Report:

The Forrester Wave™: Endpoint Security, Q4 2023

Top Vendor Products for Endpoint Security in 2023

• Bitdefender
• CrowdStrike
• Microsoft
• Trend Micro

Endpoint Security Vendor Product Comparisons 2023

• Bitdefender - Leaders
  

  Pros:

  • Near-relentless focus on stopping threats before they can impact the endpoint
  • Depth of remediation tools makes it appealing for dispersed organizations
  • Proven prevention engines with breadth of endpoint control functions
  • Strong cross-operating system capabilities including mobile threat defense
  • Integrated patching and vulnerability management
  • One of the most flexible pricing models in the evaluation

  Cons:

  • Application Control functions only available with on-premises deployments, not in the cloud
  • Agent has one of the highest memory utilizations of vendors in this evaluation
  • Reference customers noted product needs to be more efficient when finding data


• CrowdStrike - Leaders
  

  Pros:

  • Improvements to protection engines allow EDR solution for customers seeking solid prevention foundation
  • Inclusion of secure configuration management and reporting makes it attractive for SMB customers
  • Extensive attack remediation capabilities
  • Superior vision focuses on how adversaries will attack and how to prevent it
  • Lowest impact on endpoint performance
  • Reference customers praised core endpoint security capabilities and ability to stop attacks quickly

  Cons:

  • Cost to deliver functions can be very high
  • Requires customers to purchase multiple add-ons to match competitors' features, increasing final price
  • Endpoint control functions (data security, device control, application control) are just on par with other vendors
  • Reference customers worried that company's recent growth into areas not focused on endpoint protection could impact quality
  • Some references found recent acquisitions' interfaces did not integrate with core endpoint security product


• Microsoft - Leaders
  

  Pros:

  • Vulnerability management functions stronger than others in this evaluation
  • Natively integrated into Windows minimizes agent performance overhead
  • Included within Microsoft 365 E5 license
  • Deployed in largest and smallest customers with same levels of performance
  • Outstanding roadmap includes expanding Defender functionality to OT and IoT devices
  • Extensive partner community
  • Agent's runtime behavior protection integrates into conditional access methods for device trust

  Cons:

  • Licensing models are the most challenging in the industry with advanced features requiring enterprise agreements
  • Need to regularly move between separate consoles to perform tasks
  • Need to use other Microsoft solutions (Intune and Purview) to access functions other vendors provide within core endpoint protection platform
  • Reference customers confirmed reporting and management were challenging


• Trend Micro - Leaders
  

  Pros:

  • Attack prevention engines have been a staple for customers wanting endpoint security 'that just works'
  • Continually worked to ensure features function in both on-premises and cloud-native environments
  • High customer loyalty for enterprises of all levels on a global basis
  • High level of investment in innovation and XDR
  • Roadmap ensures endpoint protection is foundational to all enterprise security offerings
  • Full-featured mobile threat defense solution
  • Very granular application control platform
  • Reference customers felt like part of the Trend Micro team and rated it the best vendor to work with

  Cons:

  • Environment management and reporting can be challenging as customers move from on-premises Apex One to cloud-delivered Vision One
  • Reference customer sentiment reflects challenges with the transition


• Broadcom - Strong Performers
  

  Pros:

  • Latest Symantec Endpoint Security release provides deep application behavior analysis function and execution baselining allowing granular control
  • Single price for Symantec Endpoint Security provides all key endpoint security features
  • Excels in application control functions, allowing security practitioners to control apps and actions taken by approved apps
  • Can block malicious actions common to many cyberattacks
  • Reference customers pleased with recent changes within the company and offering
  • Happy with protection provided including cross-platform support

  Cons:

  • After Broadcom acquired Symantec, endpoint security solution languished which soured many customers
  • Functions like data security or patch and vulnerability remediation require different Symantec solutions
  • Reference customers contacted are still using on-premises editions that lack newer advanced functionality only available within cloud service
  • Adoption has been challenging due to recent uncertainty and customer experiences post-Broadcom acquisition


• ESET - Strong Performers
  

  Pros:

  • Dominant prevention engines for malware and exploits targeted at endpoints
  • Mobile device security provides mobile device management
  • Includes vulnerability and patch management for all supported endpoints
  • Able to support organizations that need to maintain air-gapped infrastructure
  • Will host instance of current cloud-based offering within disconnected infrastructure
  • Strong presence with EMEA and APAC businesses concerned with regional data sovereignty

  Cons:

  • Missing data security management functions of others (available as add-ons)
  • Relies on Microsoft's Volume Shadow Copy Service for rollback functions within attack remediation, which is a key target of attackers
  • Data security management and other features available à la carte rather than included


• Palo Alto Networks - Strong Performers
  

  Pros:

  • One of the most full-featured endpoint security solutions in this evaluation
  • Strong prevention capabilities coupled with good amount of endpoint control
  • Strong adoption as customers of other Palo Alto Networks solutions incorporate this endpoint solution
  • Top-notch prevention engines for malware or abnormal behavior
  • Reference customers liked strong protection features and excellent control
  • Praised interactions with PANW

