ماه: می 2020

Endpoint security is a cornerstone of IT security, so our team put considerable time and thought into this list of top endpoint detection and response (EDR) vendors.

IT security isn’t just about raw test scores, although independent testing is very important in our view. It’s also the advanced features that provide additional protection, the ease of implementation and use, management control of endpoints and threats, value and support, and so we rate EDR products in all those areas. Generally, the more you pay, the more advanced features you get, and many vendors offer multiple levels of products at different price points.

One important trend to note: endpoint protection platforms (EPP) and endpoint detection and response (EDR) products are rapidly converging, so one thing EDR buyers should look for is a product that combines both, or gets EPP and EDR tools to work together as seamlessly as possible. All our top EDR products have that feature.

We rated more than 30 EDR products in seven key areas and measured 130 data points for each vendor to come up with our list of 12 top EDR vendors and 10 honorable mentions. For more on our methodology and ratings, see our Methodology section.

https://o1.qnsr.com/log/p.gif?;n=203;c=204660767;s=9477;x=7936;f=201812281314300;u=j;z=TIMESTAMP;a=20392941;e=i

So with that context, here are our picks for top EDR products, followed by honorable mentions.

Top EDR products

CrowdStrike Falcon

CrowdStrike Falcon is popular with analysts and users alike – and it came out on top in our analysis too. Falcon is near the top in raw security scores, but when factoring in the product’s advanced features, it wound up with an overall Detection score well above any other vendor on this list. It also scored high in Response, Management, Ease of Use, and Support. Pricing is above average, but as all EDR products save millions of dollars in breach and remediation costs, price is relative, and well-executed advanced features pay for themselves. Falcon offers almost all the standard features you’d expect in a top EDR product, although automated remediation costs extra. Web content filtering and VPN aren’t offered, and for encryption it merely reports on the status of Windows BitLocker, but none of those features are widely offered enough to be considered a standard EDR feature. Users score it high in capabilities, implementation, cloud-based management, and Linux and technical support, among other areas. But CrowdStrike’s biggest strength is the additional services offered with Falcon, including threat hunting, vulnerability assessment and more. In short, CrowdStrike is for those willing to pay for advanced features that are hard to beat.

Pros:

• Happy customers
• Easy cloud-based implementation
• Advanced features that deliver

Cons:

• Can get pricey
• A few vendors have higher raw independent test scores – but in any other product, we’d place that in the “Pros” section
• Web content filtering and VPN needs would have to be met in other ways

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
CrowdStrike	4.7	4.7	4.5	4.6	4.6	4.7	4.8

 

Check Point Software SandBlast

Check Point’s SandBlast offering was tied for second overall on the strength of its top-notch security and support at a good price. It received the highest score in Ease of Use and came in second in Management, and its automated response capability is also good, making it a strong candidate for smaller companies or those with less sophisticated security teams. In NSS Labs testing, SandBlast handled everything thrown at it, with the sole exception of targeted (hand-crafted) attacks, where it stopped 40%. It offers full-featured management, although users report some challenges with implementation. Check Point also offers a remarkably full-featured product for a price that’s toward the lower end of EDR products, with custom rules the only missing piece. There may be cheaper products and there may be more advanced ones, but none offer better security for the price. It’s a good match for companies of all sizes seeking strong endpoint security at a good price point, particularly those who want their EDR solution to do some of the work for them.

Pros:

• Automated response
• Ease of use and management
• Full-featured at reasonable cost

Cons:

• Custom rules missing
• Some implementation challenges reported

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Check Point	4.4	4.6	4.7	4.1	4.9	4.6	4.5

 

SentinelOne

SentinelOne tied for second overall, with top scores in Detection, Deployment and Value. SentinelOne users are among the happiest in the EDR space, and they have good reason to be. The product’s automated response features are rated highly by users, which could make SentinelOne a good choice for smaller companies and those without a sophisticated security team. Security scores are good, and SentinelOne even came out on top in the second round of MITRE testing – that’s no small feat, as participants are basically trying to stop Russian nation-state hackers across 140 areas. Missing features include full-disk encryption, VPN, mobile support and web content filtering, and rogue device discovery can be had at an additional cost, but as only about half of top vendors offer those, it would be hard to call them standard features. SentinelOne isn’t the cheapest EDR product on the market, but even there, price is often cited as a reason for buying. A good choice for companies willing to pay for advanced features without sweating the details too much.

Pros:

• Automated response
• Strong security at a reasonable price
• Good security for less sophisticated teams

Cons:

• Missing features: full-disk encryption, VPN, mobile support, web content filtering
• Rogue device discovery offered at an additional cost
• Not for those buying on price alone, but otherwise a good value

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
SentinelOne	4.5	4.8	4.4	4.6	4.5	4.8	4.5

 

F-Secure

F-Secure, headquartered in Helsinki, matched Palo Alto for the highest independent test scores. The company offers some of the best security on the EDR market for a price that’s about average, with some of the highest scores in the MITRE evaluations. It gets high scores for Ease of Use and Value too. F-Secure boasts a solid lineup of advanced features, but they can come at an additional cost: vulnerability monitoring, custom rules, advanced threat hunting, rogue device discovery, rollback, VPN. Still, the list of features is pretty thorough. Users report some difficulty with implementation, but support and services are there if you need them. In short, if top-notch security is a requirement, F-Secure is a good one to add to your shortlist.

Pros:

• Top security
• Full lineup of advanced features, but some cost extra
• Ease of use and value

Cons:

• Advanced features can cost extra
• Some implementation challenges

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
F-Secure	4.5	4.4	4.3	4.4	4.7	4.7	4.4

 

Palo Alto Networks Cortex XDR

Palo Alto Networks matched F-Secure for the highest independent test scores, with strong results from both NSS Labs and MITRE. And that security can be had for a price that’s about average. Palo Alto’s Cortex XDR system is priced solidly in the midrange of EDR products, where a majority of vendors seem to price their EDR offerings. NSS Labs found that the product handled all manner of attacks, including handcrafted (targeted attacks), and Palo Alto came out on top in the first round of the rigorous MITRE ATT@CK evaluations, and in the top two or three in the just-released second round results. The only weak spot in the NSS tests was social exploits embedded in documents, where Palo Alto stopped just over 60% of attacks. Alerting capabilities are solid, and AI and behavioral analytics track threats across endpoints, the network and the cloud. Users report some issues with integration and support, and some of the less common EDR features are missing: vulnerability monitoring, patch management, web content filtering, rogue device discovery, rollback. Strong integration with Palo Alto firewalls and technologies could limit the product’s market to current Palo Alto customers, but anyone seeking top security and a product that goes beyond endpoints should take a look.

Pros:

• Top scores in third-party security tests
• Ability to handle advanced attacks
• AI and behavioral analytics, strong alerting capabilities
• Tracks threats across endpoints, networks and cloud

Cons:

• vulnerability monitoring, patch management, web content filtering, rogue device discovery, and rollback are missing features
• Management and implementation can be complicated
• Palo Alto customers make up a big part of the market; need for broader visibility

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Palo Alto	4.4	4.6	4.3	4.3	4.4	4.4	4.5

 

Kaspersky

Kaspersky’s EDR offering offers solid security at bargain-basement prices, which also makes the product one of the more popular ones on the market. It’s a feature-rich product too, with an additional cost for VPN the only noteworthy omission. Users like the product’s automation features that surface the most critical issues, investigation and response capabilities, top-notch research, ease of implementation and use, and support. Some users have said the product can be resource-intensive, straining CPUs, and Kaspersky’s raw score in the just-released second round of MITRE testing was below average. The Moscow-based company has also moved much of its data processing to Switzerland to ease any suspicions about ties to the Russian government. A good choice for any company looking for solid security and ease of use on a budget.

Pros:

• Solid security for a low price
• Feature-rich
• Ease of use
• Support

Cons:

• Can be resource-intensive
• VPN costs extra
• Underwhelming MITRE round two evaluation

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Kaspersky	4.2	4.3	4.2	4.2	4.7	4.7	4.7

 

Microsoft Defender Advanced Threat Protection

Microsoft has invested significantly in its security capabilities and in-house development, and the result was an impressive performance in both rounds of the rigorous MITRE ATT@CK evaluations. By virtue of including its endpoint security software in Windows 10, Microsoft is number one in deployed endpoints, but the company is taking the Mac and Linux markets seriously too, and has also addressed licensing concerns by making Defender Advanced Threat Protection available as a standalone EDR product or as part of a suite. Microsoft turned in top-tier performances in the first two rounds of MITRE ATT@CK evaluations, proof that the software giant intends to be a player in endpoint security. Management and Ease of Use were two areas the product scored high in. Defender ATP is feature-packed, with analyst workflow the lone missing feature, and rogue device discovery and VPN available for an additional cost. With its integration into Windows source code, the product is a natural for Windows environments, but the product’s strong security makes it a contender elsewhere too.

