Jump ahead to:
In-depth EDR Software Reviews
- Crowdstrike Falcon
- Check Point Software SandBlast
- Palo Alto Networks Cortex XDR
- Microsoft Defender for Endpoints
- Trend Micro
- VMware Cardon Black
- Blackberry Cylance
Key takeaway: CrowdStrike is for those willing to pay for advanced features that are hard to beat.
CrowdStrike Falcon is popular with analysts and users alike – and it came out on top in our analysis too. Falcon has posted solid security scores through three rounds of MITRE ATT&CK testing, but when factoring in the product’s advanced features, it wound up with an overall Detection score at the top of the list. It also scored high in Response, Management, Ease of Use, and Support. Pricing is above average, but as all EDR products save millions of dollars in breach and remediation costs, price is relative, and well-executed advanced features pay for themselves. Falcon offers almost all the standard features you’d expect in a top EDR product, although automated remediation costs extra. Web content filtering and VPN aren’t offered, and for encryption it merely reports on the status of Windows BitLocker, but none of those features are widely offered enough to be considered a standard EDR feature. Users score it high in capabilities, implementation, cloud-based management, and Linux and technical support, among other areas. But CrowdStrike’s biggest strength is the additional services offered with Falcon, including threat hunting, vulnerability assessment and more.
- Happy customers
- Easy cloud-based implementation
- Advanced features that deliver
- Can get pricey
- A few vendors have higher raw independent test scores – but in any other product, we’d place that in the “Pros” section
- Web content filtering and VPN needs would have to be met in other ways
Key takeaway: A good match for companies of all sizes seeking strong endpoint security at a good price point, particularly those who want their EDR solution to do some of the work for them.
Check Point’s SandBlast offering was tied for second overall on the strength of its top-notch security and support at a good price. It received the highest score in Ease of Use and came in second in Management, and its automated response capability is also good, making it a strong candidate for smaller companies or those with less sophisticated security teams. In NSS Labs testing, SandBlast handled everything thrown at it, with the sole exception of targeted (hand-crafted) attacks, where it stopped 40%. Results in the rigorous MITRE testing have been impressive too. SandBlast offers full-featured management, although users report some challenges with implementation. Check Point also offers a remarkably full-featured product for a price that’s toward the lower end of EDR products, with custom rules the only missing piece. There may be cheaper products and there may be more advanced ones, but none offer better security for the price.
Check Point Ratings
- Automated response
- Ease of use and management
- Full-featured at reasonable cost
- Custom rules missing
- Some implementation challenges reported
Key takeaway: A good choice for companies willing to pay for advanced features without sweating the details too much.
SentinelOne tied for second overall, with top scores in Detection, Deployment and Value. SentinelOne users are among the happiest in the EDR space, and they have good reason to be. The product’s automated response features are rated highly by users, which could make SentinelOne a good choice for smaller companies and those without a sophisticated security team. Security scores are strong, and SentinelOne even came out on top in a couple rounds of MITRE testing – that’s no small feat, as participants are basically trying to stop Russian nation-state hackers and other sophisticated attacks across more than 100 attack techniques. Missing features include full-disk encryption, VPN, mobile support and web content filtering, and rogue device discovery can be had at an additional cost, but as only about half of top vendors offer those, it would be hard to call them standard features. SentinelOne isn’t the cheapest EDR product on the market, but even there, price is often cited as a reason for buying.
- Automated response
- Strong security at a reasonable price
- Good security for less sophisticated teams
- Missing features: full-disk encryption, VPN, mobile support, web content filtering
- Rogue device discovery offered at an additional cost
- Not for those buying on price alone, but otherwise a good value
Note: F-Secure’s enterprise security business has been renamed WithSecure. The consumer business will retain the F-Secure name.
Key takeaway: If top-notch security is a requirement, F-Secure is a good one to add to your shortlist.
F-Secure, headquartered in Helsinki, has consistently posted high independent test scores. The company offers some of the best security on the EDR market for a price that’s about average, with some of the highest scores in the MITRE evaluations. It gets high marks for Ease of Use and Value too. F-Secure boasts a solid lineup of advanced features, but they can come at an additional cost: vulnerability monitoring, custom rules, advanced threat hunting, rogue device discovery, rollback, VPN. Still, the list of features is pretty thorough. Users report some difficulty with implementation, but support and services are there if you need them.
