We're using Check Point Harmony for endpoint security and secure access, but SSL inspection is breaking developer tools and package registries. We've also had slow boots, captive portal connection loops, and occasional false positives.
We already have Microsoft 365 E5. Has Harmony worked well for anyone, or is there an alternative worth considering that won't disrupt developer workflows as much?
Start by looking at Defender for Endpoint, since it's already included in your E5 licenses. That gives you a candidate for the endpoint side without immediately adding another product bill.
I'd evaluate secure access separately rather than assume an endpoint replacement covers everything Harmony does. Map out which internal resources need remote access, then test the options against those requirements.
The certificate problem isn't unique to Harmony. SSL inspection presents a different certificate to the client, so the inspecting certificate authority needs to be trusted. Some developer tools use their own trust stores rather than the operating system's, which can make a simple certificate deployment incomplete.
Check how the affected package managers and cloud tools handle trusted certificates. You may still need carefully scoped inspection exclusions for tools that can't be made to work with your setup. Disabling inspection everywhere is not the only option, but neither is forcing every tool through it.
I'd test the user experience before committing to a migration. Try captive portal Wi-Fi, startup time, connecting and disconnecting, and access to the internal resources people actually need. A secure access client that gets in the way can push users toward workarounds.
Also check the management interface and support workflow. Even a setup used mainly for basic remote access can become tedious if routine administration is slow or confusing.
Before ripping it out, separate the false positives and performance issues from the SSL inspection issue. Review the flagged software and collect examples of the slow boots and connection loops. That gives you something concrete to troubleshoot with support and a fair checklist for comparing replacements.
Answers are reviewed before publication.
3fold+later~perhaps:
That testing should include the actual developer workflows, not just whether a browser loads a page. A working browser doesn't guarantee the CLI uses the same trust store.