Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.
$2.50
per user/per month
Microsoft System Center Endpoint Protection
Score 8.0 out of 10
N/A
Microsoft System Center Endpoint Protection is a malware, spyware, antivirus and endpoint protection application available formerly with System Center Configuration Manager (SCCM), which later became Microsoft Endpoint Manager. It is a legacy product, with older versions reaching end of support, and is not available as a standalone product.
Because of its integration with Windows, it is very easy to deploy and manage. Any IT department should be able to leverage the software and interface. The admin portal provides weighted recommendations that comprise the Secure Store, offering admins, security teams, and business owners valuable insights into their security footprint without requiring a strong security background. The software would be ideal for small and mid-sized businesses that cannot dedicate resources to security. Larger enterprises would also benefit, but may require the enhanced license.
If an organization is all Windows-based Active Directory systems, then System Center Endpoint Protection is worth deploying and using. If it's a hybrid of operating systems, then an alternative solution is best.
One, it's crazy lightweight, so compared to some of the competitors that we also have used with our security services, it's really lightweight and so I don't have a lot of overhead on the system that it's running on.
It is easy to use and configure. This is a benefit, not just for the IT/Admin team, but also for the end-user, as they can easily set how and when to run scans.
It is good a identifying threats and removing these threats. When looking for a product such as this, it is important to really look at these two areas to really see how the software will work in a real-world environment. SCEP is one such product that does really well at both of these things.
So the fact that Defender for Endpoint still works with signatures is actually, I don't know, a little difficult for us because, I mean, since Microsoft trusts those signatures, you can easily inject code. And we've done it many times. To show that you can inject code through vulnerabilities like CV 2013, 99, and 33 but still keep the signature. So because of the trust of those signatures, the malware just kind of slides into the environment without Defender knowing. That's the first part. The second part is that the behavioral analysis is not precisely its Prime. It's not Defender's best capability for endpoints. So, Defender does not identify all behaviors considered by other EDRs in the market.
Cost add-ons for Security features is nickel and diming the process to keep pace with cybercrime. Limited Education budgets require us to be more pro-active in finding cost-effective measures to protect our devices, staff and students. Defender is a strong, well-featured product that is pricing itself out of the education market
It offers multiple security features and integrates well with Microsoft ecosystems. A workflow for threat detection, investigation, automated remediation, and a centralized dashboard is an added advantage. This application is mainly designed for experienced users; new users may feel challenged.
It is integrated with Windows and SCCM, making it easy to use, license, manage, and update. Additionally, it is straightforward to diagnose when virus and ransomware alerts are detected on endpoints. IT Service Desk management is also easy.
Microsoft Defender for Endpoint chugs along just fine no matter what we throw at it and what systems it's running on. It doesn't take up a lot of resources either, so that's welcomed.
The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session
Support is pretty good overall. Since it's a Microsoft product, there are a number of different options for either end-users or IT Admins to get help with this product. This includes phone support, email, web KB articles, community forums, etc. This support is also available 24/7, which can't be said the same for every AV product out there. Also, organizations can opt to buy into Enterprise support, which gives the added benefit of faster response times, training by the vendor, etc.
Deployment was handled by our team here and everything went pretty smoothly. We did have a few hiccups in our test group, but that only took a bit to get ironed out.
Cylance's policy is to block everything and requires an active person to monitor and unblock legitimate processes. As updates and software continue to evolve, it is a full-time job to be a Cylance administrator. Microsoft Defender for Endpoint is a set-and-forget solution that catches threats when they occur and leaves you to focus on your work unimpeded.
Microsoft System Center Endpoint Protection was the logical choice for our organization since we were utilizing so many other Microsoft solutions. We have since realized the need for more advanced threat protections and primarily use SCEP as an additional level of protection. Our primary protection is being provided by Carbon Black because of it's advanced heuristics and behavioral analysis capabilities
