Item: Microsoft Defender for Endpoint
Rating: 7
Author: William Huang

Use Cases and Deployment Scope

We are using Microsoft Defender for Endpoint as our second layer of protection for our critical devices. We implemented this as additional security protection against ransomware attacks in case our primary protection fails to catch the ransomware.

Pros and Cons

Easy deployment for windows devices
It does a great job of updating the threat protection database to keep up with those zero-day vulnerabilities
Works great with Windows OS system without causing resource conflicts or system performance degradation

Hard to integrate with third party SIEM solution
Not available for OS other than Windows
It is a little hard to do threat analysis or investigation when you try to correlate the detection with other security control systems like firewalls, web proxies, etc.

Return on Investment

Provided additional security assurance to protect our endpoint device from ransomware attacks
It requires very little additional IT resource to deploy or manage the solution since we have IT resources familiar with Microsoft solution already
Integration with third party security solution is not easy to do

Key Differentiators

Scalability
Ease of Use

Ease of use was the main factor that influenced our purchase decision.

Components

We use malware/threat detection and protection for blocking advanced threat attacks. We also use vulnerability and misconfiguration discovery features to help identify some obvious security gaps in some endpoint devices.

Protection Scope

About 2000 Windows devices. We use something else for MAC and Linux.

Alternatives Considered

SentinelOne Singularity and CrowdStrike Falcon

I would say Microsoft Defender for Endpoint is a little behind compared to those two market leaders in the space. However, Microsoft Defender for Endpoint is easy to deploy and manage for windows devices and the cost is more reasonable.

Key Insights

Do you think Microsoft Defender for Endpoint delivers good value for the price?

Yes

Are you happy with Microsoft Defender for Endpoint's feature set?

Yes

Did Microsoft Defender for Endpoint live up to sales and marketing promises?

Yes

Did implementation of Microsoft Defender for Endpoint go as expected?

Yes

Would you buy Microsoft Defender for Endpoint again?

Yes

Other Software Used

Palo Alto Networks Advanced Threat Prevention, Zscaler Internet Access, CrowdStrike Falcon

Likelihood to Recommend

It is a good security solution for protecting the endpoint devices if the majority of the environment contains Microsoft systems. While you have a mixed environment, you won't be able to solely rely on this product and most likely you will have to combine it with other security solutions to have full coverage of protection.

A good value Endpoint protection solution - Microsoft Defender for Endpoint

Overall Satisfaction with Microsoft Defender for Endpoint