Report:

Magic Quadrant for Endpoint Protection Platforms

Top Vendor Products for Endpoint Protection Platforms in 2023

• CrowdStrike
• Microsoft
• Palo Alto Networks
• SentinelOne
• Sophos
• Trend Micro

Endpoint Protection Platforms Vendor Product Comparisons 2023

• CrowdStrike - Leader
  

  Pros:

  • CrowdStrike's strong market responsiveness and track record are due to its top market share and impressive growth rate. Gartner client interactions show evidence of a high degree of visibility for this vendor.
  • CrowdStrike's product strategy benefits from its innovation in capabilities such as cloud security, attack surface management and ITDR, alongside advancements in XDR.
  • The vendor's product benefits from the broad set of raw endpoint telemetry collected, mature and customizable EDR functionality, lightweight security agent, and app-store-like agent expansion capability.
  • Its product also benefits from its vendor-managed MDR and threat-hunting services, addressing the needs of organizations with less mature security staff and expertise augmentation needs.

  Cons:

  • CrowdStrike's geographic strategy is challenged by generally lower market penetration in regions outside North America. The vendor's language support is limited to English and Japanese.
  • The vendor's product lacks a comprehensive native workspace security suite compared to most other Leaders in this Magic Quadrant, despite having a broad ecosystem of integration partners.
  • CrowdStrike's sales execution is impacted by generally higher-than-average prices and lower-than-average default endpoint telemetry retention compared to other vendors in this Magic Quadrant.
  • CrowdStrike's product lacks hybrid and on-premises deployment options for its management console. CrowdStrike also has limited support for legacy OS compared to some of the other Leaders in this Magic Quadrant.


• Microsoft - Leader
  

  Pros:

  • Microsoft's strong market responsiveness, track record and overall viability are attributed to its substantial market share and share growth in its security business. Gartner client interactions show evidence of a high degree of visibility for this vendor.
  • Microsoft's strong product strategy and innovation are reflected in the breadth of its workspace security suite and the tight coupling with Microsoft Sentinel SIEM. Recent enhancements include automatic attack disruption capabilities for high-confidence incidents.
  • Microsoft's product benefits from security configuration management capabilities, providing continuous posture assessment and recommended remediation suggestions to address vulnerabilities and misconfigurations.
  • The vendor's product includes generous default endpoint telemetry and detection event retention that is higher than average among the vendors in this Magic Quadrant.

  Cons:

  • Microsoft's product is challenged by limited support for older OSs and generally uneven support across non-Windows OSs. Support for and performance on Linux-based systems are among Gartner clients' complaints.
  • Microsoft's sales execution is impacted by a general focus on selling security bundles, which often creates shelfware and redundant spending, as reported by Gartner clients. In addition, products such as Microsoft Defender for Servers or Microsoft Sentinel SIEM are not fully represented in popular packages such as E3 or E5.
  • Microsoft's customer experience assessment reflects below-average ease of use based on analyst and end-user impressions of the console UX and the current need to use separate dashboards for endpoint protection settings and security event management, despite the in-progress consolidation into a unified experience.
  • Microsoft's product is impacted by a lack of on-premises deployment options for its EPP management console, making it unsuitable for organizations without a cloud-first strategy.


• Palo Alto Networks - Leader
  

  Pros:

  • Palo Alto Networks has a strong product strategy based on its growing workspace security suite and ongoing efforts to integrate these capabilities into Cortex XDR. Recent examples include the release of a new ITDR capability that expands the Cortex XDR offering.
  • Palo Alto Networks' product benefits from high levels of customization, interoperability, automation and scoring logic tuning available through its administration console and often requested by mature security operations teams and MSSPs.
  • The vendor's high overall viability assessment is attributed to its strength in adjacent cybersecurity markets, sustained financial performance and high relative share growth in the EPP market.
  • Palo Alto Networks has a strong geographic strategy due to its global reach and multilingual product localization. The vendor supports more cloud hosting points of presence than average among the vendors included in this Magic Quadrant.

