Crowdstrike Falcon Endpoint Security and XDR vs Microsoft Defender for Endpoint comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary
Updated on Mar 20, 2022

We performed a comparison between Crowdstrike Falcon and Microsoft Defender for Endpoint based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Users of Microsoft Defender For Endpoint provided mixed reviews regarding the solution’s deployment. Some reviewers said that the setup was easy and straightforward, while other users felt that the initial setup could be complex (especially in regards to the configuration of extra parts), and the deployment can take up to a few months depending on the size of the organization.

    Most CrowdStrike Falcon reviewers agreed that its deployment is a simple and quick process. Only one user reported the manual sensor deployment to be time-consuming.

  • Features: Users of both products were happy with their stability and scalability. Valuable features of Microsoft Defender For Endpoint include holistic integration with all Defender products and MCAS, data leak prevention, high stability, attack surface reduction controls, exploit prevention control, application control, scalability, ransomware, and auto-remediation as well as manual-remediation. There are certain things that users found were lacking. Some users mentioned that other vendors provide a lot more customization when it comes to integration; Others said they encountered some misbehavior between Microsoft Office Suite and Defender; Still other users felt the GUI could be better optimized, the monitoring could be better, onboarding could be a little faster, log collection could be easier, and that the dashboard could be more streamlined.

    CrowdStrike Falcon users noted the high level of threat detection. A few reviewers had difficulties with integrations and felt that CrowdStrike Falcon’s user interface needed improvements.

  • Pricing: Reviewers of both products agreed that their pricing is reasonable.

  • Service and Support: Reviewers of Microsoft Defender For Endpoint felt that their service and support were just average, while Crowdstrike falcon users gave it very positive reviews for technical support.

Comparison Results: All other things being equal, Crowdstrike Falcon is the favorite when it comes to both ease of deployment and customer service and support.

To learn more, read our detailed CrowdStrike Falcon vs. Microsoft Defender for Endpoint Report (Updated: March 2024).
765,234 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"It is very easy to set up. I would rate my experience with the initial setup a ten out of ten, with ten being very easy to set up.""The price is low and quite competitive with others.""The most valuable feature is the analysis, because of the beta structure.""he solution is an anti-malware product that integrates well with other vendor products such as firewalls, SIEM, etc. It captures threat intelligence and gives you better visibility. The product also has sandboxing features.""NGAV and EDR features are outstanding.""Additionally, when it comes to EDR, there are more tools available to assist with client work.""Fortinet FortiEDR made our clients feel secure and more at ease, knowing that they had an EDR solution that would close the gap in their security posture.""I like FortiClient EMS. FortiEDR has a lot of great features like lockdown mode, remote wipes, and encryption. I can set malware outbreak policies and controls for detecting abnormalities. You can also simulate phishing attacks."

More Fortinet FortiEDR Pros →

"CrowdStrike Falcon is a very light solution. It does not use too much processor or RAM.""It's very easy to set up.""The most valuable feature is the indicator of compromise, which show you what file was either quarantined or removed.""The feature that I find to be the most valuable, is being able to look at the system analysis and being able to baseline what is installed on the system.""I like the Overwatch feature the most.""As an EDR tool, we can integrate log management and event management. The solution deals with threats automatically, that's the advantage.""The stability is good; we haven't experienced any glitches or bugs.""We have a small IT Team, and this allows us to get sleep at night, knowing that someone else is taking care of any incidents that occur."

More CrowdStrike Falcon Pros →

"I like that it's easy to deploy because it already comes with Windows 10. Overall, it has all the features that we need. Easy to deploy, comes with updates, and comes with Windows updates. You don't have to really manage or update the signature.""The most valuable features are that it's easy to use and the updates are very simple.""Real-time detection and cloud-based delivery of detections are highly efficient.""The most important and the most relevant features of Defender for Endpoint are the malware and ransomware protection.""There are a couple of features, such as isolating the devices or connecting the device and connecting live response.""User-friendly, offering safety and security.""Microsoft's technical support is fantastic.""We have liked the fact that it comes with Microsoft Windows 10 and it is constantly updated with all new virus definitions. It is also updated with new security features on a regular basis."

