seen a return on investment financially, with up to a 79% reduction in security costs and a 70% faster incident investigation and response time.

My experience with pricing, setup cost, and licensing has been quite acceptable, especially with the flexibility of having a credit-based licensing architecture by using TrendFlex.

Before choosing TrendAI Vision One, I did not evaluate other options.

My advice to others looking into using TrendAI Vision One is to utilize the powered API connectors, link your SaaS with Office 365 and endpoint security, and evaluate it thoroughly before proceeding. I would rate this product a 10.

My main use case for TrendAI Vision One is security monitoring and threat detection. On a daily basis, I check alerts, investigate suspicious activities, and look into endpoint or network-related incidents. For example, if TrendAI Vision One detects unusual behavior on any endpoint, I review the alert's details, check the related process and activities, and we take the required action or escalate if it is needed.

The best features in TrendAI Vision One that stand out to me are endpoint detections and response, centralized visibility, and detailed alert investigation. I also appreciate the correlations of security events, which makes it easier and simpler to understand the full context of an incident, and it gives better ability to investigate endpoint activity and respond from one platform. This is very useful for our SOC environment.

TrendAI Vision One has positively impacted our organization by making our investigation workflow more efficient and providing better visibility into endpoint activity. We also have related alerts from one platform, which reduces the time spent switching between different tools, allowing me to investigate suspicious activity faster and easier while giving the team more context when deciding whether an incident needs escalation or not.

One area of TrendAI Vision One that could be improved is the alert investigation experience. Some alerts contain a lot of information, so having a simpler way to prioritize the most important details would make the investigation faster. I would also like to see more customization options for dashboards and alert filtering based on our SOC environment.

Better integration with other security tools, especially for teams using multiple SIEM and security platforms such as Wazuh and Splunk, would be useful for TrendAI Vision One. Reporting could also be more flexible, with customizable templates and options to create reports based on specific incidents, alert types, or time periods, making it easier to share investigation results with the wider team.

One smaller improvement I think would be beneficial for TrendAI Vision One is better notification and alert customization, providing more control over which alerts are prioritized or notified to the SOC team based on severity.

I have been using TrendAI Vision One for around one and a half years, utilizing it for security monitoring, investigating alerts, threat detections, and analyzing suspicious activity.

In my experience, TrendAI Vision One has been generally stable for day-to-day SOC operations. I have not personally seen any major or prolonged downtime that affected our organization. There can be occasional delays or minor issues with alert data or console performance, but overall, it has been reliable enough for regular monitoring and incident investigation.

TrendAI Vision One has scaled well with our environment so far. As the number of endpoints and servers increases, we are able to extend coverage without major changes to the SOC workflow. The centralized console also makes it easier to manage and investigate alerts across a large environment, and configuration and tuning become more important as the volume of alerts grows.

I have had limited direct interactions with TrendAI Vision One support since our internal team handles most day-to-day issues. When we needed assistance, the support team was responsive and helped with troubleshooting and product-related questions. Having clear documentation and timely technical guidance is very useful when we face an issue requiring vendor-level support.

Before TrendAI Vision One, we used a combination of endpoint security SIEM tools for monitoring and investigation. We switched to TrendAI Vision One because we wanted more centralized endpoint visibility and better correlation of security events while reducing the need to switch between multiple consoles during investigations. The different solutions we had to use in our environment are Wazuh and SentinelOne Singularity.

From my perspective, the biggest benefit of TrendAI Vision One has been time savings rather than directly reducing headcount or licensing costs. Having centralized visibility and better alert context makes triage and investigation quicker, allowing analysts to spend more time on genuine incidents instead of manually collecting information from different tools. The workflow efficiency has been noticeable, though I do not have a formal ROI figure.

I am not directly involved in commercial negotiations, so I do not have the exact pricing or setup cost for TrendAI Vision One. The licensing is managed by our organization, and from the operational side, deployment and access have been fairly straightforward. For a detailed cost comparison, I would need to rely on our procurement or management team.

Our organization evaluated a few endpoint security and XDR options before selecting TrendAI Vision One. The options included Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne. The evaluation focused mainly on detection capabilities, endpoint visibility, integrations, investigation workflow, and how well the solution would fit with our existing SOC environment.

