IT security isn’t just about raw test scores, although independent testing is very important in our view.
It’s also the advanced features that provide additional protection, the ease of implementation and use, management control of endpoints and threats, value and support, and so we rate EDR software products in all those areas.
We rated more than 30 EDR products in seven key areas and measured around 10,000 data points to come up with our list of 12 top EDR providers, plus an additional 10 notable EDR products. We went well beyond vendor data sheets to study 28 key features of EDR tools. All our top EDR vendors offer a unified EDR/endpoint protection platform (EPP), machine learning-based threat detection, advanced fileless threat protection, and correlation and automatic indicators of compromise (IoC). We evaluate their capabilities in 10 additional key areas in a chart below. For more on our methodology and ratings, see our Methodology section.
Jump ahead to:
- Check Point
- Sentinel One
- Palo Alto
- Trend Micro
- VMware Carbon Black
- BlackBerry Cylance
- Other market leaders
- Key EDR features
- EDR, EPP and endpoint security steps
Top EDR Software Products
Key takeaway: CrowdStrike is for those willing to pay for advanced features that are hard to beat.
- Happy customers
- Easy cloud-based implementation
- Advanced features that deliver
- Can get pricey
- A few vendors have higher raw independent test scores – but in any other product, we’d place that in the “Pros” section
- Web content filtering and VPN needs would have to be met in other ways
CrowdStrike Falcon is popular with analysts and users alike – and it came out on top in our analysis too. Falcon is near the top in raw security scores, but when factoring in the product’s advanced features, it wound up with an overall Detection score well above any other vendor on this list. It also scored high in Response, Management, Ease of Use, and Support. Pricing is above average, but as all EDR products save millions of dollars in breach and remediation costs, price is relative, and well-executed advanced features pay for themselves. Falcon offers almost all the standard features you’d expect in a top EDR product, although automated remediation costs extra. Web content filtering and VPN aren’t offered, and for encryption it merely reports on the status of Windows BitLocker, but none of those features are widely offered enough to be considered a standard EDR feature. Users score it high in capabilities, implementation, cloud-based management, and Linux and technical support, among other areas. But CrowdStrike’s biggest strength is the additional services offered with Falcon, including threat hunting, vulnerability assessment and more.
Check Point Software SandBlast
Key takeaway: A good match for companies of all sizes seeking strong endpoint security at a good price point, particularly those who want their EDR solution to do some of the work for them.
- Automated response
- Ease of use and management
- Full-featured at reasonable cost
- Custom rules missing
- Some implementation challenges reported
Check Point’s SandBlast offering was tied for second overall on the strength of its top-notch security and support at a good price. It received the highest score in Ease of Use and came in second in Management, and its automated response capability is also good, making it a strong candidate for smaller companies or those with less sophisticated security teams. In NSS Labs testing, SandBlast handled everything thrown at it, with the sole exception of targeted (hand-crafted) attacks, where it stopped 40%. It offers full-featured management, although users report some challenges with implementation. Check Point also offers a remarkably full-featured product for a price that’s toward the lower end of EDR products, with custom rules the only missing piece. There may be cheaper products and there may be more advanced ones, but none offer better security for the price.
Check Point Ratings
See our comparison of Check Point and Palo Alto Networks
Key takeaway: A good choice for companies willing to pay for advanced features without sweating the details too much.
- Automated response
- Strong security at a reasonable price
- Good security for less sophisticated teams
- Missing features: full-disk encryption, VPN, mobile support, web content filtering
- Rogue device discovery offered at an additional cost
- Not for those buying on price alone, but otherwise a good value
SentinelOne tied for second overall, with top scores in Detection, Deployment and Value. SentinelOne users are among the happiest in the EDR space, and they have good reason to be. The product’s automated response features are rated highly by users, which could make SentinelOne a good choice for smaller companies and those without a sophisticated security team. Security scores are good, and SentinelOne even came out on top in the second round of MITRE testing – that’s no small feat, as participants are basically trying to stop Russian nation-state hackers across 140 areas. Missing features include full-disk encryption, VPN, mobile support and web content filtering, and rogue device discovery can be had at an additional cost, but as only about half of top vendors offer those, it would be hard to call them standard features. SentinelOne isn’t the cheapest EDR product on the market, but even there, price is often cited as a reason for buying.