More Microsoft Defender for Endpoint Pros →

Cons
"FortiEDR could add a separate scanning dashboard. In incident management, we prefer to remove the endpoint system from the environment and scan the system. We typically use Symantec for that, but if we want to use FortiEDR for that, then we need a scanning tab to clarify things.""Everything with Fortinet having to do with their cloud services. They need to invest more in their internal infrastructure that they are running in the cloud. One of the things I find with their cloud environment compared to others' is that they go cheap on the equipment. So it causes some performance degradation.""We find the solution to be a bit expensive.""Detections could be improved.""To improve Fortinet, we need to see more features and technology areas at the endpoint level introduced.""We'd like to see more one-to-one product presentations for the distribution channels.""The EDR console should have more extensive reporting. You shouldn't need to purchase FortiAnalyzer. It should be included in the EDR part. The security adviser cloud platform could be improved with more options for exclusive or intensive rules for devices.""They can include the automation for the realtime updates. We have a network infrastructure with remote sites. Whenever they send updates, they are not automated. We have to go into the console and push those updates. I wish it was more automated. The update file is currently around 31 MB. It could be smaller."

More Fortinet FortiEDR Cons →

"The management of the solution could improve.""It does take more time to scan than other solutions.""They should provide us with good visibility for everything.""CrowdStrike should provide better visibility in its reporting. There should be more forensic details about detected threats.""An improvement would be to extend support to legacy and unsupported servers.""The malware analysis could be improved, as that's what we use the solution for the most and that change would make it a better EDR tool.""Too many false positives.""CrowdStrike Falcon could improve the logs by making them free to the API."

More CrowdStrike Falcon Cons →

"A challenge is that it is not a multi-tenant solution. Microsoft's tenant is a licensed tenant. I'm an MSSP. So, I have multiple customers. In Microsoft's world, that means that I can't just buy an E5 license and give that out to all my customers. That won't work because all of the customer data resides within a single tenant in Microsoft's world. Other products—such as SentinelOne, Palo Alto Cortex, CrowdStrike, et cetera—are multi-tenant. So, I can have it at the top of the pyramid for my analyst to look into it and see all the customers, but each customer's data is separate. If the customer wants to look at what we see, they would only see their data, whereas in the Microsoft world, if I've got multiple customers connected to the same Microsoft tenant, they would see everybody else's data, which is a privacy problem in Europe. It is not possible to share the data, and it is a breach of privacy.""It's not quite a mature solution just yet. It needs more time to grow and develop.""The time to generate certain alerts on our dashboard can take between 45 minutes to an hour, and I am unsure of the factors that influence this duration.""The system can always be simplified and have a better integration check. More detailed reports would be good. When it does the integrated check, it just shows if the system is okay but I want to know what happened.""With increase of cyber threats and cybersecurity issues, I would recommend that the product be developed like an AI product with more features which can counter any threat in the coming eras.""This solution is not secure, which is why I have moved to Linux.""Defender is free for one year. Once that year is over, we will switch to Kaspersky.""The documentation could be better. When they update their manuals, sometimes they refer to products by their old names, so it is a little confusing. For example, the documentation might still say "Advanced Threat Protection" instead of Defender for Endpoint."

More Microsoft Defender for Endpoint Cons →

Pricing and Cost Advice
  • "I know it is tough to get big budget additions up front, but I highly recommend deploying environment wide and adding the forensic service."
  • "There are no issues with the pricing."
  • "The price is comprable to other endpoint security solutions."
  • "The pricing is typical for enterprises and fairly priced."
  • "I'm not familiar with pricing, but it looks a bit costly compared to other vendors I think."
  • "The pricing is good."
  • "I would rate the solution's pricing an eight out of ten."
  • "The hardware costs about €100,000 and about €20,000 annually for access."
  • More Fortinet FortiEDR Pricing and Cost Advice →

  • "The pricing will depend upon your volume of usage."
  • "I would like them to further reduce the price, because it is quite pricey at the moment."
  • "Purchasing the product through the AWS Marketplace is just a click away. Since we were using the on-premise version of the product, we continued on the cloud by purchasing it through the AWS Marketplace."
  • "I do not have experience with the cost or licensing of the product."
  • "The other administrator and I can log in to check the exact details of what happened, what was running, and what caused the detection. We know exactly what was happening on the end users PC and we can tell if it's something that we actually need or something that's malicious."
  • "We are at about $60,000 per year."
  • "This solution has a very competitive price."
  • "Our company pays approximately US$ 65,000 annually for 900 machines."
  • More CrowdStrike Falcon Pricing and Cost Advice →

