Endpoint Protection

Pick the first of two products.

Open a name for its full profile

CrowdStrike Falcon Insight
Scored
CrowdStrike · Commercial · 2 capabilities in this domain · 4.21 / 5
Select
Microsoft Defender for Endpoint
Scored
Microsoft · Commercial · 6 capabilities in this domain · 4.18 / 5
Select
Microsoft Defender for Endpoint Plan 1
Capabilities only
Microsoft · Commercial · 4 capabilities in this domain
Select
SentinelOne Singularity Platform
Capabilities only
SentinelOne · Commercial · 4 capabilities in this domain
Select
CrowdStrike Falcon Prevent
Capabilities only
CrowdStrike · Commercial · 3 capabilities in this domain
Select
Symantec Endpoint Protection
Capabilities only
Broadcom · Commercial · 3 capabilities in this domain
Select

In Endpoint Protection

CrowdStrike Falcon Insight

CrowdStrike · Endpoint Protection

CommercialCompany4.21 / 5

Falcon Insight XDR records endpoint activity continuously, detects attacks with indicators of attack and machine learning, supports hunting and remote response, and correlates third-party telemetry for XDR. It is included in the Falcon Enterprise bundle.

Website ↗

What it does7 capabilities · 6 at full coverage

6 of 7 at full coverage, 3 through a named feature.

Automated Investigation & ResponsePartialDR · via a feature · level 4 · 4 providers
Extended Detection & Response CorrelationFullDR · level 3 · 2 providers
Real-time Threat DetectionFullDR · level 3 · 5 providers
Security Orchestration & Automated ResponseFullDR · via a feature · level 3 · 5 providers
Threat HuntingFullDR · level 4 · 10 providers
Device Isolation & ContainmentFullENDPOINT · via a feature · level 3 · 5 providers
Endpoint Detection & ResponseFullENDPOINT · level 3 · 5 providers

What it proves15 controls across 3 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.012 / 106DE.AE-02 DE.AE-03 DE.AE-04 DE.AE-07 DE.CM-01 DE.CM-09 ID.RA-03 RS.AN-03 RS.CO-02 RS.MA-01 RS.MI-01 RS.MI-02
CIS Controls2 / 18CIS 10 CIS 13
AICM1 / 18LOG

What it stops11 techniques

11 techniques countered, 11 of them common

Application Layer ProtocolT1071Very Common
Boot or Logon Autostart ExecutionT1547Very Common
Command and Scripting InterpreterT1059Very Common
Data Encrypted for ImpactT1486Very Common
Exfiltration Over C2 ChannelT1041Very Common
OS Credential DumpingT1003Very Common
Obfuscated Files or InformationT1027Very Common
PhishingT1566Very Common
Process InjectionT1055Very Common
Remote ServicesT1021Very Common
Valid AccountsT1078Very Common

Where it runs2 phases · 2 ways to deploy

Capabilities per lifecycle phase

Operate3
Monitor5

How it is delivered

Host agent or sensorSaaS

What it unlocks2 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 3

Real-time detection with automated responseHigh effort

Level 4

Detection engineering as code and threat huntingHigh effort

How it holds up9 criteria scored · 3 strengths · 2 limitations

Scored 0 to 5 against the evaluation criteria

Cloud-native support4.2
Context-driven prioritization4.4
APIs and extensibility4.5
Actionable remediation guidance4.4
Accuracy and noise4.5
Governance and compliance reporting3.9
AI capability maturity and AI security coverage4.1
Total cost and licensing fit3.6
Operational effort and skills required4.2

Strengths

Single lightweight cloud-managed agent
Strong threat intelligence and hunting integration
Consistently strong results in MITRE ATT&CK Evaluations

Limitations

Per-endpoint pricing adds up for large server estates
Advanced modules sold separately

Best for

Mixed operating system estates
Organizations wanting vendor-neutral EDR

What it costs3 tiers · Per endpoint subscription

LicensingPer endpoint subscription

Priced perdevice per year

BillingSubscription

Scales withProtected workstations and servers

Enterprise agreementContact salesAnnual
Planning estimateestimate$165endpoint/year · Annual
Falcon Enterprise$184.99endpoint/year · Annual

Total cost

Server and VDI counts, ephemeral cloud instances and multiple sensors per user change totals significantly.

What it takes to run4 FTE at peak · 2 roles · 3 automation hooks

Peak staffing4 FTE

Typical team2-4 FTE

False positives2% typical

APIAvailable

Roles it needs

SOC Analyst2–3 FTE
Incident Responder1 FTE

Automation

Falcon Fusion SOAR workflowsReal Time ResponseCharlotte AI investigation assistance

What it works with3 features · 3 integrations · 1 AI feature

Named features

Charlotte AIAICharlotte AI in CrowdStrike Falcon Insight.Needs Add-on
Falcon Fusion SOARFalcon Fusion SOAR in CrowdStrike Falcon Insight.
Real Time ResponseReal Time Response in CrowdStrike Falcon Insight.

Integrates with

CrowdStrike Falcon Next-Gen SIEMMicrosoft SentinelSplunk Enterprise Security

AI features

Charlotte AI

What else to look at2 competing · 1 comparable head to head · 5 siblings

Comparable head to head

Microsoft Defender for Endpointweighted →

Competes with

Microsoft Defender for EndpointCommercial · 4.18
SentinelOne Singularity PlatformCommercial

Same family

CrowdStrike Falcon Cloud SecurityCommercial
CrowdStrike Falcon CompleteCommercial
CrowdStrike Falcon Identity ProtectionCommercial
CrowdStrike Falcon Next-Gen SIEMCommercial
CrowdStrike Falcon PreventCommercial

What backs this up2 measurements

Measured, with how much to trust it

False Positive Rate2%RockPoint Cyber Estimate · 2026-01-01
Mean Time to Detect20 minRockPoint Cyber Estimate · 2026-01-01

Gantry 7.1.0 · OFF.12 · OFF.13

Endpoint Protection

CrowdStrike Falcon Insight

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint Plan 1

SentinelOne Singularity Platform

CrowdStrike Falcon Prevent

Symantec Endpoint Protection