Learn More about SentinelOne
Key takeaway: If top-notch security is a requirement, F-Secure is a good one to add to your shortlist.
- Top security
- Full lineup of advanced features, but some cost extra
- Ease of use and value
- Advanced features can cost extra
- Some implementation challenges
F-Secure, headquartered in Helsinki, matched Palo Alto for the highest independent test scores. The company offers some of the best security on the EDR market for a price that’s about average, with some of the highest scores in the MITRE evaluations. It gets high marks for Ease of Use and Value too. F-Secure boasts a solid lineup of advanced features, but they can come at an additional cost: vulnerability monitoring, custom rules, advanced threat hunting, rogue device discovery, rollback, VPN. Still, the list of features is pretty thorough. Users report some difficulty with implementation, but support and services are there if you need them.
Learn More about F-Secure
Palo Alto Networks Cortex XDR
Key takeaway: A natural for Palo Alto customers, but anyone seeking top security and a product that goes beyond endpoints should take a look.
- Top scores in third-party security tests
- Ability to handle advanced attacks
- AI and behavioral analytics, strong alerting capabilities
- Tracks threats across endpoints, networks and cloud
- Vulnerability monitoring, patch management, web content filtering, and rollback are missing features
- Management and implementation can be complicated
- Palo Alto customers make up a big part of the market; need for broader visibility
Palo Alto Networks matched F-Secure for the highest independent test scores, with strong results from both NSS Labs and MITRE. And that security can be had for a price that’s a little above average. NSS Labs found that Palo Alto’s Cortex XDR system handled all manner of attacks, including handcrafted (targeted attacks). Palo Alto also came out on top in the first round of the rigorous MITRE [email protected] evaluations, and in the top two or three in the just-released second round results. The only weak spot in the NSS tests was social exploits embedded in documents, where Palo Alto stopped just over 60% of attacks. Alerting capabilities are solid, and AI and behavioral analytics track threats across endpoints, the network and the cloud. Users report some issues with integration and support, and some of the less common EDR features are missing: vulnerability monitoring, patch management, web content filtering, rollback. Strong integration with Palo Alto firewalls and technologies could limit the product’s market to current Palo Alto customers, but anyone seeking top security and a product that goes beyond endpoints should take a look.
Palo Alto Ratings
See our comparison of Palo Alto and Check Point
Key takeaway: A good choice for any company looking for solid security and ease of use on a budget.
- Solid security for a low price
- Ease of use
- Can be resource-intensive
- VPN costs extra
- Underwhelming MITRE round two evaluation
Kaspersky’s EDR offering offers solid security at bargain-basement prices, which also makes the product one of the more popular ones on the market. It’s a feature-rich product too, with an additional cost for VPN the only noteworthy omission. Users like the product’s automation features that surface the most critical issues, its investigation and response capabilities, top-notch research, ease of implementation and use, and support. Some users have said the product can be resource-intensive, straining CPUs, and Kaspersky’s raw score in the just-released second round of MITRE testing was below average. The Moscow-based company has also moved much of its data processing to Switzerland to ease any suspicions about ties to the Russian government.
See our comparison of Kaspersky and Bitdefender
Microsoft Defender for Endpoints
Key takeaway: With its integration into Windows source code, Microsoft Defender is a natural for Windows environments, but the product’s strong security makes it a contender elsewhere too.
- Strong security
- Windows source code integration
- Management and ease of use
- Lots of standard features like vulnerability and configuration management
- Analyst workflow a missing feature
- Rogue device discovery and VPN cost extra
- Some reports that it can get pricey
Microsoft has invested significantly in its security capabilities and in-house development, and the result was an impressive performance in both rounds of the rigorous MITRE [email protected] evaluations. By virtue of including its endpoint security software in Windows 10, Microsoft is number one in deployed endpoints, but the company is taking the Mac and Linux markets seriously too, and has also addressed licensing concerns by making Defender for Endpoints (previously called Defender Advanced Threat Protection) available as a standalone EDR product or as part of a suite. Microsoft turned in top-tier performances in the first two rounds of MITRE [email protected] evaluations, proof that the software giant intends to be a player in endpoint security. Management and Ease of Use were two areas the product scored high in. Defender is feature-packed, with analyst workflow the lone missing feature, and rogue device discovery and VPN available for an additional cost.
