Microsoft Defender for Endpoint vs. Proofpoint Advanced Threat Protection

I would say, where it's well suited as certainly any device where you know that either you're potentially running a Kickstarter device as your own personal unit, but maybe you want to try to connect it to some resource like, "Hey, you know what? This is a small community device. Maybe I'll try connecting my email on the go." You're protected from that perspective with the vendor, even if it's something that might be a bit suspicious from a hardware perspective. There's also the case where any device that you know are running Defender for endpoint that you're good to go. You don't really have to worry about all the other solutions out there because Defender has recovered.

Incentivized

It is great out of the box and uses AI and machine learning to identify threats with minimal input. It does need to be configured and tuned to meet the needs of the organisation. Industry specific software that sends or receives emails may be affected by this product.

Incentivized

• It integrates perfectly with Azure Sentinel. I mean, that's great. We can have a single pane of class with other platforms, like Defender for Cloud, Defender for endpoints, and Defender for servers, which is awesome as well. The ease of deployment is because Microsoft made sure around a year ago that every single workstation with Microsoft Windows came with Defender for Endpoints embedded.

Incentivized

• Spam filtering.
• Automatic retrieval of malicious emails that have gotten through the filter but were later detected using sample data across all the organizations Proofpoint has as customers.

Incentivized

• While it's a very good product for auditing, it has a very hard time to distinguish what is malicious and is an attack, what is not. Very rarely we get indication of a real malicious attack. We got lots of hours for off the shelf malware that it cleans up automatically. So basically we never get to look at it, which is a positive thing, but threats are detected by the third party endpoint, so it will not be enough by itself.

Incentivized

• With our current setup we need to add new users manually.
• Reports aren't that intuitive.
• Mailboxes have to be removed manually.

Incentivized

Proofpoint offers a lot of products, but they are not particularly well integrated. They all look different, and there is no central location to access them all from, which is disappointing. However, I do know they have a big push for upgrading the UI and usability, so this should improve in the coming months I hope.

Incentivized

The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session

Incentivized

Even though the product is good, the support can be lacking at times. The support needs to know their product inside and out, but there are times in which we figure out things before their support does. I feel as if we should not be able to fix issues that their support cant fix, hence the main reason for support.

Incentivized

Tenable Security Center was a fantastic exposure detection tool but there was always a lag and servers would hang alot when being scanned causing resource traffic. Microsoft Defender for Endpoint on the other hand does not use up most resources soo there is usually noo lag during scanning and it also provide more detailed insights on the network. Also Microsoft Defender for Endpoint integration power has helped us up our security game by delivering a smooth secure network.

Incentivized

Proofpoint's Advanced Threat Protection, in the past, has identified threats whereby Microsoft's Advanced Threat Protection did not.

Incentivized

• Positive : Microsoft Defender for Endpoint offers sophisticated threat detection and response capabilities, putting it into use helps increase security. Reduced security incidents, data breaches, and related expenses may arise from this.
• Positive : A more secure environment means less time and effort spent by IT and security teams on remediation and incident response.
• False Positives: Like any security solution, false positives can occur, leading to unnecessary investigations and potential disruptions to business operations. This may require additional resources to manage.

Incentivized

• PP blocks 5-10 emails per day which are spam or malicious
• I only get a small number of emails per week which are spam
• The only malicious emails I receive are from our internal security team which bypasses the PP threat protection

Incentivized