- Top security
- Full lineup of advanced features, but some cost extra
- Ease of use and value
- Advanced features can cost extra
- Some implementation challenges
Key takeaway: A natural for Palo Alto customers, but anyone seeking top security and a product that goes beyond endpoints should take a look.
Palo Alto Networks ranks highest overall in security in our analysis on the strength of consistently high independent test scores, with strong results from both NSS Labs and MITRE. And that security can be had for a price that’s a little above average. NSS Labs found that Palo Alto’s Cortex XDR system handled all manner of attacks, including handcrafted (targeted attacks). Palo Alto also came out on top in multiple rounds of the rigorous MITRE ATT&CK evaluations, including MITRE’s new protection tests. The only weak spot in the NSS tests was social exploits embedded in documents, where Palo Alto stopped just over 60% of attacks. Alerting capabilities are solid, and AI and behavioral analytics track threats across endpoints, the network and the cloud. Users report some issues with integration and support, and some of the less common EDR features are missing: vulnerability monitoring, patch management, web content filtering, rollback. Strong integration with Palo Alto firewalls and technologies could limit the product’s market to current Palo Alto customers, but anyone seeking top security and a product that goes beyond endpoints should take a look.
Palo Alto Ratings
- Top scores in third-party security tests
- Ability to handle advanced attacks
- AI and behavioral analytics, strong alerting capabilities
- Tracks threats across endpoints, networks and cloud
- Vulnerability monitoring, patch management, web content filtering, and rollback are missing features
- Management and implementation can be complicated
- Palo Alto customers make up a big part of the market; need for broader visibility
Key takeaway: A good choice for any company looking for solid security and ease of use on a budget.
Kaspersky’s EDR offering offers solid security at bargain-basement prices, which also makes the product one of the more popular ones on the market. It’s a feature-rich product too, with an additional cost for VPN the only noteworthy omission. Users like the product’s automation features that surface the most critical issues, its investigation and response capabilities, top-notch research, ease of implementation and use, and support. Some users have said the product can be resource-intensive, straining CPUs, and Kaspersky’s raw score in the second round of MITRE testing was below average. The Moscow-based company has also moved much of its data processing to Switzerland to ease any suspicions about ties to the Russian government. Still, lingering concerns about independence from Moscow have led many to seek Kaspersky alternatives.
- Solid security for a low price
- Ease of use
- Can be resource-intensive
- VPN costs extra
- Underwhelming MITRE round two evaluation
Key takeaway: With its integration into Windows source code, Microsoft Defender is a natural for Windows environments, but the product’s strong security makes it a contender elsewhere too.
Microsoft has invested significantly in its security capabilities and in-house development, and the result has been an impressive performance in all rounds of the rigorous MITRE ATT&CK evaluations. By virtue of including its endpoint security software in Windows 10, Microsoft is number one in deployed endpoints, but the company is taking the Mac and Linux markets seriously too, and has also addressed licensing concerns by making Defender for Endpoints (previously called Defender Advanced Threat Protection) available as a standalone EDR product or as part of a suite. Microsoft turned in top-tier performances in the first two rounds of MITRE ATT&CK evaluations, proof that the software giant intends to be a player in endpoint security. Management and Ease of Use were two areas the product scored high in. Defender is feature-packed, with analyst workflow the lone missing feature, and rogue device discovery and VPN available for an additional cost.
Microsoft Defender Ratings
- Strong security
- Windows source code integration
- Management and ease of use
- Lots of standard features like vulnerability and configuration management
- Analyst workflow a missing feature
- Rogue device discovery and VPN cost extra
- Some reports that it can get pricey
Key takeaway: Trend Micro Apex One should be considered by those seeking strong security on a budget.
Apex One, Trend Micro’s combined EPP/EDR offering, scores highest in value, not surprising since it’s priced at the low end of the EDR market. With a top-tier performance in two rounds of MITRE evaluations, it’s one of the biggest bargains in the EDR market. Apex One’s combination of low cost and good security effectiveness gave it one of the best total cost of ownership (TCO) scores in NSS Labs testing. Office 365 and Google G Suite integration are a focus, a plus for cloud office suite users. There have been some issues with deployment, and users have reported occasionally needing to manually remove malware found by the product. A number of features are missing or cost extra, like patching, device control, analyst workflow, custom rules, and rollback, but as the product is at the low end of the pricing spectrum, those features can be added at a pretty reasonable cost when available.
