Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.
$2.50
per user/per month
Tenable Vulnerability Management
Score 9.0 out of 10
N/A
Vulnerability management specialist Tenable offers their cloud application and container security platform Tenable Web App Scanning (formerly Tenable.io), a vulnerability management tool that emphasizes visibility of web applications, automatic scanning, and a unified view of cloud infrastructure and possible inconsistencies indicating a vulnerability.
Microsoft Defender for Endpoint is on par or exceeds the competitor products and provides an enterprise grade EDR solution. Based on the savings by bundling Microsoft products under the E5 license and the benefits it provides; it is an excellent choice for customers looking for …
Defender works better for my org. This may depend on your ecosystem, however for me, Defender is a clear winner. I like Defender's ability to utilize multiple sensors and data points to detect possible breaches. I like the built-in EDR functionality. I do not need to purchase a …
I think Microsoft Defender for Endpoint is very good in the federal space that I work in because when you deal with these highly regulated environments, anything that you have outside of the Microsoft ecosystem, you have the justified documented company. There's a lot of work and a high level of effort involved in that. So what it's really good at is that it's all encompassed into Microsoft. It's built in, it works really well together. So that's why it's my recommendation whenever we deal with customers that are in my field.
I've been using this product since it began as an open source product, I really like it and for the money, I think it's probably the best choice for most companies who need a product like this. Over the years I've seen the interface change quite a bit and sometimes I think it's a bit unclear how to do certain things and the different packages can be confusing, these are the only reasons I'm giving it a 9 instead of a 10.
I think from a scalability perspective, it’s incredible. It fits very well with our Azure stack, and we’re constantly adopting more and more different Microsoft products. But I think the key thing is ease of use. Its scalability, and it’s just that, enterprise-wise and in terms of control, we can actually centralize it as well.
I feel like the vulnerability management side of things is really great. I would like maybe more custom risk scores from that. It gives us our highs and criticals. Proof of concept exploits would be great so we can really assess the risk. It already does a lot of that, though. It gives us that tag. But maybe making it more GUI-friendly, more visibly friendly, could be something I feel like they could work on. The portal, too, I find, is a little hard to navigate sometimes. There seem to be hidden webpages within webpages. One thing off the top of my head is the IPs. They have the IP pages, but you have to click through four or five different subpages to get there. So I feel like maybe redoing the navigation in the portal would be very helpful.
Expensive - You do pay a slight premium for the best product in the space.
Asset management is difficult to work with if you have a lot of asset turnover, the license can be ''held'' for 3-6 months after the asset is gone from your environment.
Cost add-ons for Security features is nickel and diming the process to keep pace with cybercrime. Limited Education budgets require us to be more pro-active in finding cost-effective measures to protect our devices, staff and students. Defender is a strong, well-featured product that is pricing itself out of the education market
It's good, but as I said, it does get a little confusing sometimes when you're trying to remediate, when you're trying to put all your alerts together, and trying to get everything in the same place. It's a little, I guess, what we call alert fatigue. There are a lot of alerts on it as well.
Microsoft Defender for Endpoint chugs along just fine no matter what we throw at it and what systems it's running on. It doesn't take up a lot of resources either, so that's welcomed.
The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session
Support is usually really great at walking you through any steps you need to take when you get stuck on something. There are a few false positives and errors that have come up over the years that required their help to get through. Unfortunately, the steps required to diagnose some problems are more tedious than I think should be necessary. (IE: SQL instances can throw errors that clog up your logs because one plugin affects it in a certain way. The process to diagnose this is to watch timestamps of plugins in a log while monitoring the SQL logs at the same time and using your best guess as to what is causing it.)
Deployment was handled by our team here and everything went pretty smoothly. We did have a few hiccups in our test group, but that only took a bit to get ironed out.
Previously, we've used Sophos. We've used, way back when, McAfee, Norton, Symantec, all those. And we finally settled on Microsoft Defender for Endpoint. We're a Microsoft technology stack shop. So obviously it was natural. It's built into Windows, so we're not adding additional agents. Some of the other vendors and their agents, for a while, would compete with CPU usage. And so it actually slowed down the machines. Because Microsoft Defender for Endpoint is built into the Windows product, Microsoft is going to ensure that it does not affect the other productivity tools that a user may use.
Tenable.io has a comparable set of features, with excellent support and a competitive price. After less than desirable experiences with another company, we moved to Tenable and haven't looked back since.
Another positive impact is that Microsoft Defender for Endpoint is built into the Windows OS. So naturally, it is much easier to load it out and manage it, rather than acquiring it through party ER, deploying it, and managing it separately. So that's definitely on the positive side that we observe there's a byproduct of changing Microsoft Defender for Endpoint.
Since this is a requirement for our PCI compliance and the cost is relatively low, the ROI isn't really something we need to think too much about, Tenable's pricing is fair and affordable.
