Microsoft Defender for Endpoint

Score8.7 out of 10

222 Reviews and Ratings

What is Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.

Categories & Use Cases

Endpoint Security

Media

1 / 5

Screenshot of blocked activities

Infection Remediation
Capability to quarantine infected endpoint and terminate malicious processes.
Category average: 8.9
Endpoint Detection and Response (EDR)
Continuous monitoring and response to advanced internet threats by endpoint agents.
Category average: 9.1
Centralized Management
Centralized management supporting multi-factor authentication, customized views, and role-based access control.
Category average: 8.5

Anti-Exploit Technology
In-memory and application layer attack blocking (e.g. ransomeware)
Category average: 8.6
Vulnerability Management
Vulnerability prioritization for fixes.
Category average: 8.3
Hybrid Deployment Support
Administrators should be able to choose endpoint security on-premise, cloud, or hybrid.
Category average: 8.3

Most Frequent Users

Top 3 industries using Microsoft Defender for Endpoint.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

24.1%

1,106 installations of 4,597

“We use all platforms.”

#2 most frequent

Manufacturing

10.2%

470 installations of 4,597

#3 most frequent

Finance and Insurance

9.9%

454 installations of 4,597

Pros

Strong endpoint protection capabilities
Effective threat detection and resolution
Positive ROI due to integration with Microsoft ecosystem

Cons

Integration and deployment challenges
High number of false positive alerts
Cumbersome user interface and management experience

Verified User

Consultant in Information Technology (10,001+ employees)

Use Cases and Deployment Scope

In our organization, we use Microsoft Defender for Endpoint to protect against malware, phishing, and other advanced threats. It provides real-time threat detections and automated remediations. This application assists us in improving endpoint compliance and centralized control.

Pros

Endpoint detection and response.
Real time threat detection.
Centralized dashboard.
Role-based access.

Cons

High CPU usage, the application should be lighter.
Improvement needs in UI.
Rules customization in limited.
Mobile support is not as good as a desktop application.

Return on Investment

Strong Microsoft ecosystem.
Integrating multiple security tools.
Threat detections and remediations.
Licensing is expensive.

Usability

Return on Investment

In our organization, we primarily focus on the Microsoft ecosystem. We manage approximately 20,000 endpoints, such as laptops and virtual servers. Although we have Mac & Linux, it's very limited, as the majority of our infrastructure is based on Windows.

Alternatives Considered

Trellix Endpoint Security ENS and Cisco Secure Endpoint

Other Software Used

Sentinel, FortiClient

Michael Miller

IT Engineer in Information Technology at Carolina West Wireless (51-200 employees)

Use Cases and Deployment Scope

We used Defender to replace Sophos. Being included as part of the Microsoft 365 package saved us the entirety of the cost of the previous provider. It also provides significantly more detailed security insights into our devices. Dashboard scores are used to help proactively respond to threats. The software also includes threat assessment to see all of the vectors an attacker would use.

Pros

Dashboard for threats.
Ease of installation.
Rapid response to threats.

Cons

PC reporting often lags behind, so scores remain unchanged longer than desired.
The portal interface changes regularly, moving objects and menus.
It needs a more defined client interface to resemble a traditional third-party antivirus.

Return on Investment

Was able to alert us to a malicious event overnight, tracking the incident end-to-end.
Gives management clear insight into the security footprint of the company.
Saved several thousand dollars a year in 3rd party antivirus costs.

Return on Investment

We are currently deployed to around 200 total PCs and servers. Our PCs are mostly Windows 11 with a few Windows 10 PCs that are in the process of being replaced. Our servers are entirely Windows-based, with most using Server 2019. We are not currently using Defender on mobile devices.

Alternatives Considered

Sophos Managed Detection and Response

Other Software Used

Microsoft Intune, Microsoft Exchange Online Archiving, VMware vSphere

Danny Nagdev View profile

Founder in Corporate at LetsReflect (1-10 employees)

Use Cases and Deployment Scope

We use Microsoft Defender for Endpoint as an antivirus to protect our systems from different types of malware. It helps us uncover attacks which are happening on our machines. Also, it is useful in getting timely alerts for such attacks.

Pros

Detect attacks
Prevent infection from malware
Provide alerts

Cons

Easy to use management interface

Return on Investment

It has reduced the expert manpower requirement to less than 50% for detection
For initial configuration, it took lots of time.

Return on Investment

Mostly Windows clients (around 100 computers)

Alternatives Considered

Sophos Intercept X

Other Software Used

Sophos Intercept X

Gaurav Sharma

Sales Head in Sales at Lenovo (51-200 employees)

Use Cases and Deployment Scope

We use Microsoft Defender for Endpoint for phishing emails where we have installed the endpoint as well as all other users endpoint laptops where we use it to monitor all threats and take appropriate action accordingly.

Pros

Great threat detection and management.
No major impact on performance of the device.
Securing our buisness in and out.

Cons

User Interface can be worked upon.
Improving Capabilities with non windows environment.
Latest Security updates timely.

Return on Investment

A centralised reporting dashboard.
Active background scanning and analysis with proper threat management.
Securing overall buisness from threats like phishing, malware, Virus, etc.

Return on Investment

Around 15 devices and all are on windows.

Alternatives Considered

Norton Small Business

Other Software Used

CA Workload Automation

Paolo Heuer

Cybersecurity Director in Information Technology at Impresoft 4ward (501-1000 employees)

Use Cases and Deployment Scope

It's our primary EDR on client and servers.

Pros

It's particularly good to log and integrate with the Microsoft Security stack and to protect and have details on what happening on devices.

Cons

difficult to use Live Response
quite difficult to install it on legacy operating system.

Return on Investment

As a partner and as a reseller, we recommend it to every customer. The problem of the challenge here is that other EDRs are sold as a lower price and not every customer understands the value of having this type of application and this type of features on their environment.

Return on Investment

We are protecting 250 Windows clients and 150 windows and Linux Servers

Alternatives Considered

CrowdStrike Falcon

Symantec Endpoint Security

Sophos Intercept X

CrowdStrike Falcon

Microsoft Defender for Endpoint

What is Microsoft Defender for Endpoint?

Categories & Use Cases

Media