Trend Micro Ratings
- Price, value and TCO
- Cloud office support
- Strong security
- Missing features: analyst workflow, custom rules, rollback
- Features that cost extra: patch management, full-disk encryption, device control, threat intelligence feed integration, VPN
- Some deployment issues
- Some reports of malware needing to be removed manually
Key takeaway: Carbon Black is popular with sophisticated security teams, but those needing more standard features may find value too.
Ease of Use and Value were the areas VMware Carbon Black scored highest in, perhaps a little surprising for a product priced in the middle of the pack. Users are pretty high on the product’s capabilities, which were solid enough to give it a very good TCO score in NSS Labs testing last year. Security is good too, with solid scores in NSS Labs and MITRE testing. One downside is that a number of features that might be expected in a mid-to-high end product are missing or cost extra: vulnerability monitoring, device control, guided investigation, advanced threat hunting and rollback among them. Predictive Security Cloud is the flagship offering, with options for threat hunting and response, and audit and remediation, and is popular with sophisticated security teams, but those needing more standard features may find value in Carbon Black too.
VMware Carbon Black Ratings
- Ease of use and product capabilities are strengths
- Well integrated EPP and EDR
- Advanced threat hunting may cost extra, but it’s well done
- Features that cost extra: advanced threat hunting, vulnerability monitoring and patch management
- Features not offered: full-disk encryption, web content filtering, device control, guided investigation, rollback, VPN
- Despite relative value, a few users report that the product can get pricey
Key takeaway: A comfortable choice that remains a top competitor.
Now owned by Broadcom, the EDR market leader hasn’t been resting on its laurels, not that any vendor could afford to in such a competitive market. Symantec Endpoint Security (SES) Complete, the vendor’s combined EPP-EDR offering, offers advanced features such as vulnerability remediation, threat hunting and targeted attack analytics. Response, Management, Ease of Use and Value were all good, indications that Symantec has put together a product that does many things well. Pricing can range from low-cost to expensive, depending on features selected, with larger companies enjoying substantial volume discounts. Standard features include vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery and more. Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost, while rollback isn’t offered, the only missing feature on our 28-item checklist. Symantec has posted a couple of strong rounds in the difficult MITRE testing, including in the new protection tests, so the longtime market leader offers a comfortable combination of familiarity and strong security. Symantec engineers have made some good choices, and the product gets solid marks from users across the board.
- Many standard features: vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery
- Good security
- Overall balanced scores
- Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost
- Rollback isn’t offered
- Pricing can be high
- Can be resource-intensive on endpoints
Key takeaway: Bitdefender is one that SMBs should be taking a look at, and even some enterprises too, as the company has basic and advanced offerings for both SMBs and enterprises.
Bucharest-based Bitdefender is popular with small and mid-sized businesses that want their endpoint security to do a lot of the work for them, and Bitdefender GravityZone can do that with machine learning, behavioral monitoring, risk analytics and automated remediation. Those features come at a cost, however, and for a product that can get pricey, a number of advanced features are missing, like guided investigation, threat intelligence feed integration and custom rules. Patch management, full-disk encryption, and rogue device discovery can be had at a premium. Security is good, with solid scores in NSS Labs and MITRE evaluations.
- Good security
- Popular with SMBs
- Good automation features
- Missing: guided investigation, threat intelligence feed integration, custom rules
- Available at a premium: patch management, full-disk encryption, rogue device discovery
- Can get pricey
Key takeaway: BlackBerry Cylance is for enterprises willing to pay extra for protection against unknown threats, but that extra cost may pay for itself in reduced remediation time.
BlackBerry Cylance offers good automated response abilities, and users are also high on the ability of CylancePROTECT EPP and CylanceOPTICS EDR to stop ransomware and unknown threats. NSS Labs and MITRE scores have been solid, but the product can be pricey. Threat hunting and custom rules are some of the advanced EDR features offered, but a number of advanced features are missing, like behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, and rollback. OPTICS in particular may present some implementation challenges, but users are generally pleased with the results.
BlackBerry Cylance Ratings
- Automated remediation
- Time-saving response and management capabilities
- Stops unknown threats
- Missing features: behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, rollback
- Some implementation challenges
- Can be pricey
Key takeaway: Cutting-edge security combined with ease of use.
