The cost of displacement-is the grass greener on the other side moving form Check Point to Palo Alto Network - is it worth it?

1. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
1
IS THE GRASS GREENER ON THE OTHER SIDE?
The Cost of Displacement
AFTER EVALUATING
NEWER ALTERNATIVES,
SWITCHING SECURITY
VENDORS OFTEN SEEMS
ATTRACTIVE – ONE
CUSTOMER SHARES
THEIR EXPERIENCE
IN SOME CASES, LIKE
THE CASE STUDY
BELOW, CUSTOMERS
MAKE THE BIG SHIFT
ONLY TO FIND OUT THAT
THE “GRASS ON THE
OTHER SIDE ONLY
LOOKS GREENER”
Today’s ever-dynamic security market is highly competitive with
vendors constantly looking for opportunities to increase their
market share. Chief Security Officers (CSO) and security
administrators often evaluate new products and technologies,
and at the same time are being bombarded with marketing tactics
from sales representatives.
Embellished marketing and sales statements often distract
potential customers from a full review the relevant specifications
and detailed analysis of all the facts. IT Security decisions
influenced by these distractions can have a negative long-term
effect on a business. Switching from one security vendor to
another can be costly, and potentially may compromise security
and business assets. All information should be considered before
making a switch. In some cases though, like the case study
below, customers make the big shift only to find out that the
“grass on the other side only looks greener”.
Customers typically decide to switch vendors for one of
these three common reasons:
 Product Quality or Support Issues with Current Vendor –
Unresponsive support teams, time-consuming upgrades, and
performance and stability issues can cause customers to
search for a new solution.
Belief that a Newer Product is Superior – New is not
always better, but misleading marketing tactics can cause
customers to switch without fully comparing or testing
security and functionality.
 Attractive pricing, for an otherwise inferior product – Many
vendors lure customers with attractive initial pricing and the
promise of a cheaper solution.

2. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
2
Customer case study
One of the world’s leading online e-commerce companies was a
long time Check Point customer with a large install base, including
Multi-Domain Manager (MDM) and more than seventy clusters.
This particular customer experienced a few issues, including:
AFTER WORKING WITH
PALO ALTO FOR SOME
TIME, THE CUSTOMER
STARTED TO
EXPERIENCE MANY
ISSUES
COMPLAINTS INCLUDED:
 APPLIANCE UNDER
SIZING
 POOR OPERATIONAL
EFFICIENCY
 MANAGEMENT LABOR
INCREASES
 EXCESSIVE DELAYS IN
BUG FIXES
 Complicated Upgrades – With many complications during
and after software upgrades, there were many support-
initiated upgrades to fix existing issues.
 High Cost of Support – The customer felt Check Point’s
highest level of support, the Diamond support team, was
inconsistent in solving some complex issues.
 Cost of Ownership – The customer didn’t feel that the
product was delivering value relative to the cost
o Request for new features were often delayed /
not implemented
o High pricing of licenses and support renewal with
minimal discounts
In 2010, the customer decided to replace Check Point and made the
move to Palo Alto Networks (PAN). For a while, all was well. After
working with PAN for some time however, they started to
experience several issues affecting their return on investment.
Complaints included:
 Appliance under sizing resulting in a need for additional
purchases or accepting lower performance
 Poor operational efficiency, impacting costs and timely
deployment of policy updates
 Need for additional management oversight
 Long delays for bug fixing

3. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
3
Appliance under sizing
The customer found that PAN’s expensive solution and relatively
narrow appliance range required them to undersize their
appliances, whereas Check Point’s wide range of appliances was
able to better fit nearly all their performance needs.
PALO ALTO’S EXPENSIVE
SOLUTION AND NARROW
APPLIANCE RANGE
REQUIRED THE
CUSTOMER TO
UNDERSIZE THEIR
APPLIANCES IN
COMPARISON TO
CHECK POINT
The image above shows a comparison of Palo Alto’s Appliance
portfolio versus comparable Check Point products based on the
various performance requirements that organizations look for.
With eight different series, Check Point has a broader range of
appliances covering more performance requirements than Palo
Alto Networks (PAN).

4. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
4
PAN’S POLICY
CONFIGURATION IS
CUMBERSOME
CHECK POINT:
CUSTOMER JUST TYPES
THE SIGNATURE NAME IN
THE SEARCH FIELD AND
RIGHT CLICKS ON IT
PALO ALTO NETWORKS:
THE CUSTOMER MUST
MANUALLY FIND IPS AND
ANTI-VIRUS SIGNATURE ID
OUT OF THOUSANDS OF
SIGNATURES FROM
SECURITY THREAT LOGS.
Operational Efficiency
Although managed from a visually appealing Web User
Interface (WebUI), PAN’s security policy configuration is
very cumbersome. With Check Point, adding IPS and antivirus
exceptions is as easy as typing the signature name and
clicking it. However, with PAN the customer must manually
find IPS and anti-virus signatures out of thousands of
signatures from security threat logs.
Check Point IPS/AV signature exception & deactivation
PAN IPS/AV signature exception
Source: Palo Alto Networks Web Interface Reference Guide Version 7.0

5. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
5
Management Labor Time
Multiple management issues compromised the customer’s business
processes. When dealing with Palo Alto’s Panorama management,
the customer complained about many bugs, causing the loss of
policy changes as well as duplicating and extending labor time for
security administrators trying to work with the solution.
A good security management solution efficiently manages the
business security flow. Check Point is considered by Gartner to
be the “security management ‘gold standard’ against which other
management consoles are measured”*. In addition, our central
unified management system decreases labor time in day-to-day
management**,resulting in fewer FTE (Full Time Employment)
headcount to manage similar configurations.
WHEN DEALING WITH
PALO ALTO’S PANORAMA
MANAGEMENT, THE
CUSTOMER COMPLAINED
ABOUT MANY BUGS
CAUSING LOSS OF POLICY
CHANGES
* Gartner - Magic quadrant for Enterprise Firewalls 2014
** NSS Labs - Next Generation Firewall Comparative Analysis 2013

6. ©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content
6
Long delays in resolving bugs
THE CUSTOMER
COMPLAINED OF PALO
ALTO NETWORK’S VERY
SLOW RESPONSE TO BUG
FIXES, WHICH IN SOME
CASES TOOK MORE THAN
2 YEARS TO CLOSE
THE CUSTOMER HAS
SHARED THIS
INFORMATION AND IS IN
THE PROCESS OF
EVALUATING OPTIONS
INCLUDING MOVING BACK
TO CHECK POINT
Bugs and support cases submitted by premium customers
should get the maximum attention. This customer was highly
frustrated by PAN’s very slow response to bugs, with fixes
spanning more than 2 years in some instances, as shown
below. Support issues, which initially made the customer
displace Check Point, proved to be far worse with Palo Alto
Networks.
Snippet from Palo Alto Support Case shows it took 2 years to fix a software bug
Conclusions and lessons learned
Keeping your business secure is critical. Before switching security
vendors, one should consider all costs, management labor time,
ease of use, support commitment, and the range of possible
outcomes. This unfortunate chain of events taught us, and our
customer, many important lessons. We are excited to have this
customer once again working with us, and Check Point is striving to
constantly improve and evolve. In the case of this customer, upgrade
procedures and product stability has improved dramatically in the
last few years. Specifically, we are giving more attention to support
involvement and response time for our critical customers. We know
that we cannot just be the leading security vendor in the market…
we must make sure our customers are not simply satisfied, but are
incredibly happy with our products and services. At that point, we
hope they will share our view that the security turf we are sharing is
pretty green after all.
The customer has shared this information and is in the process of
evaluating options including moving back to Check Point. We will
help in getting this over the line and assist with the migration.