  Cons:

  • Cortex XDR Prevent product name is very confusing - implies XDR product but is actually endpoint protection providing entry point to EDR/XDR
  • Mobile security solution is lacking in capabilities relative to others in this evaluation
  • Reference customers noted lack of cohesion between various PANW add-on modules


• SentinelOne - Strong Performers
  

  Pros:

  • Key focus on automation allows customers to reduce SOC staffing while providing necessary endpoint attack prevention
  • Cloud-native solution fits well in world of anywhere work and cybersecurity staffing shortages
  • Approaches endpoint protection with automated defense for file-based, fileless, or user/application behavior
  • Extensive attack remediation capabilities
  • Reference customers highlighted product roadmap as key reason for staying with SentinelOne
  • Customers stated remediation function saved time when unique phishing attack was missed by other security solutions

  Cons:

  • Cost for offering is higher than many in this evaluation
  • Customers need to purchase add-ons such as data security to meet same level of protection others offer in main product
  • Mobile security delivered with separate license
  • Data security limited to device control without base data security management
  • Add-on needed for deeper network threat detection
  • Reference customers noted agent is challenge to update or remove despite low footprint
  • Features other vendors include (mobile threat defense, network threat detection) only offered as add-ons


• Sophos - Strong Performers
  

  Pros:

  • Long history of providing endpoint security to customers big and small
  • Focus on endpoint performance and consistent attack prevention
  • Strong prevention capabilities with very low agent overhead
  • Powerful network threat detection
  • Open partner ecosystem integrating with many solutions
  • Reference customers noted ease of use, low endpoint impact, and ability to stop threats
  • Positive experiences with Sophos sales and support teams

  Cons:

  • Mobile security offering requires separate license
  • Some functions for secure configuration management only available through Sophos' unified endpoint management product
  • Vision and roadmap are on par with others and don't offer anything exciting
  • Strategy doesn't deviate from current target


• Trellix - Strong Performers
  

  Pros:

  • Versatile solution with noticeable benefits such as extensive data security controls and advanced forensics
  • Outstanding data security features
  • Credential theft protection
  • Powerful dynamic application containment
  • Plans to integrate cybersecurity forensics, identity protection, and attack surface management with endpoint offering are appealing

  Cons:

  • Solution looks and feels like two different products with limited integration at the moment
  • Multiple consoles make environment management a challenge
  • Multiple agents on endpoint increase management difficulties
  • Strategy is XDR-centric which can be off-putting to customers not ready for XDR
  • Reference customers indicated McAfee Enterprise product was sufficient but there were product support challenges associated with merger
  • Working to merge two endpoint security solutions into single product


• Cisco - Contenders
  

  Pros:

  • Strong attack prevention for viruses, exploits, or malicious behavior
  • Integrates easily with rest of Cisco stack
  • Good vision supported by sound partner ecosystem allowing integration into/from variety of solutions
  • Many standard endpoint protection features including patching and vulnerability management
  • Cross-platform support
  • Own mobile defense
  • Strong reporting platform considered very useful by reference customers
  • Reference customers appreciated endpoint protection features and numerous integrations with other Cisco solutions

  Cons:

  • Enhancements and innovation have stalled
  • Deficient in areas such as data security
  • Lacks endpoint encryption control, only provides view of encryption status through API queries
  • Lacks differentiation for non-Cisco customers
  • Aggressive roadmap to close competitive gaps still in progress


• VMware - Contenders
  

  Pros:

  • Prevents malware and malicious behaviors
  • Powerful endpoint application control function that rivals vendors specializing in app control
  • Deep application control solution through allowlisting approach can prevent many sophisticated attacks
  • Tied to sturdy prevention and runtime protection engines providing good security foundation
  • Good vision for XDR and MDR capabilities

  Cons:

  • Current strategy focuses on XDR and MDR at expense of traditional endpoint protection features which are stagnating
  • Filling gaps in endpoint solution that many other vendors already provide
  • Relies on external management for functions such as mobile device security
  • Missing core endpoint security features like data security
  • Reference customers said solution required a lot of tuning to reduce false positives
  • Customer support was mixed
  • Broadcom's pending acquisition causing customer confusion around future product plans


• BlackBerry - Contenders
  

  Pros:

  • Easy to use and deploy
  • Can easily integrate into other Cylance offerings for balanced defense across infrastructure
  • Roadmap includes endpoint features not yet addressed by other vendors
  • Services for delivery within customer environments are quite broad
  • Good protection capabilities with variety of automation features
  • Includes mobile threat defense solution
  • Reference customers satisfied with solution, some planning to deploy more BlackBerry offerings
  • Leadership recognizes current gaps and has aggressive vision and roadmap to close them

  Cons:

  • Targets midmarket which may discourage large enterprises
  • Features in other endpoint security offerings like network threat detection or secure configuration management not included with CylancePROTECT and require other BlackBerry solutions
  • Current gaps in endpoint offering compared to competitors

Reference

• Forrester, The Forrester Wave™: Endpoint Security, Q4 2023, 18-Oct-2023, ID RES178486

View Market Definition
View Vendor Movements