After stellar results in both MITRE and NSS Labs testing, Cybereason has become an EDR vendor to be reckoned with. Users are positive about the product’s capabilities and ease of use, but report some challenges with implementation and support. The company is a leader in XDR and managed detection and response (MDR) too, giving users greater visibility and endpoint security options. Automated controls and remediation are a strength, and Cybereason’s users report the product’s security as state of the art. Advanced features like incident response, MDR, vulnerability management and threat hunting require the Ultimate license; the Enterprise version covers basic endpoint security and management. A good choice for organizations with some security expertise that are looking for strong security.
- Very strong security
- XDR and MDR leadership makes for broad security options
- Strong capabilities combined with ease of use
- Implementation and support can be challenging
Key takeaway: Advanced features, good security and happy users.
Cynet’s strong showing in recent MITRE testing and growing presence in XDR and other security markets has landed the six-year-old startup a spot among our top EDR products. Cynet 360 provides a single, unified XDR platform that includes full EDR capabilities along with visibility into network and user activities, with added deception technology. The platform provides advanced automated remediation capabilities across files, hosts, users and networks, along with remediation playbooks and an Incident Engine that automatically investigates and responds to threats, capabilities that also recently landed Cynet on our top incident response tools and services list. Cynet clients receive MDR service at no extra cost. Cynet users give the company high marks, with a few requests for more implementation and training help.
- Strong automation features
- Free MDR service
- Good XDR capabilities
- Implementation and training could be better
Key takeaway: Advanced features, good security and value.
Note: McAfee’s enterprise security business is now under the Trellix name after merging with FireEye.
A strong showing in the most recent MITRE testing, including the new protection tests, has moved McAfee up our list. MVISION Insights, which prioritizes threats and remediations, is a standout feature. Other advanced features include behavioral blocking, credential theft monitoring, rollback options and more. Those advanced features won’t cost you as much as you might think, as McAfee scored among the leaders in value, and ease of use is pretty good too. Certainly an EDR product for McAfee users to consider, as well as others.
McAfee MVISION Ratings
- Strong security
- Good value and ease of use
- Standout remediation features
- Changes in product direction have left many customers on older systems
- MDR and XDR offerings could be stronger
Here are a number of additional EDR products that impressed us. Many of these have posted impressive scores in rigorous third-party testing. Vendors in this category are more likely to have an offering that is best for specific uses cases, or are emerging and worthy of consideration.
Sophos: Sophos Intercept X had a strong showing in NSS Labs testing last year and is priced toward the low end of EDR products, making it a security bargain. Users have had their complaints – false positives, implementation and performance overhead are a few – but you won’t find many complaints about its security performance. MITRE ATT&CK results could have been better, but Sophos is a bargain worth considering.
Elastic/Endgame: The merger of two strong security companies – Endgame in endpoint security and Elastic in SIEM – makes Elastic a vendor to keep an eye on. MITRE and NSS Labs scores have been solid, so anyone valuing strong security should have a look.
Cisco AMP for Endpoints: Solid security at bargain prices; particularly well matched for Cisco shops. Cisco’s detection rate in the most recent MITRE evaluations was an unexciting 70%, but the networking giant’s 90% score in the more important protection tests is noteworthy.
Fortinet/enSilo: Fortinet may be best known for its firewalls, but with a low-cost, solid, easy-to-use EDR offering and the addition of the more advanced enSilo, the company is one to watch in the EDR space. A solid showing in recent MITRE testing confirms that observation.
WatchGuard/Panda: A recent acquisition combines Panda’s strong EDR security, which received high marks from NSS Labs, with WatchGuard’s strength in firewalls and network security.
Comodo: Strong test results from NSS Labs and solid user reviews should bring Comodo some notice. Users report some challenges with implementation and ease of use, but are otherwise satisfied.
ESET: An established EDR vendor with a strong presence with SMBs and a global reach – and a strong recent MITRE performance that cements its presence on this list.
See Our EDR Software Comparison Articles
We analyzed third-party test data, user reviews, product features, analyst reports and reseller pricing, and winnowed an initial list of more than 30 EDR vendors to come up with our list of 12 top vendors and 10 honorable mentions.
Here’s an explanation of our ratings categories, in order of our weighting:
Detection: It’s important that EDR products stop a high percentage of threats, but detection is also about advanced features that protect more than a traditional endpoint security platform might, such as threat hunting, correlation, and fileless threat detection. User opinions of the product’s capabilities also factor into our ratings.
