Check Point Security Operations

Name: Check Point Security Operations
Brand: Check Point Software Technologies
Rating: 4.6 (209 reviews)

Leader

Customers rely on Lakera for real-time security that doesn’t slow down their GenAI applications.

Est 1993|Valuation $13.7B|Raised $1.8B

LinkedIn 11K|Website|Web traffic 2.0M|FTEs 6,825|HQ San Francisco, CA

MarketsSecurity Information and Event Management (SIEM)Security Orchestration, Automation, and Response (SOAR)

Published Oct 15, 2026

01Common complaints

- If your primary requirement is a pure-play SIEM with broad, established content libraries and mature third-party integrations (for example, organizations anchored on Splunk ES), Check Point's solutions may not align with that center of gravity. - If transparent, self-serve pricing and trial access for SOC platform elements are required, Check Point's quote-driven packaging may be a mismatch. - If there is minimal existing Check Point footprint and the organization does not intend to standardize on Check Point controls, alternative vendors may offer faster time-to-value. - If endpoint agent performance stability is an absolute hard requirement without tolerance for risk, anecdotal reports of agent resource use should prompt an extended proof of concept before procurement.

Deal disqualifiers (poor fit)

Very small organizations that require simple, low-friction SaaS pricing and procurement
Organizations that require a specific SIEM as the primary control plane (for example, Splunk ES or Microsoft Sentinel) and have strict aversion to vendor-native SOC tooling
Environments where endpoint agent stability is mission-critical and cannot tolerate the risk of performance issues without extensive validation

Known limitations evidenced in sources

Community reports indicate friction exporting deep logs into third-party SIEMs; this represents an operational risk to be validated.

Security incidents / vulnerability management relevance

There have been public disclosures of vulnerabilities affecting Check Point gateway products that required patching (for example, a CVE referenced in community discussion). While gateway vulnerabilities are separate from SOC tooling, they underscore the need for comprehensive asset coverage and timely patching within SOC workflows.

Roadmap / future features

Roadmap information is typically available through vendor community channels and events. Feature announcements often include incremental improvements to IOC management and Horizon-related capabilities; organizations should request formal roadmap communications and timelines during procurement if roadmap alignment is material to the decision.

02Why they buy

Strengths supported by available documentation

- Certain enterprise certifications and the ISO 27001 certificate list Infinity components by name, which can be relevant for procurement and vendor risk assessments. - Integration across network, cloud, email, and endpoint controls is a core platform capability that benefits organizations already standardized on the Check Point stack. - A menu of managed services that includes SIEM/SOAR support and integration options with third-party SIEMs (for example, Microsoft Sentinel) provides options for organizations that prefer managed SOC delivery.

Where competitors may have the advantage

Vendors anchored on different primary controls (for example, Palo Alto Networks for network/analytics or CrowdStrike for endpoint telemetry) may deliver more coherent out-of-the-box experiences in those anchor domains.

03Field reports

Because "Check Point Security Operations" is a suite, many reviews appear under adjacent products (Harmony, Security Management, etc.) rather than a single listing for "Infinity SOC." Review platforms that include user feedback for Check Point products include general B2B review sites and analyst review aggregates.

Review platforms (examples)

G2: user feedback and ratings for Check Point product listings
PeerSpot: review summaries and pros/cons for Check Point Security Management
Gartner Peer Insights: vendor-specific review listings (may be gated)

Community/social feedback (summary of user perspectives)

User feedback is mixed across forums and review sites. Representative themes include: Positive or neutral operational sentiment (general statements about product improvements): - Some users report improved platform maturity since specific software versions and note continued development across the portfolio. - Some users reported favorable economics from particular managed integrations, reported anecdotally. Negative or cautionary feedback (operational concerns and variability in experience): - Reports of endpoint agent performance issues (resource consumption and stability) have appeared in community discussions; these are anecdotal and should prompt POC testing to measure CPU/RAM utilization and stability in representative environments. - Variability in support experience has been reported: some users describe satisfactory outcomes while others report negative interactions; this appears to vary by case and geography. - Difficulties exporting deep logs to third-party SIEMs have been reported in community forums, indicating potential friction and vendor-preferred tooling paths. Why customers choose Check Point (inferred themes): - Consolidation under a single vendor for network, endpoint, cloud, and email controls - Existing investments in Check Point products across the estate - Vendor positioning around prevention-oriented detection and integrated tooling Why some customers leave (inferred themes): - Concerns about endpoint agent performance and stability (anecdotal) - Support experience variability - Potential vendor lock-in and data egress friction when integrating with separate SIEMs All community-sourced statements should be treated as anecdotal and validated through references, case studies, or proofs of concept.