  Cons:

  • Palo Alto Networks' market responsiveness and track record are impacted by its market share, which remains significantly lower than that of the other Leaders in this Magic Quadrant, despite demonstrable progress over the past year.
  • Palo Alto Networks' extensive functionality impacts its customer experience with a below-average ease of use based on analyst and end-user impressions of the console UX, highlighting the platform's steep learning curve.
  • The vendor's product is impacted by its lack of fully on-premises or air-gapped deployment support, despite supporting hybrid use cases with the help of a Broker VM.
  • Palo Alto Networks' sales execution is impacted by pricing that is higher than average among the vendors included in this Magic Quadrant.


• SentinelOne - Leader
  

  Pros:

  • SentinelOne's strong market responsiveness and track record are attributed to above-average market share and share growth. Gartner client interactions show evidence of a high degree of visibility for this vendor.
  • SentinelOne's product benefits from the intuitive design of its console UX combined with configuration granularity and customization, balancing ease of use and capability depth.
  • SentinelOne's innovation manifests in the rapid pace of introducing new features, such as ITDR and Windows kernel real-time monitoring and protection.
  • SentinelOne offers broad platform support, including for legacy systems such as Windows XP and Windows Server 2003. The vendor supports eBPF for numerous Linux families and introduced support for NetApp ONTAP in 2023.

  Cons:

  • SentinelOne's geographic strategy is impacted by limited language localization (English and Japanese only). The vendor demonstrates a smaller presence in regions outside of North America and Europe; however, new cloud hosting points of presence that are being introduced may broaden its appeal.
  • The vendor's performance in the overall viability evaluation criterion is impacted by the challenging macroeconomic environment, which manifested in a small reduction in workforce.
  • SentinelOne's product lacks a comprehensive workspace security suite compared to other Leaders in this Magic Quadrant. The vendor relies on ecosystem integrations to cover the gaps in its portfolio.
  • SentinelOne's product lacks managed security service support for the vendor's identity protection and extended detection and response products, despite supporting MDR for the endpoint.


• Sophos - Leader
  

  Pros:

  • Sophos has a strong market understanding due to the broad scope of its endpoint, workspace, networking and XDR offerings.
  • Sophos' product benefits from recent improvements such as Active Adversary Protection, which dynamically enables heightened endpoint protection settings when a severe endpoint attack is detected.
  • The vendor's product strategy benefits from the newly introduced Account Health Check tool, which helps continuously identify and remediate misconfigured Intercept X settings.
  • Sophos' product benefits from MDR services supporting third-party integrations and includes incident response services as part of its higher-tier service package. In 2023, Sophos extended its MDR coverage to Microsoft security solutions.

  Cons:

  • Sophos' market responsiveness and track record assessment indicates the slow adoption of EDR capabilities in the vendor's installed base.
  • Sophos' product lacks advanced EDR functionality, such as the ability to define granular custom detection rules, customize detection severity levels and assign MITRE ATT&CK classifications in the console. Sophos offers fewer built-in automated response actions for custom detection than other Leaders in this Magic Quadrant.
  • Sophos' overall viability evaluation criterion performance is impacted by the challenging macroeconomic environment, which manifested in recent organizational structure changes and a small reduction in workforce.
  • Sophos' product is impacted by an evolving XDR capability that lacks a coherent analyst workflow for threat investigation and response, relying on cut-and-paste and navigation across multiple tabs for parts of the workflow. Sophos Factory, the part of the Sophos XDR offering used to create automation pipelines, is a separate interface from Sophos Central.


• Trend Micro - Leader
  

  Pros:

  • Trend Micro's innovation manifests in its integrated attack surface management, security configuration management and XDR capabilities in the Trend Vision One platform to aid in proactive risk reduction and security operations.
  • Trend Micro's product benefits from the breadth and integration of its workspace security suite components. Recent enhancements include an integrated ITDR capability within the Trend Vision One platform.
  • Trend Micro's sales execution benefits from its flexible credit-based licensing model and generally lower-than-average prices compared to other Leaders in this Magic Quadrant.
  • Trend Micro's product offers depth and granularity in its administration console, and broad support for legacy and rare OSs. Trend Micro is one of the few vendors supporting flavors of IBM AIX, Oracle Solaris, Red Hat OpenShift and others.

