Symantec Advanced Threat Protection

Symantec Corporation, founded in 1982 and headquartered in Mountain View, California, evolved from a broad technology vendor into a security-focused company after entering the antivirus market in the early 1990s. In 2015, it split into two entities, with Veritas taking information management solutions and Symantec concentrating solely on cybersecurity. The company operates at global scale, with more than 12,000 employees across 35+ countries, a long-standing presence in consumer and enterprise protection under the Norton brand, and a threat intelligence network covering over 175 million protected endpoints. Its security portfolio spans endpoint protection, malware defense, data loss prevention, encryption, and strong authentication, and was strengthened further by acquiring Blue Coat Systems in August 2016 to expand web and cloud security capabilities.

Against a backdrop of increasingly sophisticated, multi-vector attacks that can remain undetected for months, the text positions next-generation security analytics—built on large-scale data collection, correlation, and machine learning—as the industry response for reducing detection times to hours or minutes. Symantec Advanced Threat Protection (ATP) is presented as an integrated platform that combines traditional detection methods with newer analytics and threat intelligence across three primary vectors: endpoints, networks, and email. The product is delivered as a virtual or hardware appliance, can be deployed module-by-module, and provides a single console for unified visibility, investigation, and remediation.

Endpoint ATP integrates with Symantec Endpoint Protection for EDR without additional agents and uses Symantec Cynic cloud sandboxing, including physical-hardware execution to expose VM-aware malware. Network ATP can run standalone and enriches detections using DeepSight threat intelligence and Insight reputation data, while Email ATP requires Symantec Email Security.cloud and does not support alternative email services. Symantec Synapse correlation reduces noise, ranks incidents by criticality, stores artifacts for forensics, and integrates with SIEM, ServiceNow, and APIs. The solution is recommended as a turn-key, highly integrated option—especially for existing Symantec customers and smaller organizations—while noting limits in extensibility, orchestration, and built-in reporting compared to dedicated security analytics platforms.

• Symantec Corporation was founded in 1982 and is headquartered in Mountain View, California, USA.
• A 2015 split created two independent entities, with Veritas taking information management solutions.
• The company has over 12,000 employees across more than 35 countries.
• Symantec is a Fortune 500 company and a member of the S&P 500 index.
• The Norton brand is used for consumer and enterprise antivirus and malware protection offerings.
• The threat intelligence network covers over 175 million protected endpoints.
• Blue Coat Systems was acquired in August 2016.
• Symantec Advanced Threat Protection is delivered as a virtual or hardware appliance.
• The Network module can be deployed standalone without dependencies on other Symantec products.
• The Email module requires Symantec Email Security.cloud and does not support other comparable services or standard mail servers.

• “As cybercriminals are constantly developing increasingly sophisticated attacks that combine multiple threat vectors and may remain undetected for months, traditional security tools are becoming less and less effective against new challenges.”
• “These solutions are capable of detecting suspicious activities in hours if not minutes instead of months, giving security experts powerful automated tools for forensic analysis and quick remediation of uncovered security incidents.”
• “Notably, the solution employs execution of physical hardware to detect virtual machine-aware malware.”
• “Directly from the central console, it is possible to block or completely remove a detected malware object from all endpoints with a single click or even completely isolate compromised endpoints from the network.”
• “By filtering out the statistical noise, security analytics algorithms dramatically reduce the number of incidents security experts must analyze.”
• “Although we cannot consider Symantec Advanced Threat Protection a full-featured security analytics platform, because it lacks flexibility and extensibility usually found in one, it is important to stress that the company does not position it as one.”
• “Symantec ATP is first and foremost designed to provide advanced persistent threat protection by identifying and blocking them across endpoints, network and email – the most common attack vectors.”
• “As a highly-integrated turn-key solution for detecting and remediating most common cyber threats, the product can definitely be recommended for many potential customers, especially for smaller companies that do not have enough resources for running a full-scale security operations center.”
• “For exiting Symantec customers, this should be a complete no-brainer: the security analytics solution that seamlessly integrates with traditional endpoint and email security tools already deployed within the company is not just a recommended addition, but a must-have component of a modern corporate security infrastructure capable of detecting and defending from sophisticated advanced threats.”
• “Symantec Advanced Threat Protection goes beyond pure Real-Time Security Intelligence by combining traditional on-premises and cloud-based threat prevention functions with next-generation security analytics and threat intelligence in a highly-integrated package from a leading security vendor.”