Endpoint Protection

Pick the first of two products.

Open a name for its full profile

CrowdStrike Falcon Insight
Scored
CrowdStrike · Commercial · 2 capabilities in this domain · 4.21 / 5
Select
Microsoft Defender for Endpoint
Scored
Microsoft · Commercial · 6 capabilities in this domain · 4.18 / 5
Select
Microsoft Defender for Endpoint Plan 1
Capabilities only
Microsoft · Commercial · 4 capabilities in this domain
Select
SentinelOne Singularity Platform
Capabilities only
SentinelOne · Commercial · 4 capabilities in this domain
Select
CrowdStrike Falcon Prevent
Capabilities only
CrowdStrike · Commercial · 3 capabilities in this domain
Select
Symantec Endpoint Protection
Capabilities only
Broadcom · Commercial · 3 capabilities in this domain
Select

In Endpoint Protection

Microsoft Defender for Endpoint Plan 1

Microsoft · Endpoint Protection

CommercialCompany

Plan 1 provides Defender Antivirus, attack surface reduction rules, device control and manual response, without EDR telemetry, advanced hunting or automated investigation.

What it does4 capabilities · 3 at full coverage

3 of 4 at full coverage.

Attack Surface ReductionFullENDPOINT · level 2 · 4 providers
Device Isolation & ContainmentPartialENDPOINT · level 3 · 5 providers
Exploit PreventionFullENDPOINT · level 2 · 4 providers
Next-Generation AntivirusFullENDPOINT · level 2 · 5 providers

What it proves6 controls across 3 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.03 / 106PR.PS-01 PR.PS-05 RS.MI-01
CIS Controls2 / 18CIS 10 CIS 4
CRA1 / 41Annex I Part I (2)(k)

What it stops9 techniques

9 techniques countered, 9 of them common

Command and Scripting InterpreterT1059Very Common
Data Encrypted for ImpactT1486Very Common
Exfiltration Over C2 ChannelT1041Very Common
OS Credential DumpingT1003Very Common
PhishingT1566Very Common
Process InjectionT1055Very Common
Remote ServicesT1021Very Common
User ExecutionT1204Very Common
Exploitation for Privilege EscalationT1068Common

Where it runs1 phase · 2 ways to deploy

Capabilities per lifecycle phase

Operate4

How it is delivered

Host agent or sensorSaaS

What it unlocks

No maturity activity uses its capabilities, so it does not move a program level on its own.

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer user subscription

LicensingPer user subscription

Priced peruser per month or year

BillingSubscription

Scales withNamed or licensed users

Total cost

Bundles such as Microsoft 365 E5 spread cost across many products; value depends on actually deploying the included capabilities.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at7 siblings

Same family

Microsoft Defender Experts for XDRCommercial
Microsoft Defender External Attack Surface ManagementCommercial
Microsoft Defender XDRCommercial
Microsoft Defender for APIsCommercial
Microsoft Defender for EndpointCommercial · 4.18
Microsoft Defender for IdentityCommercial
Microsoft Defender for Office 365Commercial

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13

Endpoint Protection

CrowdStrike Falcon Insight

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint Plan 1

SentinelOne Singularity Platform

CrowdStrike Falcon Prevent

Symantec Endpoint Protection