Cylance Smart Antivirus vs Microsoft Defender for Endpoint Formerly Microsoft Defender ATP

Cylance Smart Antivirus is well suited for the typical office user. It can be very restrictive if you do not tune it properly and can cause many issues. When tuned and set up properly it is appropriate for 95% of use cases. The last 5% are ones that have the capabilities of bringing an organization down if it is not tuned properly.

Small or large organizations will benefit from using MDE. They need to provide a way to buy MDE as a standalone add-on product not only make it a bundled feature in Microsoft 365 E5. I wish it had the ability to deploy updates to 3rd party apps when the vulnerability scanner discovers a vulnerability. Currently, I have to use a 3rd party tool to address this gap.

• Blocking Scripts
• Stopping remote exploits
• easy to install

• It is great at proactively monitoring threats across the network. It works seamlessly with the client to monitor individual user computers, and it has a good real-time scanning engine.
• On the client side, Windows Defender doesn't require a whole lot of system resources to run, nor will it create unnessary slowdowns of a computer, even while scanning for threats

• Better functionality to whitelist on the Application.
• Easier to setup Mobile Settings
• Easier to understand logs

• Virus detection rates are below competitors.
• Too many notifications that end up bothering.
• Do not ask every time if you should send reports to Microsoft.

Every time I've had a question or a problem, I was able to get it addressed quickly. Microsoft has a huge database for ATP support, and it has contained 90% of what I have looked for. It was a lifesaver during initial setup.

Cylance was the first AI scanning-based AV on the market. While Webroot was competitive we found Cylance to be the better solution.

Defender works better for my org. This may depend on your ecosystem, however for me, Defender is a clear winner. I like Defender's ability to utilize multiple sensors and data points to detect possible breaches. I like the built-in EDR functionality. I do not need to purchase a separate EDR software anymore. I really like the vulnerability management. it has enabled our SOC team to view multiple security-related sensors from a single portal.

• Too much time to manage.
• Too many false positives.
• Too much lost productivity.

• There is definitely a piece of mind provided when you know that your system will not get compromised because of malware and viruses.
• The fact that I don't have to spend money in the first place means that I can spend money on other more important things that do require it.