Report:

Magic Quadrant for Endpoint Protection Platforms

Top Vendor Products for Endpoint Protection Platforms in 2025

• CrowdStrike
• Microsoft
• Palo Alto Networks
• SentinelOne
• Sophos
• Trend Micro

Endpoint Protection Platforms Vendor Product Comparisons 2025

• CrowdStrike - Leader
  

  Pros:

  • Product: CrowdStrike's EDR functionality, cloud-based management, performance impact and TDIR product integration capabilities are well-regarded by customers for their efficacy and utility.
  • Product strategy: CrowdStrike's foundational developments in the EPP market, such as a lightweight endpoint agent with broad raw endpoint telemetry collection, enable it to continue to address emerging requirements of EPP buyers ahead of market competitors. Following the July 2024 Channel File 291 incident, CrowdStrike released granular content update controls for update scheduling, version control and group-based deployments, offered only by a few other vendors.
  • Market responsiveness and track record: CrowdStrike holds a significant share of the EPP market and continues to demonstrate a leading rate of consideration by EPP buyers.

  Cons:

  • Pricing: Although CrowdStrike launched the Falcon Flex licensing model, customers report that its licensing is increasingly difficult to understand. Additionally, CrowdStrike remains one of the premium-priced offerings compared to other vendors in this research.
  • Geographic strategy: CrowdStrike's dashboard language support is limited to English and Japanese. CrowdStrike also offers fewer geographic SaaS points of presence than other vendors in this Magic Quadrant.
  • Vertical strategy: CrowdStrike's product offering is not suitable for organizations that require on-premises, air-gapped or hybrid management of EPP.


• Microsoft - Leader
  

  Pros:

  • Product: Microsoft's EDR functionality, protection, cloud-based management and workspace security integration capabilities are generally well-regarded by customers for their effectiveness and maturity.
  • Product strategy: Microsoft's planned enhancements, such as autonomous attack surface reduction, build on a long history of consistent investment in its EPP product capabilities, such as rules for endpoint attack surface reduction. Microsoft's integration with its broader ecosystem is notable.
  • Market responsiveness and track record: Microsoft holds a significant share of the EPP market and continues to demonstrate a leading rate of consideration by EPP buyers.

  Cons:

  • Sales execution: Customers using Microsoft licensing bundles often report product underutilization and diminished discounts at renewal time, which can be challenging in the current macroeconomic environment.
  • Customer experience: Customers report that initial deployment, configuration optimization and relatively slow pace of support issue resolution may degrade the overall customer experience.
  • Innovation: In the last year, Microsoft's R&D appears to have been focused on bolstering adjacent products, such as Security Exposure Management, which is less likely to impact the broader EPP market.


• Palo Alto Networks - Leader
  

  Pros:

  • Product: Cortex XDR's capabilities, such as EDR functionality, protection, cloud-based management and TDIR product integration are generally well-regarded by customers for their efficacy and maturity.
  • Product strategy: Palo Alto Networks consistently demonstrates improvements in its EPP product functionality and protection efficacy across major operating systems. The vendor's planned enhancements align with emerging requirements of EPP buyers.
  • Overall viability: Palo Alto Networks is a large, well-funded vendor with strong global presence and faster-than-average revenue growth in the EPP market. Palo Alto Networks publicly stated its intentions to continue to invest in its Cortex product portfolio.

  Cons:

  • Pricing: Although Palo Alto Networks offers a competitive displacement program, the vendor's offering remains a premium-priced product with some customers expressing concern over cost at renewal time.
  • Vertical strategy: Palo Alto Networks' product offering is not suitable for organizations that require on-premises or air-gapped management of EPP.
  • Market responsiveness and track record: The vendor's share of the EPP market remains significantly lower than that of other Leaders in this Magic Quadrant.


• SentinelOne - Leader
  

  Pros:

  • Product: SentinelOne's EDR functionality, cloud-based management, ease of use and hybrid management capabilities are generally well-regarded by customers for their efficacy and maturity.
  • Product strategy: SentinelOne's developments in the EPP market resulted in differentiated and intuitive console UX, balancing high configuration granularity with capability depth and ease of use. Recent and planned releases reaffirm its continued investment in maintaining EPP product efficacy while gradually expanding its portfolio.
  • Market responsiveness and track record: SentinelOne's share of the EPP market is larger than that of most other vendors included in this Magic Quadrant.

  Cons:

  • Geographic strategy: SentinelOne's administration dashboard supports only English and Japanese. Most of SentinelOne's customers are based in the U.S., resulting in lower market penetration in international markets compared to other Leaders in this Magic Quadrant.
  • Innovation: In the last year, SentinelOne's R&D appears to be focused on bolstering adjacent product capabilities, such as automation and orchestration, which are less likely to impact the broader EPP market.
  • Pricing: SentinelOne's offering remains a premium-priced product in the EPP market, which may put a strain on organizations in the current macroeconomic environment.


