Before you act on endpoint security reviews

Four kinds of published review exist for this category, and they measure different things. Independent lab tests include AV-TEST, AV-Comparatives, and SE Labs; MITRE Engenuity ATT&CK Evaluations offer a separate adversary-emulation view. Analyst report series include Gartner Magic Quadrant, Forrester Wave, and IDC MarketScape when they cover endpoint security; marketplace reviews appear on G2, Capterra, TrustRadius, and Gartner Peer Insights. A lab test measures detection under lab conditions, an analyst report measures market position, a marketplace review reflects a reviewer's experience, and a colleague's account measures their fleet, not yours.

None measures what you need to know: what the product will do on your machines with your people. That takes a fifth kind of review, and you write it yourself.

Examples of endpoint security products a small business could evaluate include Microsoft Defender for Business, CrowdStrike Falcon, SentinelOne Singularity Endpoint, and Sophos Endpoint. These are examples to apply the review process to, not endorsements or a ranking.

What to take away

The four published kinds, and what each is worth

Reading a lab test without being misled

When was it run? A test from two years ago describes a product that has since been rewritten twice.

What was the sample set? Labs choose their samples, and vendors know which labs to submit to. A product that scores full marks in every test tells you the tests are similar, not that the product is.

What is in the false positive column? A product that blocks everything scores perfectly on detection and will be uninstalled by your staff within a month. The useful number is detection and false alarms read together, from the same test, on the same date.

Also look for the performance section, which most summaries drop. It is the closest thing a lab produces to the tired-laptop question.

Reading marketplace reviews

People write reviews when they are angry or when they are asked to. The star average is therefore two crowds averaged, which is not a number that means anything.

Read reviews differently. Sort by most recent and read thirty. Ignore the score.

Write each complaint in three or four words: slow machines, false positives, could not uninstall, support never replied, renewal price. Then count. The complaint appearing ten times in thirty reviews is the review. Test it first in your own trial.

Note the size of the reviewer's business where it is given. A complaint about console complexity from a company with two thousand seats and a complaint about missing features from a company with six seats are describing different products.

The review you write yourself

Install the candidate on a handful of machines, one first, and keep a record for two working weeks. One line per day, six columns.

Use these six columns, one line per day: date; device or user; alerts; administrator minutes; false positives; performance or user impact.

Run these four exercises during the trial:

At the end you have three numbers that no published review can give you: alerts per week, administrator minutes per week, and false positives per week. Put them next to the license cost and the decision is usually obvious.

The United Kingdom National Cyber Security Centre's guidance on logging and protective monitoring for deployed devices is a useful technical reference for the defender's side, not a U.S. compliance requirement.

For the fourth trial exercise, inspect the candidate's console: what events it records, how long they are retained, and whether you can find last Tuesday's event without exporting. Use the NCSC guidance as a technical reference while judging whether logging and monitoring meet your needs.

The reference call nobody makes

Ask: When the product detected an incident, what did the team do next, and did the product help with incident response? How often did it generate alerts that required investigation, and how many were false positives? What took the most time to deploy, manage, or troubleshoot, and what would you change? Write down the answer to the third question.

A business your size that has never had anything happen cannot answer the first question, and that is worth knowing too. It means the product has not been tested by that customer either.

Where reviews stop and judgment starts

No review tells you whether anyone in your business will read the console. That is the question that decides whether the category is worth paying for at all, and it is a question about your organization, not about a product. The purchasing basics in security foundations are a useful place to start.

A review won't tell you if the agent protects your actual machines. Before relying on endpoint security, compare the console's device list to your inventory.

CISA's Cyber Essentials is small-business guidance that includes advice on protecting devices. Use that advice alongside the inventory check; a trial can show how wrong your list is.

Common questions

Should we trust a review that is on the vendor's own site?

Treat it as a case study, which is what it is. It shows the product working somewhere. It does not show the product failing anywhere, because nobody publishes those.

Do we need a lab result at all?

It is a useful filter for excluding products that do badly, and a poor tool for choosing between products that do well. Once two candidates both pass, the lab has done its job and your own record takes over.

How many machines for the trial?

Enough to include the oldest, the one that is rarely connected, and the one whose owner complains loudest. Three is usually enough, and they should not all be the same model.

What if the review shows the product is fine but expensive?

Then compare it against what you already have rather than against other products. The built-in protection, a tested backup, and the account controls in identity and access may already cover most of the jobs, and the honest comparison is against that, not against a rival brochure.