Q3 2016

SANDBLAST ZERO-DAY PROTECTION

OVERVIEW THE CHECK POINT ADVANTAGE MARKET LEADERSHIP

Modern malware has become much more sophisticated,
making it critical for organizations to implement
protections against attacks hidden in regular documents
and web pages. A new approach to threat prevention is
needed to protect organizations against known
malware, unknown malware and new zero-day attacks,
while delivering safe documents to users quickly to
maintain the flow of business.
New CPU-level detection catches even the
most sophisticated attacks -- including
unknown zero day threats and those using
evasion techniques
Best catch rate of both known and unknown
malware, fastest time to verdict (up to 4
min), and fastest update of Threat
Intelligence feeds
Unlike other sandboxing solutions that are
often deployed in detection mode to avoid
delays, SandBlast provides practical
prevention capabilities, combining the
fastest evaluation times with Threat
Extraction to promptly deliver a clean
version of files
Integrated architecture leverages existing
infrastructure, reducing capital costs and
implementation time, and providing a single,
consistent view into events & alerts
Check Point SandBlastTM is named a Leader in
The Forrester Wave: Automated Malware
Analysis (AMA), Q2 2016. Forrester evaluates
each vendors strengths and weaknesses in
Current Offering, Strategy and Market Presence.
Highest score for AMA strategy: 4.18 out of 5.0
4.25 score for product strategy
Top overall score of 3.94 out of 5 (tied)
Perfect score of "5" in two key categories
NSS Labs is a recognized leader in independent
security research and testing. NSS Labs 2016
Breach Detection Systems tests named Check
Point a top-scoring Recommended vendor.
100% catch-rate for Drive-By exploits
100% catch-rate for E-mail unknown malware
100% Sandbox evasion resistance
100% catch-rate for Social exploits
100% catch-rate of SSL encrypted malware
99.4% over all breach detection rate

Need more info? Contact Threat_Prevention_Sales@checkpoint.com

ELEVATOR PITCH TOP 3 SELLING POINTS SALES ENABLEMENT RESOURCES

Check Point OS and CPU-level Threat Emulation evaluates Success Stories Third Party Analysis Videos
documents by launching them in a virtual sandbox, GIMV Customer Testimonial Zero-Day Protection
Boston Properties Testimonial 2016 Forrester Wave CPU-Level Threat
to identify new, obfuscated, or evasion-based attacks Report Protection
2016 NSS BDS Test
Check Point Threat Extraction delivers a clean version of
Report
documents immediately, with access to the original only Product Information 2015 Gartner Market
White Papers
Customer Presentation Sandboxing: Expose
after it has been deemed safe (internal, partners)
Guide
the Unknown
2014 Miercom
Product Page (public, PartnerMAP) Zero Second
Up and running quickly, with flexible deployment options Test Report
Test Plan (internal, partners) Unknown 300
as standalone appliances, software blades RFP Template (internal, partners) TCO - Nick Lippis
in existing gateways, or a cloud service
2015 Check Point Software Technologies Ltd. 1
[Q3 2016 [Confidential] for designated groups and individuals
 Q3 2016

SANDBLAST ZERO-DAY PROTECTION

Proofpoint
Websense
Key

Sourcefire

TrendMicro
HOW TO COMPETE AGAINST...

Palo Alto

Bluecoat

Lastline
Fortinet
FireEye

McAfee
Capability

Check

Cisco
Point
Infrastructure Overhead: Requires 2 or 3 additional by Vendor
appliances at the organization - for email, for web and for Advanced Threat Prevention Matrix
central management
Real-Time 1 1
Partial visibility to incoming files: No SSL / TLS inspection, Prevention-
Unknown
allowing files in encrypted communications to get into Malware
organization 6
Files Supported
Poor results in NSS labs BDS test
The solution doesnt prevent malware but notifies the
OS Support
administrator about the malicious files retroactively (up to 15
mins)
Protocols
No solution for archive files other than zip
PDF File size limited to 1MB & Doc (office) file size limited System Activity
WildFire to10MB Detection