Microsoft Defender Ratings
Learn More about Microsoft Defender Advanced Threat Protection
Key takeaway: Trend Micro Apex One should be considered by those seeking strong security on a budget.
- Price, value and TCO
- Cloud office support
- Strong security
- Missing features: analyst workflow, custom rules, rollback
- Features that cost extra: patch management, full-disk encryption, device control, threat intelligence feed integration, VPN
- Some deployment issues
- Some reports of malware needing to be removed manually
Apex One, Trend Micro’s combined EPP/EDR offering, scores highest in value, not surprising since it’s priced at the low end of the EDR market. With a top-tier performance in the just-released second round of MITRE evaluations, it’s one of the biggest bargains in the market. Apex One’s combination of low cost and good security effectiveness gave it one of the best total cost of ownership (TCO) scores in NSS Labs testing last year. Office 365 and Google G Suite integration are a focus, a plus for cloud office suite users. There have been some issues with deployment, and users have reported occasionally needing to manually remove malware found by the product. A number of features are missing or cost extra, like patching, device control, analyst workflow, custom rules, and rollback, but as the product is at the low end of the pricing spectrum, those features can be added at a pretty reasonable cost when available.
Trend Micro Ratings
Learn More about Trend Micro
VMware Carbon Black
Key takeaway: Carbon Black is popular with sophisticated security teams, but those needing more standard features may find value too.
- Ease of use and product capabilities are strengths
- Well integrated EPP and EDR
- Advanced threat hunting may cost extra, but it’s well done
- Features that cost extra: advanced threat hunting, vulnerability monitoring and patch management
- Features not offered: full-disk encryption, web content filtering, device control, guided investigation, rollback, VPN
- Despite relative value, a few users report that the product can get pricey
Ease of Use and Value were the areas VMware Carbon Black scored highest in, perhaps a little surprising for a product priced in the middle of the pack. Users are pretty high on the product’s capabilities, which were solid enough to give it a very good TCO score in NSS Labs testing last year. Security is good too, with solid scores in NSS Labs and MITRE testing. One downside is that a number of features that might be expected in a mid-to-high end product are missing or cost extra: vulnerability monitoring, device control, guided investigation, advanced threat hunting and rollback among them. Predictive Security Cloud is the flagship offering, with options for threat hunting and response, and audit and remediation, and is popular with sophisticated security teams, but those needing more standard features may find value in Carbon Black too.
VMware Carbon Black Ratings
See our comparison of Carbon Black and CrowdStrike
Key takeaway: A comfortable choice that gets the job done.
- Many standard features: vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery
- Good security
- Overall balanced scores
- Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost
- Rollback isn’t offered
- Pricing can be high
- Can be resource-intensive on endpoints
Now owned by Broadcom, the EDR market leader hasn’t been resting on its laurels, not that any vendor could afford to in such a competitive market. Symantec Endpoint Security (SES), the vendor’s combined EPP-EDR offering, offers advanced features such as vulnerability remediation, threat hunting and targeted attack analytics. Response, Management, Ease of Use and Value were all good, indications that Symantec has put together a solid product. Pricing can range from low-cost to very expensive, depending on features selected. Standard features include vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery and more. Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost, while rollback isn’t offered, the only missing feature on our 28-item checklist. Symantec recently posted a very good raw score of 85% in the second round of MITRE testing, but as quite a few detections were made by MSSP only, we expect that Symantec’s EDR and services teams are getting together to make sure that both products get maximum benefit from the MITRE evaluations. Symantec has made some good choices and gets solid marks from users across the board.
Learn More about Symantec
Key takeaway: Bitdefender is one that SMBs should be taking a look at, and even some enterprises too, as the company has basic and advanced offerings for both SMBs and enterprises.
- Good security
- Popular with SMBs
- Good automation features
- Missing: guided investigation, threat intelligence feed integration, custom rules
- Available at a premium: patch management, full-disk encryption, rogue device discovery
- Can get pricey
Bucharest-based Bitdefender is popular with small and mid-sized businesses that want their endpoint security to do a lot of the work for them, and Bitdefender GravityZone can do that with machine learning, behavioral monitoring, risk analytics and automated remediation. Those features come at a cost, however, and for a product that can get pricey, a number of advanced features are missing, like guided investigation, threat intelligence feed integration and custom rules. Patch management, full-disk encryption, and rogue device discovery can be had at a premium. Security is good, with solid scores in NSS Labs and MITRE evaluations.
See our comparison of Bitdefender and Kaspersky
Key takeaway: BlackBerry Cylance is for enterprises willing to pay extra for protection against unknown threats, but that extra cost may pay for itself in reduced remediation time.
- Automated remediation
- Time-saving response and management capabilities
- Stops unknown threats
- Missing features: behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, rollback
- Some implementation challenges
- Can be pricey
Rounding out our top vendor list is Cylance, acquired by BlackBerry last year. One standout feature is its automated response abilities, and users are also high on the ability of CylancePROTECT EPP and CylanceOPTICS EDR to stop ransomware and unknown threats. NSS Labs and MITRE scores have been solid, but the product can be pricey. Threat hunting and custom rules are some of the advanced EDR features offered, but a number of advanced features are missing, like behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, and rollback. OPTICS in particular may present some implementation challenges, but users are generally pleased with the results.
BlackBerry Cylance Ratings
Learn More about BlackBerry Cylance
In addition to the features common to all our top EDR vendors, here’s a chart evaluating their capabilities in additional areas like behavioral detection, automated remediation, vulnerability monitoring, analyst workflow, guided investigation, threat intelligence feed integration, custom rules, advanced threat hunting, and device discovery and control. We note whether a feature is native to an EDR product, added via integration with another product, often as part of an integrated security suite, or not offered at all.
Here are a number of additional EDR products that impressed us. Many of these have posted impressive scores in rigorous third-party testing. Vendors in this category are more likely to have an offering that is best for specific uses cases, or are emerging and worthy of consideration.
Sophos: Sophos Intercept X had a strong showing in NSS Labs testing last year and is priced toward the low end of EDR products, making it a security bargain. Users have had their complaints – false positives, implementation and performance overhead are a few – but you won’t find many complaints about its security performance. We’d like to see Sophos join the MITRE [email protected] evaluations to confirm that strong security. In the meantime, it remains a bargain worth considering.
McAfee MVISION: A relative newcomer to the EDR market, McAfee has been quick to offer advanced features such as behavioral blocking, credential theft monitoring, rollback options and more. McAfee scored among the leaders in Value and posted a solid performance in the first round of the rigorous MITRE [email protected] evaluations, but didn’t fare as well in the second round. McAfee has the pedigree to continue to evolve in the EDR (and any security) market, so they’re one to watch. Certainly one for McAfee users to consider, as well as others.
Elastic/Endgame: A recent acquisition combining two strong security companies – Endgame in endpoint security and Elastic in SIEM – makes Elastic a vendor to keep an eye on. MITRE and NSS Labs scores were particularly impressive, so anyone valuing strong security should have a look.
Cybereason: An up and coming vendor with an impressive vision for the future, Cybereason scored well in the first round of MITRE [email protected] evaluations, roughly average in the second round, and then followed that up with the highest score from NSS Labs this year, serving notice that this next-gen EDR vendor is for real.
Cisco AMP for Endpoints: Solid security at bargain prices; particularly well matched for Cisco shops. We’d like to see Cisco join the MITRE evaluations, which are rapidly becoming a standard measure in the field.
FireEye: Positioned more as a security platform vendor, but EDR is part of that platform, and with a solid performance in both rounds of the MITRE [email protected] evaluations, it’s one worth considering, particularly if you’re looking to add other services to your EDR system.
Fortinet/enSilo: Fortinet may be best known for its firewalls, but with a low-cost, solid, easy-to-use EDR offering and the recent acquisition of the more advanced enSilo, the company is one to watch in the EDR space.
WatchGuard/Panda: A recent acquisition combines Panda’s strong EDR security, which received high marks from NSS Labs, with WatchGuard’s strength in firewalls and network security.
Comodo: Strong test results from NSS Labs and solid user reviews should bring Comodo some notice. Users report some challenges with implementation and ease of use, but are otherwise satisfied.
ESET: An established EDR vendor with a strong presence with SMBs and a global reach.