  • "The product is free of charge and comes integrated into Windows."
  • "The solution is free."
  • "This product is included in the pricing for Windows."
  • "If you don't purchase the advanced threat protection then there is no additional charge."
  • "It is affordable and comes in the Office 365 bundle."
  • "Microsoft Defender ATP is expensive."
  • "I pay for it through the Windows Professional or Standard license. It is a one-time cost for me, and I use the same license."
  • "When compared with other vendors, the pricing is very high."
  • More Microsoft Defender for Endpoint Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which EPP (Endpoint Protection for Business) solutions are best for your needs.
    765,234 professionals have used our research since 2012.
    Answers from the Community
    Netanya Carmi
    Koji Miura - PeerSpot reviewerKoji Miura
    Real User

    Depends on your budget and on the conditions of a Microsoft license. If you have an M365 license (like E3 or E5), Microsoft is cheaper.


    In terms of functionality, CrowdStrike is better.

    Questions from the Community
    Top Answer:I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protection… more »
    Top Answer:The product's initial setup phase is very easy.
    Top Answer:Fortinet FortiEDR is available at a very competitive price compared to the other products in the market. Customers also… more »
    Top Answer:Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that… more »
    Top Answer:Both of these products perform similarly and have many outstanding attributes CrowdStrike Falcon offers an amazing… more »
    Top Answer:The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push… more »
    Top Answer:Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface… more »
    Top Answer:We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior… more »
    Top Answer:The most valuable aspect lies in its automation capabilities, particularly within security automation.
    Comparisons
    Also Known As
    enSilo, FortiEDR
    CrowdStrike Falcon, CrowdStrike Falcon XDR
    Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
    Learn More
    Interactive Demo
    Fortinet
    Demo Not Available
    CrowdStrike
    Demo Not Available
    Overview

    Fortinet FortiEDR is a real-time endpoint protection, detection, and automated response solution. Its primary purpose is to detect advanced threats to stop breaches and ransomware damage. It is designed to do so in real time, even on an already compromised device, allowing you to respond and remediate incidents automatically so your data can remain protected.

    Fortinet FortiEDR Features

    Fortinet FortiEDR has many valuable key features, including:

    • Easily customizable
    • Real-time proactive risk mitigation & IoT security
    • Pre-infection protection
    • Post-infection protection
    • Track applications and ratings
    • Reduce the attack surface with risk-based proactive policies
    • Achieve analysis of entire log history
    • Optional managed detection and response (MDR) service

    Fortinet FortiEDR Benefits

    Some of the key benefits of using Fortinet FortiEDR include:

    • Protection: Fortinet FortiEDR provides proactive, real-time, automated endpoint protection with the orchestrated incident response across platforms. It stops the breach with real-time postinfection blocking to protect data from exfiltration and ransomware encryption.

    • Single unified console: Fortinet FortiEDR has a single unified console with an intuitive interface, which makes management easier. The solution automates mundane endpoint security tasks so your employees don’t need to do it.

    • Cost savings: With Fortinet FortiEDR you can eliminate post-breach operational expenses and breach damage costs.

    • Flexibility: Fortinet FortiEDR can be deployed on premises or on a secure cloud instance. With Fortinet FortiEDR, endpoints are protected both on- and off-line.

    • Scalability: Because Fortinet can be deployed quickly and has a small footprint, it is easy to scale up to protect hundreds of thousand endpoints.

    Reviews from Real Users

    Below are some reviews and helpful feedback written by Fortinet FortiEDR users.

    An Owner at a security firm says, "The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers. The customer has literally about 800 cash registers. That was the use case for Fortinet FortiEDR - to get that down into a tiny space. The only way to do that was to use this product because it had that ability to unbundle services that were a surplus.”

    Chandan M., Chief Technical Officer at Provision Technologies LLP, mentions, “The ease of deployment and configuration is valuable. It's very easy compared to other vendors like Sophos. Sophos' configuration is complex. Fortinet is a lot easier to understand. You don't need a lot of admin knowledge to do the configuration.” He also adds, “The security is also very good and the firewall response is good.”