Response: Here we judged how well the product removes threats, alerts security teams and guides response. Advanced features, such as automatically surfacing the most important threats and guided investigation, were also considered.
Management: Ease of use plays a role here, but more important are features that give a security team control over endpoints, such as vulnerability assessment, patching, endpoint control and more.
Ease of use: The higher the score, the more suitable the product may be for SMBs or less experienced security teams.
Support: Everyone contacting support has a problem that needs solving, so responsiveness matters.
Value: Value isn’t just price – where a product is truly low-cost, we note that – but is also about advanced features and high security that cost less than competing products and save companies data breach costs and security staff time in the process.
Deployment: This isn’t just about how easy a product is to implement, but also how well it integrates with user environments and how easy it is to deploy new endpoints.
Endpoint detection and response (EDR) gives security teams a centralized platform for continuously monitoring endpoints and responding to incidents as they arise, often via automated response.
What is EPP?
One important trend to note: EDR software products have been rapidly converging with endpoint protection platforms (EPP), which go beyond traditional antivirus software to offer protection against advanced threats such as fileless malware, so one thing EDR buyers should look for is a product that combines both, or gets EPP and EDR tools to work together as seamlessly as possible. All our top EDR products have that feature, and they also all offer machine learning-based detection, advanced fileless threat protection, correlation and automatic Indicators of Compromise (IoC).
Key Features of EDR Tools
In addition to the features common to all our top EDR vendors, here’s a chart evaluating their capabilities in additional areas like behavioral detection, automated remediation, vulnerability monitoring, analyst workflow, guided investigation, threat intelligence feed integration, custom rules, advanced threat hunting, and device discovery and control. We note whether a feature is native to an EDR product, added via integration with another product, often as part of an integrated security suite, or not offered at all.
EDR is just one part of endpoint security. There are a number of other security practices and technologies that organizations should be looking at.
What is Endpoint Security?
Endpoints are one of the most common entry points for malware and malicious actors – and thus one of the most important elements of IT security. Keeping endpoints safe and secure and catching attacks before they spread is one of the critical functions of EDR and EPP solutions (and of consumer-grade antivirus software too).
Endpoint Security Challenges
Complicating endpoint security is the myriad devices that connect to a corporate network, from laptops and workstations to servers, mobile devices, BYOD users, routers, WiFi access points, IoT devices and point of sale systems. All represent potential attack points.
The devices themselves aren’t even the weakest link of endpoint security: it’s the users themselves who click on malicious links and open questionable email attachments with little thought to what they contain. That alone makes employee security training an important part of endpoint security.
Unknown threats like zero-day exploits and advanced threats like fileless malware make it essential that your endpoint protection vendors have the research and development teams necessary to respond to the constantly shifting threat landscape.
Employee onboarding and departure can be security risks too, making account, network and application control other essential security tasks.
Endpoint Protection Steps
There are a dizzying array of endpoint security concerns, from malware to data theft to network and application access – and each one of them has a corresponding control or product that organizations can deploy.
EDR solutions can contain a great many of these security technologies, so create a checklist of what you need and look for the vendor that best meets your requirements. Possibilities include:
- Data loss prevention (DLP) and insider threat protection
- Vulnerability management
- Application whitelisting and control
- Identity and access management (IAM) and authentication
- Network access control (NAC)
- Data classification and protection
- Privileged account management
- Endpoint encryption
That last point merits its own discussion. Endpoint encryption has increasingly become a must-have for enterprises dealing with sensitive data, from corporate secrets to compliance regulations like PCI-DSS that require encryption. Encryption can protect data from unauthorized access, even when a device is lost or stolen.
There are two basic kinds of endpoint encryption: full disk and file-based. Full disk encrypts everything on a drive except what’s needed to boot up, but then is no longer encrypted once the user accesses the data. File-based, on the other hand, stays encrypted until an authorized user opens it. Both encryption types could be used together to maximize security.
EDR systems offer a way to centrally monitor and manage that encryption. Roughly half of EDR vendors offer encryption with their products, either as part of the product or an add-on solution. Some monitor the status of BitLocker, the native encryption tool that comes with Microsoft Windows. But regardless of how you implement it, encryption is becoming a must-have for organizations of all types and sizes.