  Cons:

  • Trend Micro's marketing execution is challenged by lower levels of brand recognition compared to other Leaders in this Magic Quadrant, particularly in North America, where the vendor has a comparatively smaller client base.
  • Trend Micro's product has gaps in raw endpoint telemetry collected for the EDR functionality. Also, despite recent optimizations, its agent still consumes more disk space than average among the vendors included in this Magic Quadrant.
  • Trend Micro's geographic strategy is impacted by generally lower market penetration in regions outside Europe and Japan. Recent marketing activities, partner programs and sales hiring may broaden its appeal in other geographies.
  • Trend Micro's product lacks centralized configuration and policy management capabilities across multiple subtenants in its MSSP console, while providing centralized threat detection and response.


• Bitdefender - Visionary
  

  Pros:

  • Bitdefender's product benefits from its relative ease of use, enhanced incident contextualization and remediation guidance, broad support for legacy and rare OSs, and strong protection efficacy. Recent improvements include protection against ransomware attacks launched from unmanaged devices over shared folders.
  • Bitdefender shows strong market understanding and innovation, with an early focus on endpoint and human risk analytics — integrated tools that help identify and remediate endpoint OS weaknesses, and identity attacks.
  • Bitdefender's product benefits from its EDR capability that records a comprehensive set of raw endpoint telemetry used for detection and investigation purposes. A network attack defense sensor provides embedded DPI technology for deep network visibility.
  • Bitdefender's sales execution benefits from generally lower-than-average prices compared to other vendors in this Magic Quadrant.

  Cons:

  • Bitdefender's below-average market responsiveness and track record are attributed to its low share of the EPP market and slow adoption of EDR capabilities.
  • Bitdefender's product XDR capability is limited and may be insufficient for experienced analysts looking for custom response automation. It also has fewer third-party integration options compared to Leaders in this Magic Quadrant.
  • Bitdefender's geographic strategy is impacted by the limited cloud hosting options it offers and a lack of solid presence in regions such as the Asia/Pacific, Middle East, Africa and Japan.
  • Its product requires a separate administration console for mobile security management of iOS, Android and Chromebook devices. Mobile security features are yet to be integrated with the vendor's XDR solution.


• Check Point Software Technologies - Visionary
  

  Pros:

  • Check Point demonstrates a strong market understanding and industry/vertical strategy due to its wide variety of integrated workspace security products, providing opportunities for consolidation and appealing to clients across the industrial spectrum.
  • Check Point's product benefits from the recent general availability of its Horizon XDR product and EDR enhancements, including improved correlation of alerts into incidents and features such as automatic analysis of the attack chain and automated remediation for common threats.
  • Check Point's product has a generally intuitive management console emphasizing ease of use for less mature security organizations. Recent enhancements include a new managed security service provider (MSSP) portal that improves centralized tenant management capabilities.
  • Check Point's sales execution benefits from generally lower-than-average prices compared to other vendors in this Magic Quadrant.

  Cons:

  • Check Point's below-average market responsiveness and track record are attributed to low market and mind share among EPP buyers, despite having the resources of a large, respected security vendor and an integrated security platform.
  • Check Point's product lacks a graphical attack view and prescriptive remediation guidance, and has limited customization capabilities for detection and response rules. The vendor's secure access service edge (SASE), IoT, cloud and mobile security products are yet to be integrated with Horizon XDR/XPR.
  • Check Point's product consumes more endpoint disk space than most other solutions evaluated in this Magic Quadrant, despite recent improvements to CPU utilization and more acceptable memory utilization rates.
  • Check Point's operations are impacted by fewer certifications obtained for the solution, lagging behind other vendors in this research. For example, Check Point does not have a FedRAMP-certified product version.


