CrowdStrike Falcon vs. Trellix Endpoint Security ENS

CrowdStrike Falcon is ideal for large, cloud-native enterprises that prioritize advanced behavioral detection and have a mature SOC to manage their intelligence. However, its cloud-reliant architecture makes it a poor fit for air-gapped or offline networks. Additionally, small organizations with limited staffing may find it difficult to manage, while teams that require integrated SOAR and vulnerability management might be discouraged by the need for additional licensing to unlock those capabilities.

Incentivized

During the pandemic all our users worked remotely that was challenging from security perspective, so we had to deploy the endpoint protection system with cloud based monitoring server. By doing that we were able to keep safety for users workspaces even though some of them did not connect to VPN for a long time

Incentivized

• The Log analysis is very detailed and easy to use.
• Prevent and block all type of malwares.
• Great threat intelligence which is very up-to-date with the recent cyber attacks
• very user friendly in access and management
• Automated feature of detecting, taking action and closing incidents using fusion workflow.

Incentivized

• Provides high fidelity alerting.
• Allows CSOC analysts to perform forensic triage and alert investigations through containment from a single pane of glass.
• Provides alert telemetry across on-disk and in-memory attacks.
• Supports many additional 'bolt-on' modules to provide additional alert context or capabilities.

Incentivized

• The Dashboard can become overwhelming at times, too much information to absorb
• Computers that may have made it out into the field without the endpoint sensor are very difficult to find
• As with all systems that rely on machine learning false positives occurr

Incentivized

• My biggest flak with McAfee Endpoint Security is that it is quite resource-intensive. It does tend to make the system a little slow. You get security at the expense of your machine's speed.
• Even though the drive encryption makes the system more secure, it takes a lot of time to first enter the very long password, and then for it to decrypt the whole machine. This sometimes clashes with Windows update and causes a lot of complications which leads to boot loops.

Incentivized

Crowdstrike has a large suite of tools built for helping the engineers triage and respond to security event whenever identified. The ability to customize the security policies and implement more granular policies to different devices based on the functionality is unmatched. Crowdstrike provides so much of ability in a decent budget which ascertains the value for money or ROI.

Incentivized

I think it is a complete and very trustful XDR platform, with very few False Positives. It is very well supported by highly skilled professionals on all levels: from pre-sales engineers, Customer Account Managers and support engineers.

Incentivized

So below is my breakdown, Pro's: Centralized Management, Comprehensive Protection and customization. Con's: Initial cost

Incentivized

Support is generally pretty fast and gets right to the issue. We haven't had to use them much, fortunately, but the issues and questions we've had are usually answered quickly. The customer success manager/account manager you're assigned will also follow up with you on a regular cadence to ensure you're getting the most out of the subscription. There's not a whole lot of room to improve, other than the general confusion about what is/what is not covered in custom packages you're subscribed to. The initial purchase took much longer because of a package name changes and realignments of different modules into those packages.

Incentivized

The support is pretty good, and I haven't had any issues with getting the highest quality technical support when there are issues. Tech support representatives that I have dealt with know the product quite well and have solved many issues that I have had with the product in the past. The only issue I have with support is that it can be quite expensive.

Incentivized

There is limited amount of learning that can be completed in an in-person training available. In my opinion, the self-paced learning provided by Falcon portal is more useful over in-person training. The support from Falcon is great and useful to overcome difficulties, if any.

Incentivized

The training provided by Crowdstrike Falcon is complete in terms of the depth of technical knowledge and teaches the users about going through with the platform. There are lots of jargons for different tools that Crowdstrike Falcon has and this training teaches them all which helps in managing the platform better. Plus, the regular knowledge checks are also very helpful for the end user.

Incentivized

Read the documentation

Incentivized

I have evaluated Cortex XDR and SentinelOne Singularity alongside CrowdStrike Falcon, and while all three are capable enterprise-grade solutions, Falcon ultimately stood out due to its cloud-native architecture, broader modular coverage, and stronger identity-focused detection. Cortex XDR performs very well in environments already heavily invested in the Palo Alto ecosystem, particularly for network-to-endpoint correlation, but it introduces additional complexity and infrastructure overhead. SentinelOne excels in autonomous remediation and offline protection, especially with ransomware rollback, but is more endpoint-centric and comparatively limited in native identity and exposure-risk context. CrowdStrike Falcon provided the best overall balance by combining NGAV, EDR, identity protection, exposure management, threat intelligence, and managed hunting within a single lightweight agent and unified console, enabling better scalability, faster investigations, reduced tool sprawl, and stronger protection against modern identity-driven attacks, making it the most aligned choice for our security and operational objectives.

Incentivized

We only selected McAfee because we are already using ESET NOD32 for the protection of our desktops and laptops. We didn't want to use the same software for our servers so we chose McAfee instead. I personally like ESET Smart Security better than McAfee when deploying it on a desktop or laptop because I think it protects the PC better. When it comes to web protection, policy updates, etc., McAfee is the better choice and that's why we deployed it on our servers.

Incentivized

• Due to some of the difficulties with Support and Sales, we are likely looking to change to another vendor. We sometimes don't feel like customers.
• When the bluescreen incident occurred (worldwide outage) in July 2024, we were unable to contact support due to the high volume of calls at the same time. We had to figure out how to remediate it ourselves, which we did, and recovered before the vendor's official release of fixes. It shook my confidence in them.
• The product itself performed well over the last 2 years, which has kept us safe and productive. The product is good.

Incentivized

• This tool helped us in delegating the asset safety responsibility to the client level by 80%, leaving 20% for the management console.
• With a decent pricing, the benefits are slightly above expectations. The ROI is good.
• But, considering most of the malware comes from internet, with a good email security appliance and next gen firewall in place, the online security alerts are now redundant. It could be something that can be termed as overkill on the budget.

Incentivized