I rate TrendAI Vision One an eight out of ten.

I chose eight out of ten for TrendAI Vision One because it provides good visibility and makes alert investigation easier for our SOC environment. To make it a ten, I would want to see a more streamlined investigation experience, better customizations for dashboards and reporting, and strong integration with other security tools we use.

In my experience, the AI capabilities of TrendAI Vision One are useful for improving detections and investigation while security and access controls are important for keeping the environment protected. We also value having visibility into why an alert is being raised rather than relying only on AI-generated results. For our SOC workflow, keeping human review as part of the investigation is important.

From my experience, the AI output of TrendAI Vision One has been fairly consistent and useful for the initial investigation. It helps provide context about suspicious activities and prioritize alerts. However, we still validate the findings with available events and logs to the endpoints' details before taking action, since AI results should not be treated as the only source of truth.

We use TrendAI Vision One in a hybrid cloud setup, which gives us centralized visibility through the cloud platform while still allowing us to monitor and protect endpoints and infrastructure in our organization. This works well with our existing SOC environment and security tools.

The cloud provider we primarily use in our hybrid setup for TrendAI Vision One is Microsoft Azure, which is utilized alongside our existing cloud and on-premises security infrastructure, helping us maintain centralized visibility across both environments.

We have mainly used TrendAI Vision One sensors across endpoints and servers. They are deployed on employee workstations and critical servers to provide endpoint visibility and detect suspicious activity, while there is also some coverage for cloud workloads depending on our security environment requirements.

The coverage from TrendAI Vision One is quite critical for our organization because it provides visibility across endpoints and servers, helping us detect suspicious activity earlier and investigate incidents with more context. Without this visibility, some endpoint-level activity could be harder to identify and correlate with other security alerts.

Some of the top security challenges in our industry include phishing, malware, credential-based attacks, endpoint compromise, and the increasing number of security alerts our team needs to investigate. TrendAI Vision One helps us address these by providing endpoint visibility, detecting suspicious behavior, and correlating related activities, making it easier to identify real threats and investigate incidents with useful evidence.

My impression is that TrendAI Vision One provides good centralized visibility across different protection layers, especially endpoints, servers, and related security events. From a SOC perspective, it is very useful to have endpoint telemetry and detection information available in one platform instead of investigating everything separately, which helps us correlate events and understand the wider context of an incident to decide what needs escalation.

TrendAI Vision One has helped reduce silos to some extent by bringing endpoint detection, investigation data, and related security events into a more centralized view. From the SOC side, this means we do not always have to switch between multiple consoles to understand the same incident. We still use other security tools, but TrendAI Vision One helps us connect the information and provide a more complete scenario.

AI capabilities in TrendAI Vision One are quite important for our organization because the SOC team deals with a high volume of alerts every day. It helps us detect, correlate, and prioritize suspicious activity while providing additional context during investigations. It does not replace analyst validation but helps us focus our time on the alerts that need deeper investigation and faster response.

TrendAI Vision One has helped reduce the time spent on initial detection and investigation. I do not have a formally measured percentage, but in daily SOC work, having the alert context, endpoint activity, and related events in one place makes the initial triage noticeably faster, helping us validate suspicious activity and escalate genuine threats without spending much time gathering information from various consoles.

My main use case for TrendAI Vision One is endpoint security, server security, or network security.

For endpoint server security, we have been using it as an essential endpoint security module where we deploy an agent on the client machines and maintain or monitor application control, firewall, anti-malware, spam, web reputation, spam reputation, and other similar capabilities, which is the same for servers including intrusion prevention and detection and response.

Furthermore, for the servers, we use it on-prem and on-cloud, specifically on-prem deep security, which we can migrate and integrate to TrendAI Vision One cloud.

In my experience, one of the best features of TrendAI Vision One is the XDR capability, which involves a centralized console collecting logs from multiple sources, correlating them, and telling us a story.

TrendAI Vision One positively impacts my organization because it is the tool we utilize more than any other cybersecurity-providing tool, as it has a very user-friendly console that I can easily explain to clients, allowing them to understand and carry forward investigations.

For specific outcomes or metrics showcasing how TrendAI Vision One has benefited my organization, it includes playbooks that run on the workbench's correlations, correlating all log sets, pinpointing exact alerts so that the SOC team cannot waste more time and can simply investigate and address them.

An area for improvement for TrendAI Vision One that I notice is on the support side; if any support issues arise or bugs I report can be remediated or addressed more promptly.

Additionally, regarding needed improvements, I pointed out to Trend Micro an issue related to email security, where an inbound protection policy I created, aimed at handling email attachments above a certain size, resulted in all emails being quarantined, and I reported that TrendAI Vision One lacked the capability to adequately manage this.

I have been using TrendAI Vision One for more than five years.

TrendAI Vision One is stable in my experience, but some clients using data centers hosted in the Gulf region, mainly Dubai, face downtime issues.

In terms of scalability, it performs well for endpoints, servers, email, network level, and sandboxing.

I would rate customer support as average, about four out of five. On a scale of one to ten, I would rate customer support an eight.

I have not switched from a different solution since my company provides multiple solutions as per client needs, leveraging various security vendors while finding TrendAI Vision One's features user-friendly and easy to understand.

My advice to others looking into using TrendAI Vision One is that it is very user-friendly and easy to deploy, requiring some firewall rules, and you can deploy an agent to easily access control and investigate.

We are using TrendAI Vision One sensors on endpoints and at the network level as well.

This coverage is critical for my organization's network because the sensors collect XDR telemetry and forward it to the main console, TrendAI Vision One.

I have seen a return on investment, as I can affirm that employees save time dealing with complexities from other products due to TrendAI Vision One's ability to address many issues at the investigation, deployment, and analysis levels.

Regarding my experience with pricing, setup cost, and licensing, I am uncertain about the exact price but note that TrendAI Vision One has shifted to a credit-based license model allowing flexible use across solutions.

Before choosing TrendAI Vision One, we evaluated other options including Kaspersky for endpoint security and FortiGate EDR.

The governance and security of TrendAI Vision One's AI capabilities are actually good; I notice it provides alerts regarding exposure management and threats, along with compliance scores, overall scores, and risk scores to help mitigate and address concerns.

In our industry, the top security challenges include securing endpoints against ransomware and malware attacks, which TrendAI Vision One covers well, along with email security.

My impressions of TrendAI Vision One's ability to provide centralized visibility and management across protection layers are very good, as it collects data from all products and resources, correlating it to tell a cohesive story.

TrendAI Vision One helps consolidate our use of security vendors and reduces silos, covering key areas such as endpoint encryption, compliance, and vulnerabilities, which I validate and remediate.

The importance of TrendAI Vision One having AI built into its platform is high, as it helps explain alerts, attack phases, and process chains with ease. I would rate this review as eight out of ten.

TrendAI Vision One is used primarily in endpoint security, email security, mobile security, cyber risk exposure management, and XDR.

For mobile security, TrendAI Vision One is used for mobile threat detection as an MTD solution, and it allows enrollment of both BYOD devices and company-owned devices while providing protection for mobile devices. The solution supports Android, iOS, and similar platforms.

My main use case for TrendAI Vision One is endpoint security, and I am also familiar with mobile security. TrendAI Vision One functions as a full-fledged next-generational antivirus solution for users, and it prevents malware, viruses, and similar threats. The solution has many machine learning features as well.

The best feature in my experience with TrendAI Vision One is that when implementing endpoint security and email security for an organization, there is no need to use multiple consoles. With TrendAI Vision One, a single console provides access to all these solutions, making it a comprehensive platform that includes all of the solutions. This consolidated approach is the main usefulness for users.

TrendAI Vision One can integrate with third-party solutions as well. Regarding usability, I credit TrendAI Vision One since it uses a credit-based model. Additionally, the licensing for TrendAI Vision One is very flexible for users and organizations.

TrendAI Vision One is a full-fledged platform for combining multiple solutions, making it easy for administrators to navigate and configure the console. It provides comprehensive security for devices and users, and the flexible licensing is very useful for organizations.

Regarding the platform's ability to provide centralized visibility and management across protection layers, the centralized visibility is really helpful for administrators to configure settings without having to navigate multiple consoles. This streamlines issue resolution and ensures that protection is covered from multiple aspects within the same console.