• Cybereason - Visionary
  

  Pros:

  • Cybereason's product has strong EDR functionality, particularly in terms of the real-time correlation of suspicious events into prioritized MalOps, improving ease of use and addressing alert fatigue.
  • The vendor's product strategy benefits from consistent improvements to its threat detection capabilities. Recent enhancements include predictive ransomware protection, in-memory variant payload detection and behavioral document protection.
  • Cybereason's product provides MSSP tenant management capabilities, including centralized endpoint, policy and alert management across multiple customer organizations.
  • Cybereason's sales execution benefits from generally lower-than-average prices compared to other vendors in this Magic Quadrant.

  Cons:

  • Cybereason's market responsiveness and track record are impacted by low market share and a slowdown in market share growth.
  • Cybereason's overall viability and operations assessments are impacted by its recent organizational structure and leadership changes. In addition to reductions in workforce that figured into Gartner's 2022 analysis of this vendor, in the ensuing time period, recent changes in the executive leadership and additional investment from investor Softbank demonstrate an organization in transition.
  • The vendor's product lacks a comprehensive native workspace security suite compared to some other vendors in this Magic Quadrant, despite having an ecosystem of integration partners.
  • Cybereason's product relies on its managed services to deliver and create custom XDR detection rules, which requires end users to interact with the services team instead of making changes directly to the Cybereason console.


• Broadcom - Niche Player
  

  Pros:

  • Broadcom's product benefits from improved incident visualization capabilities, which provide a better experience for security analysts performing threat investigations.
  • Broadcom's product includes continued advancements in its Adaptive Protection capabilities designed to restrict the execution of trusted applications running on the endpoint. Recent enhancements include configuring granular exceptions based on the prevalence of living-off-the-land behaviors in the customer environment.
  • Broadcom's market understanding benefits from the Active Directory prevention capabilities it introduced to mitigate credential harvesting and lateral movement attack techniques.
  • Broadcom's product strategy benefits from comprehensive mobile security included in its flagship EPP product. Recent improvements include protection against malicious URLs delivered in SMS messages as part of phishing attacks.

  Cons:

  • Broadcom's market responsiveness and track record are challenged as the vendor continues to lose market share and client engagement.
  • Broadcom's customer experience assessment is impacted by the mixed signals coming from different market segments. Gartner clients often raise concerns about the vendor's customer support and service. Its larger enterprise customers have reported being more satisfied.
  • Broadcom's product lacks credible MDR service and XDR product strategies. SES Complete XDR functionality is limited to integration with CloudSOC, Broadcom's CASB solution, in addition to third-party security information and event management (SIEM) and security orchestration, analytics and reporting (SOAR) integrations.
  • Broadcom's geographic strategy assessment reflects a generally lower market penetration in regions outside North America. The vendor offers fewer cloud hosting points of presence than average among the vendors included in this Magic Quadrant.


• Broadcom (VMware) - Niche Player
  

  Pros:

  • Broadcom (VMware)'s product benefits from a mature EDR capability. Recent enhancements include combining deep endpoint network visibility via embedded network IDS with endpoint identity, authentication, and application data in a single console.
  • The vendor's geographic strategy and operations are strong, given its extensive channel ecosystem and market penetration.
  • Broadcom (VMware)'s product strategy includes expanded coverage of Carbon Black App Control to air-gapped and cloud environments.
  • The vendor's product benefits from the newly added capability to assess the security configuration of the Windows Server OS against the Center for Information Security (CIS) benchmarks for compliance purposes.

  Cons:

  • As of this writing, the acquisition of VMware by Broadcom is a continuing concern. In a recent survey of Gartner clients, most either view the future of VMware negatively or are taking a cautious approach to committing to its long-term future. Without insight into a product integration roadmap and the potential for two nearly identical products in the same portfolio, there is some uncertainty about the future.
  • Broadcom (VMware)'s market responsiveness and track record are challenged due to its relatively low market share and growth.
  • The vendor's product strategy and innovation are impacted by a lag in the rollout of innovative EPP features and prevention capabilities such as host firewall management. Its XDR solution offers limited third-party security ecosystem integration compared to Leaders in this Magic Quadrant, and may be insufficient for experienced analysts looking for flexible detection and response customization across multiple security controls.
  • Broadcom (VMware)'s product offers limited integration of the popular Carbon Black App Control with the vendor's cloud-delivered flagship EPP product. Carbon Black App Control is only available as an on-premises product.