MITRE ATT&CK outcomes cited by the vendor

The vendor highlights results from MITRE ATT&CK evaluations and associates those results with Infinity XDR/XPR. While such evaluations can provide useful insight into detection coverage for specific tactics and techniques, they do not directly measure SOC operational outcomes such as analyst efficiency, false positive burden, or incident response maturity. Customer quotes attributable to specific organizations are useful for contextual insight but usually lack detailed before/after metrics (for example MTTD/MTTR changes) and do not disclose methodology in public statements.

Managed XDR integrated with Microsoft Sentinel (service packaging)

The vendor describes a managed XDR offering that integrates with Microsoft Sentinel, offering threat hunting and incident handling. The vendor pages summarize capabilities but do not provide independent ROI validation. Organizations evaluating the service should obtain service-level agreements (SLAs), escalation models, sample reports, and staffing/coverage details.

04Best fit

Company size

Typical fit tends to be mid-market to large enterprise organizations, particularly when purchasing managed SOC services.

Industries

Regulated and security-mature sectors (financial services, healthcare, government, large technology organizations) where existing Check Point network security investments are present.

Personas

Decision makers: CISO, CIO/CTO, Director of Security, SOC Director
Operational users: SOC analysts, incident responders, security engineers

Fit qualification criteria

Existing Check Point footprint and a preference to consolidate tooling under the vendor
Need for around-the-clock monitoring combined with limited internal SOC staffing
Willingness to adopt Check Point's SOC workflow tooling rather than strictly maintaining a third-party SIEM as the center of gravity

05The pitch

What the product does (core value proposition)

"Check Point Security Operations" can be described as a bundle of SOC-focused products and managed services within the Check Point Infinity/Horizon portfolio. The offering is intended to help security teams: - Collect and correlate security telemetry across Check Point controls and selected third-party sources - Detect and investigate incidents through XDR-style correlation - Automate response workflows via integrations and playbooks/automation capabilities, depending on the module - Obtain around-the-clock monitoring and response as a managed SOC service (MDR/MPR, MXDR variants) The vendor describes the offering using the term "prevention-first". Key components typically referenced in vendor materials include: - Horizon / Infinity XDR/XPR (extended detection, prevention-oriented controls, and response) - Infinity SOC / Infinity Portal for SOC workflows - External Risk Management (ERM) and exposure/attack-surface capabilities that feed the SOC - Managed security services (Horizon MDR/MPR; managed XDR with SIEM/SOAR services) Relevant official entry points include vendor product and solution pages for Infinity SOC, Horizon XDR/XPR, and managed XDR with SIEM/SOAR.

Target market and positioning

- Primary: mid-market to enterprise security organizations that operate, or are willing to adopt, a significant Check Point footprint (Quantum gateways, Harmony endpoints/email, CloudGuard, etc.). - Secondary: organizations that plan SOC-as-a-service built around Microsoft security tooling (for example, Microsoft Sentinel / Defender) combined with Check Point-managed services. The vendor's "prevention-first" positioning is a marketing characterization. Operational outcomes such as alert reduction, detection fidelity, and MTTD/MTTR should be validated in procurement exercises and proofs of concept rather than assumed from marketing statements.

Get a comprehensive analysis of Check Point Security Operations including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 15, 2026

01Common complaints

If your primary requirement is a pure-play SIEM with broad, established content libraries and mature third-party integrations (for example, organizations anchored on Splunk ES), Check Point's solutions may not align with that center of gravity.
If transparent, self-serve pricing and trial access for SOC platform elements are required, Check Point's quote-driven packaging may be a mismatch.
If there is minimal existing Check Point footprint and the organization does not intend to standardize on Check Point controls, alternative vendors may offer faster time-to-value.
If endpoint agent performance stability is an absolute hard requirement without tolerance for risk, anecdotal reports of agent resource use should prompt an extended proof of concept before procurement.

Deal disqualifiers (poor fit)

Very small organizations that require simple, low-friction SaaS pricing and procurement
Organizations that require a specific SIEM as the primary control plane (for example, Splunk ES or Microsoft Sentinel) and have strict aversion to vendor-native SOC tooling
Environments where endpoint agent stability is mission-critical and cannot tolerate the risk of performance issues without extensive validation

Known limitations evidenced in sources

Community reports indicate friction exporting deep logs into third-party SIEMs; this represents an operational risk to be validated.

Security incidents / vulnerability management relevance

There have been public disclosures of vulnerabilities affecting Check Point gateway products that required patching (for example, a CVE referenced in community discussion). While gateway vulnerabilities are separate from SOC tooling, they underscore the need for comprehensive asset coverage and timely patching within SOC workflows.

Roadmap / future features

Roadmap information is typically available through vendor community channels and events. Feature announcements often include incremental improvements to IOC management and Horizon-related capabilities; organizations should request formal roadmap communications and timelines during procurement if roadmap alignment is material to the decision.