TrendAI Vision One has helped consolidate the use of security vendors and reduced silos significantly.

TrendAI Vision One has recently added updates and new features, which can be a bit confusing. However, those features are helpful but not organized clearly. When an administrator logs into the console, it can be difficult to find some features because of the organization.

Regarding documentation improvements for TrendAI Vision One, it would be easier with the TrendAI companion. Most of the documentation and answers can be found, but it would be helpful if the company could provide more data sheets or whitepapers as well as configuration support.

Additional improvements needed for TrendAI Vision One include issues where the console sometimes indicates that services are not available. I believe these issues are being improved, but they do not constantly display as expected.

I have been using TrendAI Vision One for more than one and a half years.

TrendAI Vision One provides more security for users regarding detections and security incidents, such as warnings on unsecured websites and detecting viruses. The solution has really reduced the number of detections over time while providing full protection for users.

The top security challenge in the industry is user awareness since users are often unaware of the dangers posed by certain applications and websites. TrendAI Vision One helps address this issue by providing user awareness training, such as phishing campaigns that inform users to avoid threats.

My main advice for others considering TrendAI Vision One is that it provides both basic and advanced protection for every user, while the licensing is very flexible compared to other solutions. With TrendAI Vision One, most features are included in basic licensing, unlike other solutions that require payment for simple features.

TrendAI Vision One is a great solution for users requiring advanced protection. Over the past 20 years, it has provided as many features as possible for every user, so I can confidently recommend it for organizations. I would rate this solution an 8 out of 10.

The main use case for TrendAI Vision One in my organization is that we manage client assets such as endpoints, servers, and email.

TrendAI Vision One has positively impacted my organization. TrendAI Vision One has helped us reduce the time to detect and respond to threats, as with the correlation of events across various security layers, I benefit from a complete view of incidents from a single platform without the need to jump around.

The investigation and alert prioritization tools expedite analysis significantly, automating many detection and containment tasks even before the analyst reviews the event viewer.

I think there are quite a few things that could improve TrendAI Vision One. The console or the graphical interface of the console is a bit complex, with several sections for each module where information is spread out among them and some is repeated across sections. Console updates change the layout of sections and modules significantly, without any notice or alert informing me of these changes. The APIs section is also a bit confusing, as I understand there is a general API, but then each module has its own, and it is not very well explained when to use one or the other.

Vendor support can feel random; depending on who you get, resolving an incident can be easy or very difficult. Some support members do not have sufficient knowledge about the platform or the relevant concepts, and response times can be very variable—sometimes they can respond the next day or it can take a week. If it is a serious incident, you might be stuck for the entire week. Report generation is a bit basic; the reports are simple and I cannot customize them effectively. Licensing is also confusing because we seem to have the same license duplicated with similar functionality for different teams, which is not clearly reflected.

At the Endpoint Security level, the agents being used in TrendAI Vision One have several problems; we frequently encounter incidents where the agent consumes resources uncontrollably. Many servers or endpoints can manage this easily, but some have limited resources and processing power. It often interferes with the company's internal processes, creating delays, communication issues, and data loss, forcing us to disable modules on machines. Furthermore, support for different operating systems is limited; many clients use devices with older, unsupported operating systems, resulting in fewer modules being available.

At the Cloud level, I also experience several issues with Cloud Email Gateway Protection in TrendAI Vision One, such as problems with DKIM validation where the platform often fails to provide clear information on whether the cause is a poorly made signature or DNS resolution failures; sometimes the header indicates the absence of a DKIM signature when there actually is one. Additionally, the API for Cloud Email Gateway Protection has limitations, such as a 72-hour log retrieval limit that feels excessive. I also cannot filter mail traffic by user or specific address and must retrieve the entire domain's data. This means pulling in around 300,000 emails for a 24-hour period only to filter it myself, which consumes resources and time. Certain functions are available in the console but not through the API, which I find critical. Lastly, we have faced issues where emails that should bypass Inbound Protection based on our defined rules still get blocked, which does not make much sense.

I have been using TrendAI Vision One for one year and five months.