Pros:

• Strong security
• Windows source code integration
• Management and ease of use
• Lots of standard features like vulnerability and configuration management

Cons:

• Analyst workflow a missing feature
• Rogue device discovery and VPN cost extra
• Some reports that it can get pricey

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Microsoft Defender ATP	4.5	4.1	4.8	3.9	4.6	4.5	4.3

 

Trend Micro

Apex One, Trend Micro’s combined EPP/EDR offering, scores highest in value, not surprising since it’s priced at the low end of the EDR market. With a top-tier performance in the just-released second round of MITRE evaluations, it’s one of the biggest bargains in the market. Apex One’s combination of low cost and good security effectiveness gave it one of the best total cost of ownership (TCO) scores in NSS Labs testing last year. Office 365 and Google G Suite integration are a focus, a plus for cloud office suite users. There have been some issues with deployment, and users have reported occasionally needing to manually remove malware found by the product. A number of features are missing or cost extra, like patching, device control, analyst workflow, custom rules, and rollback, but as the product is at the low end of the pricing spectrum, those features can be added at a pretty reasonable cost when available. Apex One should be considered by those seeking strong security on a budget.

Pros:

• Price, value and TCO
• Cloud office support
• Strong security

Cons:

• Missing features: analyst workflow, custom rules, rollback
• Features that cost extra: patch management, full-disk encryption, device control, threat intelligence feed integration, VPN
• Some deployment issues
• Some reports of malware needing to be removed manually

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Trend Micro	4.5	4.3	4.5	3.4	4.5	4.7	4.4

 

VMware Carbon Black

Ease of Use and Value were the areas VMware Carbon Black scored highest in, perhaps a little surprising for a product priced in the middle of the pack. Users are pretty high on the product’s capabilities, which were solid enough to give it a very good TCO score in NSS Labs testing last year. Security is good too, with solid scores in NSS Labs and MITRE testing. One downside is that a number of features that might be expected in a mid-to-high end product are missing or cost extra: vulnerability monitoring, device control, guided investigation, advanced threat hunting and rollback among them. Predictive Security Cloud is the flagship offering, with options for threat hunting and response, and audit and remediation, and is popular with sophisticated security teams, but those needing more standard features may find value in Carbon Black too.

Pros:

• Ease of use and product capabilities are strengths
• Well integrated EPP and EDR
• Advanced threat hunting may cost extra, but it’s well done

Cons:

• Features that cost extra: advanced threat hunting, vulnerability monitoring and patch management
• Features not offered: full-disk encryption, web content filtering, device control, guided investigation, rollback, VPN
• Despite relative value, a few users report that the product can get pricey

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
VMware Carbon Black	4.3	4.4	4.2	4.4	4.5	4.6	4.3

 

Symantec

Now owned by Broadcom, the EDR market leader hasn’t been resting on its laurels, not that any vendor could afford to in such a competitive market. Symantec Endpoint Security (SES), the vendor’s combined EPP-EDR offering, offers advanced features such as vulnerability remediation, threat hunting and targeted attack analytics. Response, Management, Ease of Use and Value were all good, indications that Symantec has put together a solid product. Pricing can range from low-cost to very expensive, depending on features selected. Standard features include vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery and more. Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost, while rollback isn’t offered, the only missing feature on our 28-item checklist. Symantec recently posted a very good raw score of 85% in the second round of MITRE testing, but as quite a few detections were made by MSSP only, we expect that Symantec’s EDR and services teams are getting together to make sure that both products get maximum benefit from the MITRE evaluations. Symantec has made some good choices and gets solid marks from users across the board. A comfortable choice that gets the job done.

Pros:

• Many standard features: vulnerability and patch management, device control, analyst workflow, guided investigation, custom rules, advanced threat hunting, rogue device discovery
• Good security
• Overall balanced scores

Cons:

• Full-disk encryption, web content monitoring and threat intelligence feed integration are available at extra cost
• Rollback isn’t offered
• Pricing can be high
• Can be resource-intensive on endpoints

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Symantec	4.2	4.5	4.5	3.9	4.5	4.5	4.4

 

Bitdefender

Bucharest-based Bitdefender is popular with small and mid-sized businesses that want their endpoint security to do a lot of the work for them, and Bitdefender GravityZone can do that with machine learning, behavioral monitoring, risk analytics and automated remediation. Those features come at a cost, however, and for a product that can get pricey, a number of advanced features are missing, like guided investigation, threat intelligence feed integration and custom rules. Patch management, full-disk encryption, and rogue device discovery can be had at a premium. Security is good, with solid scores in NSS Labs and MITRE evaluations. Bitdefender is one that SMBs should be taking a look at, and even some enterprises too, as the company has basic and advanced offerings for both SMBs and enterprises.

Pros:

• Good security
• Popular with SMBs
• Good automation features

Cons:

• Missing: guided investigation, threat intelligence feed integration, custom rules
• Available at a premium: patch management, full-disk encryption, rogue device discovery
• Can get pricey

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
Bitdefender	4.5	4.1	4	4	4.5	4.5	4.5

 

BlackBerry Cylance

Rounding out our top vendor list is Cylance, acquired by BlackBerry last year. One standout feature is its automated response abilities, and users are also high on the ability of CylancePROTECT EPP and CylanceOPTICS EDR to stop ransomware and unknown threats. NSS Labs and MITRE scores have been solid, but the product can be pricey. Threat hunting and custom rules are some of the advanced EDR features offered, but a number of advanced features are missing, like behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, and rollback. OPTICS in particular may present some implementation challenges, but users are generally pleased with the results. In short, a product for enterprises willing to pay extra for protection against unknown threats, but that extra cost may pay for itself in reduced remediation time.