02Why they buy

Strengths supported by available documentation

Certain enterprise certifications and the ISO 27001 certificate list Infinity components by name, which can be relevant for procurement and vendor risk assessments.
Integration across network, cloud, email, and endpoint controls is a core platform capability that benefits organizations already standardized on the Check Point stack.
A menu of managed services that includes SIEM/SOAR support and integration options with third-party SIEMs (for example, Microsoft Sentinel) provides options for organizations that prefer managed SOC delivery.

Where competitors may have the advantage

Vendors anchored on different primary controls (for example, Palo Alto Networks for network/analytics or CrowdStrike for endpoint telemetry) may deliver more coherent out-of-the-box experiences in those anchor domains.

03Field reports

Review platforms (examples)

G2: user feedback and ratings for Check Point product listings
PeerSpot: review summaries and pros/cons for Check Point Security Management
Gartner Peer Insights: vendor-specific review listings (may be gated)

Community/social feedback (summary of user perspectives)

User feedback is mixed across forums and review sites. Representative themes include:

Positive or neutral operational sentiment (general statements about product improvements):

Some users report improved platform maturity since specific software versions and note continued development across the portfolio.
Some users reported favorable economics from particular managed integrations, reported anecdotally.

Negative or cautionary feedback (operational concerns and variability in experience):

Reports of endpoint agent performance issues (resource consumption and stability) have appeared in community discussions; these are anecdotal and should prompt POC testing to measure CPU/RAM utilization and stability in representative environments.
Variability in support experience has been reported: some users describe satisfactory outcomes while others report negative interactions; this appears to vary by case and geography.
Difficulties exporting deep logs to third-party SIEMs have been reported in community forums, indicating potential friction and vendor-preferred tooling paths.

Why customers choose Check Point (inferred themes):

Consolidation under a single vendor for network, endpoint, cloud, and email controls
Existing investments in Check Point products across the estate
Vendor positioning around prevention-oriented detection and integrated tooling

Why some customers leave (inferred themes):

Concerns about endpoint agent performance and stability (anecdotal)
Support experience variability
Potential vendor lock-in and data egress friction when integrating with separate SIEMs

All community-sourced statements should be treated as anecdotal and validated through references, case studies, or proofs of concept.

MITRE ATT&CK outcomes cited by the vendor

Customer quotes attributable to specific organizations are useful for contextual insight but usually lack detailed before/after metrics (for example MTTD/MTTR changes) and do not disclose methodology in public statements.

Managed XDR integrated with Microsoft Sentinel (service packaging)

04Best fit

Company size

Typical fit tends to be mid-market to large enterprise organizations, particularly when purchasing managed SOC services.

Industries

Regulated and security-mature sectors (financial services, healthcare, government, large technology organizations) where existing Check Point network security investments are present.

Personas

Decision makers: CISO, CIO/CTO, Director of Security, SOC Director
Operational users: SOC analysts, incident responders, security engineers

Fit qualification criteria

Existing Check Point footprint and a preference to consolidate tooling under the vendor
Need for around-the-clock monitoring combined with limited internal SOC staffing
Willingness to adopt Check Point's SOC workflow tooling rather than strictly maintaining a third-party SIEM as the center of gravity

05The pitch

What the product does (core value proposition)

Collect and correlate security telemetry across Check Point controls and selected third-party sources
Detect and investigate incidents through XDR-style correlation
Automate response workflows via integrations and playbooks/automation capabilities, depending on the module
Obtain around-the-clock monitoring and response as a managed SOC service (MDR/MPR, MXDR variants)

The vendor describes the offering using the term "prevention-first". Key components typically referenced in vendor materials include:

Horizon / Infinity XDR/XPR (extended detection, prevention-oriented controls, and response)
Infinity SOC / Infinity Portal for SOC workflows
External Risk Management (ERM) and exposure/attack-surface capabilities that feed the SOC
Managed security services (Horizon MDR/MPR; managed XDR with SIEM/SOAR services)

Relevant official entry points include vendor product and solution pages for Infinity SOC, Horizon XDR/XPR, and managed XDR with SIEM/SOAR.

Target market and positioning

Primary: mid-market to enterprise security organizations that operate, or are willing to adopt, a significant Check Point footprint (Quantum gateways, Harmony endpoints/email, CloudGuard, etc.).
Secondary: organizations that plan SOC-as-a-service built around Microsoft security tooling (for example, Microsoft Sentinel / Defender) combined with Check Point-managed services.

The vendor's "prevention-first" positioning is a marketing characterization. Operational outcomes such as alert reduction, detection fidelity, and MTTD/MTTR should be validated in procurement exercises and proofs of concept rather than assumed from marketing statements.

Get a comprehensive analysis of Check Point Security Operations including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →