Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.
$2.50
per user/per month
ThreatLocker
Score 9.5 out of 10
N/A
ThreatLocker Inc. is a security platform used to stop misuse and vulnerable software as well as control application elevation, storage and network traffic.
We have not used anything else other than Microsoft Defender for Endpoint. Maybe we've used other antivirus software like Sophos and things like that. They're just not all encompassing and that's why we moved to use this product.
I have been working with customers that they are transitioning from Sentinel One, CrowdStrike to Defender for Endpoint, right? So I think it's because they see the value in the product and also they see how much they can save in terms of the cost for companies because they …
We previously used CrowdStrike on our servers. However, the seamless integration of Microsoft Defender (MD) with XDR and the entire Microsoft ecosystem led us to choose Microsoft Defender for Endpoint (MDE).
What we love more about this product is the way this pro gets integrated into the other family of solutions, especially Defender for Identity or the XDR solutions. We think that the market, the customers are full of unattended consults coming out from different vendors and that …
Microsoft Defender for Endpoint is more advantageous in our windows heavy infrastructure and it was unparalled in the ease of integration with windows endpoints. Security breaches, system crashes and outages with other competitors like Crowdstrike made it easier for us to go …
CrowdStrike Falcon is also a good solution for endpoint protection which offer EDR Soultion, threat hunting and AI driven threat protection. Sophos Intercept X combines next-gen antivirus with advanced EDR capabilities with its deep learning technology, exploit prevention, and …
Microsoft Defender for Endpoint is unique for its effortless deployment into the Microsoft ecosystem, where it taps the broadest set of threat intelligence from more than 1.5 billion endpoints. Its state-of-the-art AI-powered automated investigation and remediation minimize …
We started onboarding macOS devices on jamf and started managing it. Because Defender for Endpoint is not working as expected for and compared to price and functionality we are switching from it.
CrowdStrike and SentinelOne. CrowdStrike, you have to deploy it, but it's the defender, it's already baked into the operating system. Same thing with SentinelOne.
I'm not familiar. It's just been one year plus that I started using, so I've just started using Defender, so I really don't know how to compare it with others.
I would say at the end all they are doing the same, but with the benefit that we don't need to install anything. So it's just kind of enabling and then the functionality is available, so other products need to be installed, which is not necessary with the defend
We use Defender in the cloud. We are currently using Defender in the cloud and also evaluating the XDR solution for programmatic. It's just arguments, the defense in depth. You have Defender Endpoint and then you have what you have in the cloud as well, so it's just augmenting …
Before using Defender for Endpoint, we basically had the starter version of the Microsoft product, which comes prebuilt into the system. We had them using in the initial run, but then what usually happened was the employees started disabling it, and that usually made, we guys …
I am a big fan of Tanium actually, so I think it is good. Tanium seemed like it was maybe a little bit easier, but maybe the capability was lacking. Maybe that's the reason why it seems like Defender for Endpoint might be a little harder to understand. There might just be more …
CrowdStrike Falcon, and Sentinel One are other big ones that we use a bit. Cisco Secure Endpoint we've evaluated as well. Cisco Secure endpoint capability-wise doesn't match up to Defender, SentinelOne, and CrowdStrike both do, but the cost profiles are a bit higher. So most of …
I would say not to name specific company names, because I'm a partner with one of them and that's the account that I work with. But I use some competing solutions that I would say are pretty heavy from an overhead perspective with the agent that has to be installed in the …
Prior to buying ThreatLocker, we evaluated Tanium's whitelisting module. We felt that ThreatLocker's method of baselining existing applications and comparing them to known IoC's made for an easier implementation. To be fair, this was solely based on demonstrations by each …
The pricing is what matters the most on this. We went with ThreatLocker mostly because of their pricing and as time has gone on, we have completely fallen in love with the tool. The vendor support is miles better than all other tools I have used and being able to freely …
I honestly have not seen many other programs like Threatlocker so I do not have any to compare to. Auto-Elevate may be the closest, however I did not evaluate them as part of my decision. Threatlocker does do a great job at onboarding which made deploying, setting up, and …
We chose Threatlocker because it is unique in that it specializes in a specific area, whereas other products offer a broader range of capabilities. It blocks software from running and provides us with all the necessary information for this purpose in an easy-to-use graphical …
Because of its integration with Windows, it is very easy to deploy and manage. Any IT department should be able to leverage the software and interface. The admin portal provides weighted recommendations that comprise the Secure Store, offering admins, security teams, and business owners valuable insights into their security footprint without requiring a strong security background. The software would be ideal for small and mid-sized businesses that cannot dedicate resources to security. Larger enterprises would also benefit, but may require the enhanced license.
If you want to know what is running in your environment and what it is trying to access, you should be able to take preemptive measures to prevent and protect yourself from it. ThreatLocker is the system for you! It will replace almost any EDR requirement, although I recommend you partner it with Windows Defender.
One, it's crazy lightweight, so compared to some of the competitors that we also have used with our security services, it's really lightweight and so I don't have a lot of overhead on the system that it's running on.
So the fact that Defender for Endpoint still works with signatures is actually, I don't know, a little difficult for us because, I mean, since Microsoft trusts those signatures, you can easily inject code. And we've done it many times. To show that you can inject code through vulnerabilities like CV 2013, 99, and 33 but still keep the signature. So because of the trust of those signatures, the malware just kind of slides into the environment without Defender knowing. That's the first part. The second part is that the behavioral analysis is not precisely its Prime. It's not Defender's best capability for endpoints. So, Defender does not identify all behaviors considered by other EDRs in the market.
Microsoft Defender is closely catching -up in market with existing competitors they have added DLP endpoint & DLP Network and Cloud DLP solution last year with OCR capabilities. I would say Microsoft Defender is not legacy Vendor in end point security, the need to learn from other vendors in market and focus on new XDR technologies, which is going to be new battle for all vendors
ThreaLocker has done its job and has prevented malware from executing. It has stopped an encryption process once already. It has kept a user from going to a bad website. He tried twice and was wondering why he was getting an error message from ThreatLocker and ESET both.
Because in terms of the usability is easy to understand, it's easy to manage, obviously you need to have specific skills to do that, but I would say that even the console and the product is walking through the flow that you are looking for on this console.
The console is very user friendly and is frequently updated based on user requests. It is well laid out and many of the areas allow the ability to pivot from one area to another without having navigate the entire menu tree. Much of what you do is to query activities on a given PC and the application allows you to save frequently run queries.
Microsoft Defender for Endpoint chugs along just fine no matter what we throw at it and what systems it's running on. It doesn't take up a lot of resources either, so that's welcomed.
Overall support is really good for this product. Since it's a Microsoft product, you will get good support from a number of different resources, including knowledgebase articles on the web, support from Microsoft technicians, and documentation (which tends to very thorough). Also, there is a vast user support community for this product, so user support forums would also be another valuable channel to get help if needed. I don't envision too many people will have issues/problems with the product, as it tends to run good overall.
You can email, call or do online chat with tech support. I love their online chat. They are quick and friendly. Also, if you need to show them something, you can give the chat technician permission from your Chat box to allow the tech access to your computer. They also can pull out your admin console on their side. They can look at your "Unified Audit" log and see the same thing that you can. They have a good KnowledgeBase that you can look for answers. They have what is called "ThreatLocker University" where you can go through tutorials and take tests.
The owners and co-founders work with you through Zoom Meetings. They walk you through how to use and setup ThreatLocker. They also have webinars. You also can go through ThreatLocker University online training.
Using ThreatLocker University online training is very easy and informative. You take online tests to see how well you learned the material. It is great!
Deployment was handled by our team here and everything went pretty smoothly. We did have a few hiccups in our test group, but that only took a bit to get ironed out.
ThreatLocker is a family ran business. The owners, co-founders work with you to ensure you are up and running as quickly as possible. They went to ensure your success with ThreatLocker.
Microsoft Defender for Endpoint offers strong integration with Microsoft 365 and Azure services, which provide a unified security experience. While McAfee Trellix is known for solid antivirus, Microsoft Defender excels in integration in the ecosystem.
We chose Threatlocker because it is unique in that it specializes in a specific area, whereas other products offer a broader range of capabilities. It blocks software from running and provides us with all the necessary information for this purpose in an easy-to-use graphical user interface (GUI), which is all we need for our use case.
ThreatLocker is very easy to add new ThreatLocker agents on computers and servers. It is very easy to do. You can install an agent on a computer or server in about 2 minutes or less.
Applications that are new to the environment can be blocked even if they are wanted. Which can cause strain on the environment if not properly tuned or prepped.
We have this deployed onto around 7700 endpoints at this moment with less than 0.01% of issues with the agent or its functionality being noted. It's incredibly stable and the Vendor support further helps if it does break, and they can usually fix it without 15 mins.
We have had this tool on customers, and it has single handedly stopped Ransomware attacks by itself when the customers previous EDR failed to catch threat actor attacks. I can remember 3 separate instances where someone did something to cause an attack and ThreatLocker brought it to a screeching halt due to the application control and built-in ringfencing it provides.