    Harpreet S., Information Technology Support Specialist at Chemtrade Logistics, explains, "It notifies us if there's any suspicious file on any PC. If any execution or similar kind of thing is happening, it just alerts us. It doesn't only alert. It also blocks the execution until we allow it. We check whether the execution is legitimate or not, and then approve it or keep it blocked. This gives us a little bit of control over this mechanism. Fortinet FortiEDR is also very straightforward and easy to maintain."

    DeAndre V., Senior Network Administrator at a financial services firm, states, “The dashboard is easy to follow and use. The deployment and uninstalling were easy. I like the detailed information about the path of a file that might be suspicious. Being able to check that out was easy to follow. Exceptions are easy to create and the interface is easy to follow with a nice appearance.

    CrowdStrike Falcon is a comprehensive endpoint protection platform, primarily designed to meet the evolving cybersecurity needs of modern enterprises. It employs machine learning, behavioral analytics, and integrated threat intelligence to combat a wide range of cyber threats. CrowdStrike Falcon stands out for its cloud-native architecture, ensuring real-time protection and threat intelligence, essential for safeguarding dynamic environments. Its lightweight agent architecture minimizes system performance impact while offering extensive network visibility.

    CrowdStrike Falcon offers robust, user-friendly cybersecurity measures that are crucial for protecting digital assets and minimizing the risk of data breaches and cyberattacks. Its proactive threat detection and mitigation help maintain business continuity and protect brand reputation. Additionally, its scalability and ease of use contribute to cost-effectiveness by reducing the need for extensive IT resources and training. The platform's seamless integration with existing IT infrastructures makes it a versatile choice for diverse IT environments.

    During our conversations with CrowdStrike's users, they highly regard CrowdStrike Falcon for its efficiency in detecting and responding to threats, ease of use, and minimal system impact. It's praised for its comprehensive coverage, extending beyond traditional antivirus solutions, with strong customer support and continuous improvements.

    General Feedback and Recommendations:

    • Strengths: Its lightweight agent, stability, scalability, positive technical support experience, and improvements over competitors are notable strengths.
    • Weaknesses: The extraction process did not effectively capture the weaknesses, indicating a need for more precise data analysis.
    • Implementation and Usage: Insights include scalability and stability, particularly in cloud solutions, and ease of implementation without external assistance.

    Key Features and Advantages:

    1. Advanced Threat Detection and Response - utilizes sophisticated algorithms and machine learning to identify and neutralize preemptively, crucial for mitigating risks from advanced persistent threats (APTs) and zero-day exploits.
    2. Comprehensive Visibility and Insight - provides deep endpoint activity visibility, enabling IT teams to detect anomalies and respond to incidents effectively.
    3. Cloud-Native Architecture - offers scalability and flexibility, adapting to changing business needs, beneficial for organizations scaling operations or transitioning to cloud infrastructures.
    4. Integrated Threat Intelligence - backed by CrowdStrike's threat intelligence database, the platform stays ahead of attackers with continuously updated information on emerging threats.
    5. Ease of Deployment and Management - Its lightweight agent and cloud-based management console simplify deployment and management, which is practical for businesses of all sizes.
    6. Compliance and Risk Management - aids in meeting compliance requirements with thorough reporting and audit trails, essential for regulatory scrutiny.
    7. User and Entity Behavior Analytics (UEBA) - Analyzing user behavior patterns enhances detection capabilities against insider threats and compromised accounts.

    CrowdStrike Falcon offers various pricing plans based on endpoints and required features. The plans cater to different organizational sizes and needs, from basic endpoint protection to comprehensive protection with advanced capabilities. Additional features like DLP, UBA, Endpoint Sandboxing, and MDR are available, with pricing upon request.

    CrowdStrike Falcon emerges as a sophisticated solution for enterprise cybersecurity, offering advanced threat detection, scalability, and user-friendly design. It's well-suited for both IT professionals and business executives, protecting against current cyber threats and adaptable to future challenges in the cybersecurity landscape. For a more detailed understanding, especially concerning its use cases and weaknesses, a manual review of user feedback might be necessary.