• Cisco - Niche Player
  

  Pros:

  • Cisco's product benefits from the broad workspace security suite, as its wide range of security products provide prospective clients with consolidation opportunities to reduce integration efforts and simplify operations.
  • Cisco's product strategy benefits from integrating its flagship EPP product as a native module of Cisco Secure Client. Besides EPP, the unified agent provides additional capabilities such as VPN, SSE, network visibility and posture assessment.
  • Cisco's sales strategy benefits from including its EPP product in wider enterprise agreements. Cisco's EPP prices are also generally lower than average for vendors in this Magic Quadrant.
  • Cisco's product supports flexible on-premises EPP deployment options like air-gapped, connected stand-alone and connected proxy modes.

  Cons:

  • Cisco's market market responsiveness and track record are impacted by its small EPP market share and slow share growth relative to the vendor's overall security business. In 2023, a more detailed breakdown of market share was provided, resulting in a smaller reported EPP market share compared to 2022.
  • As of the time of this writing, Cisco's product lacks advanced EDR capabilities such as mature raw endpoint telemetry collection, creation of custom detection rules, remote script execution and remote shell. It also does not include host firewall management.
  • The vendor's innovation is held back by the generally slow pace of releasing new and innovative EPP capabilities and the re-establishment of its XDR strategy, lagging behind the Leaders in this Magic Quadrant.
  • Cisco's product requires multiple distinct administration consoles to operate a complete solution, creating a disorganized analyst workflow. The vendor recently released a new XDR solution; however, as of this writing, Gartner does not have sufficient client feedback on its ability to improve ease of use.


• ESET - Niche Player
  

  Pros:

  • ESET's product benefits from its ease of use, generally low performance impact and high protection efficacy. Recent improvements include enhancements to the vendor's software-based detection technologies with Intel Threat Detection Technology to deliver better ransomware protection and efficacy on Intel-based PCs.
  • The vendor's strong overall viability and operations are attributed to its consistent performance and 30-plus years of experience in the EPP space.
  • ESET's product provides on-premises EPP support, including hybrid and air-gapped options, which may be required in high-security environments, critical infrastructure and organizations with strict data residency requirements.
  • ESET's innovation manifests in tighter integration of its workspace security components, improving protection and ease of use for the vendor's existing clients and target buyers.

  Cons:

  • ESET's performance in the market responsiveness and track record evaluation criterion is impacted by the generally low levels of adoption of its cloud-delivered offering and the low attach rate of EDR capabilities.
  • ESET's product EDR capability assessment indicates gaps in the recorded real-time raw endpoint telemetry. For example, driver modification and unload events, device mount and unmount events, and scheduled task events aren't recorded, despite the indirect investigative evidence available in the product.
  • The vendor's product includes a custom detection rule builder that relies on text-heavy editing mechanisms and does not extend to telemetry collected outside the endpoint.
  • ESET's product strategy is impacted by XDR capabilities that are currently restricted to the vendor's product portfolio and are evolving slower than average among the vendors in this Magic Quadrant.


• Fortinet - Niche Player
  

  Pros:

  • Fortinet's strong geographic and industry/vertical strategies are attributed to its dedicated resources in relevant industry verticals, a global market presence and an ongoing expansion of cloud hosting locations across different geographies.
  • Fortinet's overall viability benefits from sustained financial performance, strength in adjacent cybersecurity markets and above-average relative share growth in the EPP market.
  • Fortinet's sales strategy includes competitive displacement programs and dedicated sales resources for specific industry verticals. FortiEDR is attractive to organizations pursuing security vendor consolidation with Fortinet Security Fabric.
  • Fortinet's product benefits from its on-premises deployment option, support for legacy OS and generally low endpoint performance impact.

