Comodo Advanced Endpoint Protection - Detailed Review

Comodo Advanced Endpoint Protection (AEP)

Comodo Advanced Endpoint Protection (AEP) is a comprehensive security solution that integrates multiple technologies, including AI, to protect endpoint devices from various threats. Here are the key features and how they work:

Default Deny Technology

Comodo AEP operates on a Default Deny principle, which means it does not trust any file by default. Instead, it contains and analyzes unknown files in a virtual container before allowing them to run on the endpoint. This prevents unknown threats from executing and causing harm.

Auto-Containment

The Auto-Containment feature automatically isolates suspicious and unknown files in a sandbox environment. Here, the files are executed and analyzed without being given write access to critical system components. This ensures that even if a file is malicious, it cannot cause damage to the system until it is verified as safe.

Valkyrie File Analytics

Valkyrie is an AI-powered file analytics platform that analyzes files in the cloud. It uses machine learning and human expert analysis to determine whether a file is malicious. Valkyrie examines the file’s payload, functions, and activities, providing zero-day protection against rapidly spreading attacks. This process typically takes 45 seconds, ensuring minimal disruption to user productivity.

Cloud-Based IT and Security Manager (ITSM)

ITSM is a cloud-based console that unifies the management of Comodo products and endpoints across an enterprise. It allows administrators to enforce security rules and policies, monitor device status, and manage various aspects of endpoint security. ITSM also provides detailed information on device and application status, helping in system audits and forensic analysis.

Fileless Malware Defense

Comodo AEP includes a defense system against fileless malware, which targets computer memory and registry to evade detection. The Host Intrusion Prevention System (HIPS) monitors computer memory and registry for unauthorized modifications, ensuring these areas remain secure. This feature also protects against keyloggers and other types of spyware.

Network Traffic Filtering and Monitoring

The solution filters network traffic and monitors data transmission on endpoint devices to detect and prevent sophisticated attacks, including spear phishing and drive-by downloads. This ensures that endpoints are protected from both inbound and outbound threats.

Compliance and Reporting

Comodo AEP provides comprehensive reporting, including the APT Assessment Scan, which evaluates the likelihood of Advanced Persistent Threats (APTs) impacting endpoints. These reports help administrators maintain compliance and stay informed about the security posture of their endpoints.

Endpoint Management

The Endpoint Manager allows administrators to manage all endpoint devices remotely. It provides a customizable dashboard where administrators can view and manage various security aspects, such as antivirus status, application status, and device compliance. This centralized management simplifies the task of maintaining endpoint security.

Zero Trust Architecture

Comodo AEP adheres to a Zero Trust Architecture, where 100% of unknown files are verified before being allowed to run. This approach ensures that endpoints are protected against all unknown threats without impacting user productivity. The combination of machine learning and human expert analysis provides trusted verdicts on file safety.

Conclusion

In summary, Comodo Advanced Endpoint Protection leverages AI through Valkyrie to analyze files, Default Deny technology to contain unknown threats, and a comprehensive management console to ensure holistic endpoint security. These features work together to provide robust protection against various types of malware, including fileless malware and APTs, while maintaining user productivity.