    Microsoft Defender for Endpoint is a comprehensive security solution that provides advanced threat protection for organizations. It offers real-time protection against various types of cyber threats, including malware, viruses, ransomware, and phishing attacks.

    With its powerful machine-learning capabilities, it can detect and block sophisticated attacks before they can cause any harm. The solution also includes endpoint detection and response (EDR) capabilities, allowing organizations to quickly investigate and respond to security incidents. It provides detailed insights into the attack timeline, enabling security teams to understand the scope and impact of an incident.

    Microsoft Defender for Endpoint also offers proactive threat hunting, allowing organizations to proactively search for and identify potential threats within their network. It integrates seamlessly with other Microsoft security solutions, such as Microsoft Defender XDR, to provide a unified and holistic security approach. With its centralized management console, organizations can easily deploy, configure, and monitor the security solution across their entire network.

    Microsoft Defender for Endpoint is a robust and scalable security solution that helps organizations protect their endpoints and data from evolving cyber threats.

    Offer
    Learn more about Fortinet FortiEDR
    Get Fast and Easy Protection Against All Threats

    Protect your organization from all threats - not just malware - even when computers and servers aren’t connected to the internet. Start your free trial and deploy CrowdStrike Falcon within minutes to start receiving full threat protection.

    Learn more about Microsoft Defender for Endpoint
    Sample Customers
    Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
    Information Not Available
    Petrofrac, Metro CSG, Christus Health
    Top Industries
    REVIEWERS
    Financial Services Firm21%
    Comms Service Provider11%
    Manufacturing Company11%
    Educational Organization5%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Government8%
    Manufacturing Company8%
    Financial Services Firm8%
    REVIEWERS
    Computer Software Company19%
    Financial Services Firm16%
    Comms Service Provider7%
    Energy/Utilities Company7%
    VISITORS READING REVIEWS
    Computer Software Company15%
    Financial Services Firm10%
    Manufacturing Company8%
    Government7%
    REVIEWERS
    Financial Services Firm19%
    Computer Software Company16%
    Energy/Utilities Company7%
    Comms Service Provider7%
    VISITORS READING REVIEWS
    Educational Organization21%
    Computer Software Company13%
    Government8%
    Financial Services Firm7%
    Company Size
    REVIEWERS
    Small Business50%
    Midsize Enterprise16%
    Large Enterprise34%
    VISITORS READING REVIEWS
    Small Business31%
    Midsize Enterprise19%
    Large Enterprise50%
    REVIEWERS
    Small Business32%
    Midsize Enterprise23%
    Large Enterprise45%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise18%
    Large Enterprise56%
    REVIEWERS
    Small Business40%
    Midsize Enterprise17%
    Large Enterprise43%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise32%
    Large Enterprise46%
    Buyer's Guide
    CrowdStrike Falcon vs. Microsoft Defender for Endpoint
    March 2024
    Find out what your peers are saying about CrowdStrike Falcon vs. Microsoft Defender for Endpoint and other solutions. Updated: March 2024.
    765,234 professionals have used our research since 2012.

    CrowdStrike Falcon is ranked 3rd in EPP (Endpoint Protection for Business) with 101 reviews while Microsoft Defender for Endpoint is ranked 1st in EPP (Endpoint Protection for Business) with 182 reviews. CrowdStrike Falcon is rated 8.6, while Microsoft Defender for Endpoint is rated 8.0. The top reviewer of CrowdStrike Falcon writes "Easy to set up with good behavior-based analysis but needs a single-click recovery option". On the other hand, the top reviewer of Microsoft Defender for Endpoint writes "Eliminates the need to look at multiple dashboards by automatically providing one XDR dashboard to show the security score of each subscription". CrowdStrike Falcon is most compared with Microsoft Defender XDR, Darktrace, Trend Micro Deep Security, SentinelOne Singularity Complete and Trend Vision One, whereas Microsoft Defender for Endpoint is most compared with Intercept X Endpoint, Symantec Endpoint Security, SentinelOne Singularity Complete, Cortex XDR by Palo Alto Networks and Fortinet FortiClient. See our CrowdStrike Falcon vs. Microsoft Defender for Endpoint report.

    See our list of best EPP (Endpoint Protection for Business) vendors and best EDR (Endpoint Detection and Response) vendors.

    We monitor all EPP (Endpoint Protection for Business) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.