  Cons:

  • Fortinet's performance in the market responsiveness and track record evaluation criterion is impacted by its low EPP market share. Despite accelerated relative share growth, the expansion is limited beyond existing Fortinet network security customers.
  • Fortinet's EDR product capability assessment indicates that custom behavioral detection rules execute on a predefined query schedule, which could potentially result in delayed detection and response for custom rules.
  • Fortinet's customer experience assessment reflects below-average ease of use based on analyst and end-user impressions of the console UX. The FortiEDR user interface requires a steep learning curve and expertise investments to operate despite the vendor's ongoing efforts to improve product usability.
  • Fortinet's performance in the innovation evaluation criterion is impacted by a lack of prevention capabilities such as host firewall management and device control on non-Windows OSs and a lack of FortiEDR integration with FortiClient, the vendor's fabric agent. FortiXDR relies on data lake integrations such as FortiSIEM for detection customization, thus impacting end-user administration experience.


• Trellix - Niche Player
  

  Pros:

  • Trellix has a strong marketing strategy based on its renewed focus on XDR, integration strategy and customer security outcome-based promotional campaigns.
  • Trellix's product benefits from custom prevention capabilities and a generally broad set of raw endpoint telemetry collected for investigation purposes. Recent improvements include the expansion of behavioral detection coverage for privilege escalation, lateral movement, credential access and persistence.
  • Trellix's above-average geographic strategy is attributed to its global presence, multilingual product localization and the broad availability of geographic points of presence.
  • Trellix's product benefits from a broad range of security capabilities and add-ons, support for legacy systems, and a significant ecosystem of XDR integration partners.

  Cons:

  • Trellix's product strategy is held back by the current mix of endpoint protection products, which are not fully integrated and can confuse prospective buyers and complicate the purchasing process.
  • Trellix's customer experience assessment indicates below-average ease of use based on analyst and end-user impressions of the console UX and a lack of fully integrated management capability. The vendor recently released XConsole; however, as of this writing, Gartner does not have sufficient client feedback on its ability to improve ease of use.
  • Trellix's product is not built on a modern unified endpoint security agent architecture. The vendor deprioritized the integration of its EPP and EDR agents.
  • Trellix's product lacks vendor-managed MDR services, despite offering other expert and staff augmentation services to assist with deployment optimization, and relies on a channel partner network to deliver MDR.


• WithSecure - Niche Player
  

  Pros:

  • WithSecure's market responsiveness and track record benefit from higher-than-average market share growth compared to other Niche Players in this Magic Quadrant.
  • WithSecure's product strategy benefits from an on-demand incident escalation capability, called "Elevate to WithSecure," that is built into the management console, allowing clients to receive investigation support from the vendor's threat hunting team. The vendor has also recently introduced Co-Monitoring Service for EDR.
  • WithSecure's product offers solid core endpoint protection capabilities, which were recently extended with endpoint encryption, dynamically adjustable security configurations reacting to heightened risk, ransomware rollback and patch management for macOS.
  • WithSecure's product benefits from the vendor's investment in an EU-specific MDR service delivery mode, where the data is stored and accessible only from within the EU, making it attractive to customers in that geography.

  Cons:

  • WithSecure's product lacks a robust EDR capability, indicating gaps in the recorded raw endpoint telemetry collection and a lack of functionality to create custom detection rules and assign corresponding response actions.
  • WithSecure's geographic and vertical/industry strategies lack a differentiated approach to addressing the needs of specific industry verticals and geographies. Most WithSecure clients are located in Europe, lacking a balanced global representation.
  • WithSecure's product XDR capability is limited, only integrating with Microsoft 365 Email, Teams, OneDrive and SharePoint, and lacking in third-party integrations. WithSecure's overall security suite is limited to EPP, CSPM and Microsoft Office 365 protection.
  • WithSecure's innovation is held back by a lack of seamless and complete EDR capability integration in its console UX compared to Visionaries in this Magic Quadrant.

Reference

• Gartner, Magic Quadrant for Endpoint Protection Platforms, 31 December 2023, ID G00789052

View Market Definition
View Vendor Movements