Three separate management consoles needed (FW, NGFW, Deployment

Options
4 4

SWG)
Inspect
Unable to perform preemptive actions (threat extraction) to Encrypted 3 3 4 3 3

remove active content and prevent threats in documents Communica-

tions (SSL TLS)
AMP
The solution doesnt prevent malware but notifies the
4 4 1
administrator about the malicious files retroactively Anti-Evasion

No prevention capabilities can only detect threats after the Endpoint: Zero-
5
fact with SPAN port deployment Day Detection &
Forensics
Zero visibility to incoming files: No SSL inspection, allowing Summary
files
Deep in encrypted communications to get into the organization A Complete
Threat
Discovery Can be easily evaded as it is based on commercial Prevention
Solution
hypervisor Virtual Machine
1) Only on email 4) Commercial hypervisor
2) only SPAN port 5) No sandboxing on endpoint
3) needs a separate appliance 6) No archives support (except ZIP)

Need more info? Contact Threat_Prevention_Sales@checkpoint.com Need more info about the matrix ratings? Check out the Heat Map
(internal only)
[Q3 2016 [Confidential] for designated groups and individuals
 Q3 2016

SANDBLAST ZERO-DAY PROTECTION

TARGET AUDIENCE AND QUESTIONS TO ASK OBJECTION HANDLING

I am in charge of Can you refer me to the right person in your
DIRECTOR of SECURITY network security and company? Is there someone who responds to
CIO or CISO
IT / INFOSEC MANAGERS firewalls only. I dont cyber incidents or helps the organization deal
deal with other security with complex, new attacks?
How has your What are you running How often do your
aspects.
organization prepared today that would users click on links or
for a targeted attack prevent a sophisticated open attachments, We already have full AV AV and IPS products can only protect from
such as spear phishing zero-day threat from resulting in a need for deployment on the known attacks (based on signatures).
or APTs? breaching your you to remediate a network and all of the Determined attackers can easily develop
network? malware infection? end points. Why do we custom zero-day attacks that will not be
need more? detected. This is why many companies are
turning to sandboxing/emulation solutions.
What level of threat How do you correlate Does running separate
visibility do you have events between threat prevention We are already have a All existing sandboxing products can be easily
across your separate threat products make it hard sandboxing solution bypassed using simple evasion techniques,
organization? prevention products? to consolidate alerts? from XYZ and we are such as timing delays or VM detection. Only
quite happy with it. Check Point offers a revolutionary CPU-level
sandboxing technology that detects exploits
What preemptive threat How long does it take How does your current BEFORE evasion code can run.
protection do you have to identify threats in sandbox solution
in place? your network? handle advanced I dont have the Check Point offers a pain-free POC process.
evasion techniques and resources/bandwidth We can leverage a tap or span port on your
encrypted HTTP now to start an network to show you the products in action on
traffic? evaluation. your network without disrupting any services or
changing your architecture.

SUMMARY ENSURING THE WIN TOP POSITIONING TIPS FROM THE FIELD

For enterprises at risk of targeted attacks such as spear phishing and APTs,
Check Point Zero-Day Threat Emulation, with its unique CPU-level detection,
provides an additional layer of security from even the most sophisticated
hackers. Unlike traditional sandboxing solutions that are subject to evasion
techniques, Check Point catches more malware, with minimal impact on
delivery times.
Promote the Security Checkup (internal, partners) to demonstrate our value proposition.
2015 Check Point Software Technologies Ltd.
[Q3 2016 [Confidential] for designated groups and individuals
1. Highlight the proven (NSS) best catch rate and evasion resistant
detection capabilities, especially with the CPU-level engine
2. Stress out the importance of practical prevention Check Point offers
vs. detection only with the other players
3. For existing customers elaborate on their ability to capitalize on their
investment with Check Point and add Threat Emulation capabilities
with minimal effort, into integrated alert and management consoles
4. Push for POC for customers who are aware of the APT problem, if not,
offer a security checkup
3