Overall, it has proven to be a pretty stable platform. The main services, dashboards, APIs, and security modules generally provide consistent availability and performance. Of course the are some occasional issues, specially during maintenance, service updates, or when processing a high volume of data, but these don't significantly affected the overall reliability of the platform in our experience.

It offers a very strong scalability, particularly for enterprise environments with a large number of users, endpoints, and security events. The platform also provides a centralized visibility of the security layers and products, which makes it really easy to manage a growin environment without increasing the operational complexity.

4

No

I didn't took part on that process

I didn't took part on that process

We have, but I can't share any data

I didn't took part on that process

I didn't took part on that process

The features of TrendAI Vision One are really useful and have improved my work. The main security challenges in my sector include managing diverse threats. I have covered everything I had to say and do not remember anything else important that I have left out. My review rating for TrendAI Vision One is 8.

TrendAI Vision One has helped my customers consolidate their use of security vendors and reduce silos. If you purchase multiple technologies or products provided by TrendAI, that unified visibility console gives you full visibility across all the products provided by TrendAI across the network. This facilitates management and policy deployment for customers.

My customers do not purchase TrendAI Vision One directly from TrendAI or from any third party. TrendAI is not considering selling directly to end users unless it is a big corporate arrangement or an OEM agreement. Usually, sales should occur through a reseller, then a distributor, or directly through a distributor to TrendAI.

User behavior analysis is the most important feature of TrendAI Vision One, in addition to the zero-day feature within that application. When customers upsell or add an XDR license, the product becomes a closed, solid endpoint protection solution that wins against the competition.

TrendAI Vision One has helped my customers consolidate their use of security vendors and reduce silos. If you purchase multiple technologies or products provided by TrendAI, that unified visibility console gives you full visibility across all the products provided by TrendAI across the network. This facilitates management and policy deployment for customers.

TrendAI Vision One should learn from its competitors that having everything managed in one single platform gives strength to the product itself. However, instead of focusing on easing access for administrators, they should pay more attention to development itself and staying up to date. There was an initiative in the early days called Zero-Day, which means that before a threat is announced, they would hire specialists who immediately learn about threats and push updates directly to the product.

Customers are protected even before the threat is announced. Currently, the Zero-Day initiative is not as active as it once was.

Additional features I expect from TrendAI Vision One in the future to make it more competitive could be more technical in nature. A product working on the kernel level of a PC, machine, or server consumes significantly more resources than other products that work on runtime memory. If an application is attached to the operating system of the machine itself, it consumes more resources from the PC or server than running that product on the memory level. Memory-level products read all running activities across the memory when the machine is on, and when they detect malicious activity, they cut or end the session, which is lighter on the operating system and does not consume many resources.

I have been working with TrendAI Vision One for around five years.

TrendAI Vision One's technical support is adequate because they recently implemented a good methodology of supporting their customers. They initiated a Major Service Center divided across the globe, with a dedicated support center for the Middle East, another for Europe, a third one in the American market, and a final one in Singapore dedicated to supporting Far East customers. This has enhanced their support.

What gives more strength to their products is that they enable business partners, distributors, resellers, and others with sufficient tools to identify problems and provide first and second level support themselves. When an engineering intervention is needed, the case can be escalated to their support team, which is more effective than the old model. They initiated this Major Service Center two or three years ago, which makes it easier for customers and enhances support.

My impressions of TrendAI's ability to provide centralized visibility and management across protection layers are positive. They had, in the early beginning, a unified management console called Apex One. The commercial name has changed over time, and it is now called Apex Central. TrendAI Vision One Apex Central gives full visibility across the customer network, including all solutions provided by TrendAI, with unified visibility, policy deployment, and plug-in extensibility.

TrendAI Vision One has helped my customers reduce their time to detect and respond to threats. There have been a few incidents where intruders could get into the network even while the product was deployed. TrendAI ranks third globally as an endpoint or EDR solution. There are pros and cons to the product. I would rate TrendAI Vision One between seven and eight out of ten.

My customers may use the Cyber Risk Exposure Management capabilities of TrendAI Vision One. However, I do not think they are using or activating that feature because it can conflict with other products. Most banking customers prefer not to activate EDR and endpoint protection from the same vendor, as a compromise could become a significant issue. Therefore, I did not use this feature.