We analyzed third-party test data, user reviews, product features, analyst reports and reseller pricing, and winnowed an initial list of more than 30 EDR vendors to come up with our list of 12 top vendors and 10 honorable mentions.
Here’s an explanation of our ratings categories, in order of our weighting:
Detection: It’s important that EDR products stop a high percentage of threats, but detection is also about advanced features that protect more than a traditional endpoint security platform might, such as threat hunting, correlation, and fileless threat detection. User opinions of the product’s capabilities also factor into our ratings.
Response: Here we judged how well the product removes threats, alerts security teams and guides response. Advanced features, such as automatically surfacing the most important threats and guided investigation, were also considered.
Management: Ease of use plays a role here, but more important are features that give a security team control over endpoints, such as vulnerability assessment, patching, endpoint control and more.
Ease of use: The higher the score, the more suitable the product may be for SMBs or less experienced security teams.
Support: Everyone contacting support has a problem that needs solving, so responsiveness matters.
Value: Value isn’t just price – where a product is truly low-cost, we note that – but is also about advanced features and high security that cost less than competing products and save companies data breach costs and security staff time in the process.
Deployment: This isn’t just about how easy a product is to implement, but also how well it integrates with user environments and how easy it is to deploy new endpoints.
Endpoint detection and response (EDR) gives security teams a centralized platform for continuously monitoring endpoints and responding to incidents as they arise, often via automated response.
One important trend to note: EDR software products have been rapidly converging with endpoint protection platforms (EPP), which go beyond traditional antivirus software to offer protection against advanced threats such as fileless malware, so one thing EDR buyers should look for is a product that combines both, or gets EPP and EDR tools to work together as seamlessly as possible. All our top EDR products have that feature, and they also all offer machine learning-based detection, advanced fileless threat protection, correlation and automatic Indicators of Compromise (IoC). For more, see our section on key EDR features.
EDR is just one part of endpoint security. There are a number of other security practices and technologies that organizations should be looking at.
What is Endpoint Security?
Endpoints are one of the most common entry points for malware and malicious actors – and thus one of the most important elements of IT security. Keeping endpoints safe and secure and catching attacks before they spread is one of the critical functions of EDR and EPP solutions (and of consumer-grade antivirus software too).
Endpoint Security Challenges
Complicating endpoint security is the myriad devices that connect to a corporate network, from laptops and workstations to servers, mobile devices, BYOD users, routers, WiFi access points, IoT devices and point of sale systems. All represent potential attack points.
The devices themselves aren’t even the weakest link of endpoint security: it’s the users themselves who click on malicious links and open questionable email attachments with little thought to what they contain. That alone makes employee security training an important part of endpoint security.
Unknown threats like zero-day exploits and advanced threats like fileless malware make it essential that your endpoint protection vendors have the research and development teams necessary to respond to the constantly shifting threat landscape.
Employee onboarding and departure can be security risks too, making account, network and application control other essential security tasks.
Endpoint Protection Steps
There are a dizzying array of endpoint security concerns, from malware to data theft to network and application access – and each one of them has a corresponding control or product that organizations can deploy.
EDR solutions can contain a great many of these security technologies, so create a checklist of what you need and look for the vendor that best meets your requirements. Possibilities include:
- Data loss prevention (DLP) and insider threat protection
- Vulnerability management
- Application whitelisting and control
- Identity and access management (IAM) and authentication
- Network access control (NAC)
- Data classification and protection
- Privileged account management
- Endpoint encryption
That last point merits its own discussion. Endpoint encryption has increasingly become a must-have for enterprises dealing with sensitive data, from corporate secrets to compliance regulations like PCI-DSS that require encryption. Encryption can protect data from unauthorized access, even when a device is lost or stolen.
There are two basic kinds of endpoint encryption: full disk and file-based. Full disk encrypts everything on a drive except what’s needed to boot up, but then is no longer encrypted once the user accesses the data. File-based, on the other hand, stays encrypted until an authorized user opens it. Both encryption types could be used together to maximize security.
EDR systems offer a way to centrally monitor and manage that encryption. Roughly half of EDR vendors offer encryption with their products, either as part of the product or an add-on solution. Some monitor the status of BitLocker, the native encryption tool that comes with Microsoft Windows. But regardless of how you implement it, encryption is becoming a must-have for organizations of all types and sizes.