Pros:

• Automated remediation
• Time-saving response and management capabilities
• Stops unknown threats

Cons:

• Missing features: behavioral detection, patch management, full-disk encryption, web content filtering, guided investigation, rogue device discovery, rollback
• Some implementation challenges
• Can be pricey

 

	Detection	Response	Management	Deployment	Ease of use	Value	Support
BlackBerry Cylance	4.2	4.4	3.6	3.4	4.5	4.4	4.5

 

Honorable mentions

“Honorable mention” in no way means these vendors are second tier. In fact, many of them have posted impressive scores in rigorous third-party testing. Vendors in this category are more likely to have an offering that is best for specific uses cases, or are emerging and worthy of consideration.

Sophos: Sophos Intercept X had a strong showing in NSS Labs testing last year and is priced toward the low end of EDR products, making it a security bargain. Users have had their complaints – false positives, implementation and performance overhead are a few – but you won’t find many complaints about its security performance. We’d like to see Sophos join the MITRE ATT@CK evaluations to confirm that strong security. In the meantime, it remains a bargain worth considering.

McAfee MVISION: A relative newcomer to the EDR market, McAfee has been quick to offer advanced features such as behavioral blocking, credential theft monitoring, rollback options and more. McAfee scored among the leaders in Value and posted a solid performance in the first round of the rigorous MITRE ATT@CK evaluations, but didn’t fare as well in the second round. McAfee has the pedigree to continue to evolve in the EDR (and any security) market, so they’re one to watch. Certainly one for McAfee users to consider, as well as others.

Elastic/Endgame: A recent acquisition combining two strong security companies – Endgame in endpoint security and Elastic in SIEM – makes Elastic a vendor to keep an eye on. MITRE and NSS Labs scores were particularly impressive, so anyone valuing strong security should have a look.

Cybereason: An up and coming vendor with an impressive vision for the future, Cybereason scored well in the first round of MITRE ATT@CK evaluations and roughly average in the second round, serving notice that this next-gen EDR vendor is for real.

Cisco AMP for Endpoints: Solid security at bargain prices; particularly well matched for Cisco shops. We’d like to see Cisco join the MITRE evaluations, which are rapidly becoming a standard measure in the field.

FireEye: Positioned more as a security platform vendor, but EDR is part of that platform, and with a solid performance in both rounds of the MITRE ATT@CK evaluations, it’s one worth considering, particularly if you’re looking to add other services to your EDR system.

Fortinet/enSilo: Fortinet may be best known for its firewalls, but with a low-cost, solid, easy-to-use EDR offering and the recent acquisition of the more advanced enSilo, the company is one to watch in the EDR space.

WatchGuard/Panda: A recent acquisition combines Panda’s strong EDR security, which received high marks from NSS Labs, with WatchGuard’s strength in firewalls and network security.

Comodo: Strong test results from NSS Labs and solid user reviews should bring Comodo some notice. Users report some challenges with implementation and ease of use, but otherwise satisifed.

ESET: An established EDR vendor with a strong presence with SMBs and a global reach.

Methodology and ratings

We analyzed third-party test data, user reviews, product features, analyst reports and reseller pricing, and winnowed an initial list of more than 30 EDR vendors to come up with our list of 12 top vendors and 10 honorable mentions.

Here’s an explanation of our ratings categories, in order of our weighting:

• Detection: Not just whether the EDR product stops a high percentage of threats, but also whether it offers advanced features to protect more than a traditional endpoint security platform might, such as threat hunting, correlation and fileless threat detection, and user opinions of the product’s capabilities.
• Response: How well the product removes threats, alerts security teams and guides response. Advanced features, such as automatically surfacing the most important threats and guided investigation, are also considered.
• Management: Ease of use plays a role here, but more important are features that give a security team control over endpoints, such as vulnerability assessment, patching, endpoint control and more.
• Ease of use: The higher the score, the more suitable the product may be for SMBs or less experienced security teams.
• Support: Everyone contacting support has a problem that needs solving, so responsiveness matters.
• Value: Value isn’t just price – where a product is truly low-cost, we note that, but value is also about advanced features and high security that cost less than competing products, and save companies data breach costs and security staff time in the process.
• Deployment: Not just how easy a product is to implement, but also how well it integrates with user environments and how easy it is to deploy new endpoints.