Endpoint security comparison, one decision at a time

This endpoint security comparison works one decision at a time. Comparing two products in this category is mostly comparing two brochures. Comparing the approaches underneath them is more useful. Every product combines a few architectural choices. The choice fits or does not fit a business of a given size long before a brand name enters the conversation.

Five choices decide most of it. Each is set out below with what it does well, where it fails, and when to pick it.

What to take away

Built-in protection or an added product

Built-in protection ships with the operating system. Microsoft Defender Antivirus in Windows 10 and 11, Apple XProtect on macOS, and SELinux or AppArmor on Linux handle the known-bad job and improve without you doing anything.

An added product such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne Singularity brings a console across all machines. It adds remote response actions and behavior detection tuned more aggressively. It also brings an agent to update, a login to protect, and alerts to read.

Microsoft Defender for Business adds a central console and reporting to Windows, macOS, iOS, and Android. Microsoft lists it at about $3 per user per month for small businesses, and it is included in Microsoft 365 Business Premium.

Pick built-in when the fleet is small, machines are patched, daily accounts are not administrators, and nobody would be reading a console anyway. Pick an added product when somebody will read it, or when a customer or insurer requires central reporting you can show them.

Known-bad, unusual-behavior, or known-good only

Three ways to decide what is allowed to run.

Block what is known to be bad. Microsoft Defender Antivirus, ESET PROTECT, and Trend Micro Apex One use signatures and reputation lists. Fast, quiet, and blind to anything new.

Stop what behaves unusually. CrowdStrike Falcon, SentinelOne Singularity, and Sophos Intercept X catch new things by what they do rather than what they are. They also stop the finance package's odd macro, the developer's scripting tool, and the printer installer. Each becomes a support call.

Allow only what is known to be good. Microsoft Defender Application Control and AppLocker ship with Windows. ThreatLocker and Airlock Digital add commercial consoles for the same model. Nothing runs unless it is on the list.

This model is the strongest of the three against anything unexpected. It fails on day one if the list is incomplete. The United States National Institute of Standards and Technology's guide to application whitelisting is honest about the maintenance it takes. That honesty is the reason to read it before choosing this route.

Pick known-bad plus behavior for general office fleets. Pick known-good for a small number of machines that do one job and rarely change: a till, a machine on a bench, a kiosk.

Never roll out known-good across a whole fleet in one day. Run it in audit mode on one machine first and read what it would have blocked.

Agent on the device, or watching from elsewhere

An agent such as CrowdStrike Falcon, SentinelOne Singularity, or Microsoft Defender for Endpoint sees everything on the machine. It works when the machine is at home, at a client's office, or on a train. It also has to be installed, updated, and defended against removal.

Network-side tools such as Cisco Umbrella, Cloudflare Gateway, and Zscaler see traffic and downloads without touching the device. They cover machines you cannot install anything on, including printers and cameras.

Browser-side tools such as Google Safe Browsing and Microsoft SmartScreen block known malicious downloads in the browser. Neither sees anything once the machine leaves the office. Neither sees inside encrypted connections unless you inspect them, which is a separate decision with its own cost.

The United Kingdom National Cyber Security Centre's device security guidance is organized around the device rather than the network for this reason. It is the better starting point once most of the fleet travels.

Pick an agent for laptops that travel, which today means most of them. Pick network-side watching for the devices that cannot take an agent. Keep those devices on their own segment as described in network security.

Your console, or somebody else's

Running the console yourself means alerts land with a person you employ. That person knows which machine belongs to whom and why the bookkeeper runs an odd application at month end.

A managed service means a person you do not employ reads the console at hours you do not staff. CrowdStrike Falcon Complete, SentinelOne Vigilance, Sophos MDR, Huntress, and Arctic Wolf sell this arrangement to small and midsize businesses.

What they will do without phoning you is the whole question. It has to be written down before you sign. Isolate a machine? Reset a password? Wait for the morning?

Pick your own console when someone in the business genuinely has the hours. Pick a managed service when nobody does, and treat the written list of autonomous actions as the contract.

Prevention first, or detection and response

Prevention-heavy products such as Microsoft Defender Antivirus and ESET PROTECT aim to stop things and say little. Detection-heavy products such as CrowdStrike Falcon, SentinelOne Singularity, and Palo Alto Networks Cortex XDR record everything and let someone investigate. The second group is more powerful and more expensive. It produces a stream that only has value if it is read.

Pick prevention-heavy when the fleet is small and the goal is fewer bad days. Pick detection-heavy when you have the people, or the managed service, to follow a trail, and when the sequence in incident response is something you would actually run.

The five choices together

Named products by approach:

Combining approaches

Most small businesses land on the same shape. General machines get Microsoft Defender Antivirus or a modest added product such as Microsoft Defender for Business or Bitdefender GravityZone.

Anything that travels gets CrowdStrike Falcon, SentinelOne Singularity, or another agent. Two or three fixed-purpose devices get Microsoft Defender Application Control, AppLocker, or ThreatLocker. Who reads the console is decided in writing.

What the machines need before any of this matters is the short list in endpoint security. Whether the accounts on those machines are protected is the subject of identity and access, since a detection product cannot help with a login that was simply valid.

Common questions

Is one approach clearly best?

Known-good is strongest and hardest to live with. Microsoft Defender Application Control, AppLocker, ThreatLocker, and Airlock Digital can enforce it. Everything else is a trade between coverage and administrator time, and the right trade depends on who you have.

Can we mix a managed service with our own console?

Usually. The common arrangement is that they act out of hours within a written list, and you act during the day. The list is what to negotiate. Managed services such as CrowdStrike Falcon Complete, Sophos MDR, Huntress, and Arctic Wolf work this way.

Does network-side watching still matter if everyone has laptops?

For the printers, cameras and older equipment that cannot run an agent, yes. Cisco Umbrella, Cloudflare Gateway, and Zscaler cover those devices. For the laptops, no, because they are elsewhere half the time.

How do we compare two products that use the same approach?

Compare Microsoft Defender for Business, CrowdStrike Falcon Go, and Sophos Intercept X on your own machines for two weeks, with a record of alerts, false positives, and administrator minutes. At that point the brochures are irrelevant and the record decides.