• Sophos - Leader
  

  Pros:

  • Sales strategy: Sophos offers user-based licensing, enhancing the competitiveness of its EPP product pricing for organizations where each employee uses multiple devices that require protection.
  • Operations: Sophos' acquisition of Secureworks increases available resources, helping expand operations, sales reach and expertise in adjacent market segments. This acquisition is expected to help close gaps in TDIR functionality and product customization, potentially improving appeal to larger enterprises.
  • Overall viability: Sophos demonstrates consistent revenue growth and a long history in the EPP market, indicating a likelihood to continue to invest in its EPP.

  Cons:

  • Innovation: In the last year, Sophos' R&D appears to be focused on addressing gaps in Sophos Endpoint powered by Intercept X endpoint telemetry collection. Additionally, Sophos is focused on integrating its EPP with Taegis XDR, resulting in fewer EPP-specific innovations during the analysis period.
  • Customer experience: Customers report that high system resource consumption during full system scanning and inefficient security workflows in Sophos Central may degrade the overall user and customer experience.
  • Vertical strategy: Sophos' product offering is not suitable for organizations that require on-premises or air-gapped management of EPP.


• Trend Micro - Leader
  

  Pros:

  • Product: Trend Micro's prevention, cloud-based management, hybrid management, OS support and workspace security capabilities are generally well-regarded by customers. Notably, Trend Micro's virtual patching helps shield vulnerabilities in applications that can't be easily patched.
  • Product strategy: Trend Micro's developments in the EPP market resulted in a differentiated, well-integrated set of endpoint protection capabilities, such as adaptive protection settings. Recently released and planned enhancements reaffirm its continued commitment to advancing its product against emerging customer requirements.
  • Innovation: Trend Micro's recent innovations, such as deepfake detection, adaptive threat detection and behavioral protection, and granular content update controls, offer customers early access to improved endpoint security and operations.

  Cons:

  • Customer experience: Indications from customers and third-party efficacy tests are that high-alert volume and resource consumption during scanning impact the overall user and customer experience.
  • Sales strategy: Customers report that Trend Micro's credit-based licensing can be difficult to understand, citing lack of clarity regarding how credits are allocated within the vendor's broader portfolio.
  • Overall viability: In the last year, Trend Micro's revenue growth in the EPP market has been slower than that of other Leaders in this Magic Quadrant.


• Bitdefender - Visionary
  

  Pros:

  • Market understanding: Bitdefender's understanding of the EPP market helps it prioritize and release product enhancements, such as endpoint risk analytics and endpoint tagging that show demonstrable benefit to customers based on reviews.
  • Innovation: Bitdefender's recent innovations, such as PHASR, are differentiated in the market and offer customers more dynamic endpoint security configuration options that align protection with specific device and worker behaviors.
  • Customer experience: Customers generally rate the technical and account management support they receive from Bitdefender as responsive and helpful in addressing issues in a timely manner.

  Cons:

  • Operations: Bitdefender remains one of the smaller providers in this Magic Quadrant and as such, it has less-diversified operations and geographic presence compared to Leaders.
  • Market responsiveness and track record: Bitdefender's share of the EPP market remains low compared to challengers and leaders in this Magic Quadrant.
  • Sales strategy: Based on Gartner end-user client inquiries and Peer Insights customer feedback, Bitdefender is less frequently included on competitive EPP provider shortlists compared to other vendors represented in this Magic Quadrant.


• Broadcom - Niche Player
  

  Pros:

  • Vertical strategy: Broadcom continues to offer and deliver incremental improvements to its on-premises Symantec EPP offering, benefiting organizations requiring hybrid or on-premises (including air-gapped) management of EPP in architecturally constrained environments.
  • Geographic strategy: Broadcom's SES Complete administration dashboard supports multiple European and Asian languages in addition to English, benefiting international operations teams.
  • Sales strategy: Broadcom maintains direct sales relationships with strategic customers in the global large enterprise segment, enabling improved account management compared to that offered to smaller organizations.

  Cons:

  • Product strategy: Over the past year, Broadcom has introduced incremental enhancements and bug fixes to its EPP products, which are likely to have limited appeal to prospects beyond Broadcom's primary target audience.
  • Innovation: Broadcom's R&D is historically focused on closing technical gaps in its products, such as Intrusion Detection System (IDS) alert exclusion functionality in Carbon Black Cloud EPP, to moderately improve usability for existing customers rather than delivering major innovations in the EPP market.
  • Sales execution: Customers outside the vendor's target audience reported challenges engaging with Broadcom and obtaining product information; they also encountered inflated pricing during renewal cycles of the vendor's EPP products.


• Check Point Software Technologies - Niche Player
  

  Pros:

  • Pricing: Check Point's EPP product pricing is highly competitive for the breadth of prevention and protection features it offers relative to other vendors in this research.
  • Geographic strategy: Check Point's administration dashboard offers support for multiple European languages along with English, Chinese and Japanese. The vendor also has at least one SaaS point of presence in most major geographies, catering to organizations with data residency requirements.
  • Vertical strategy: Check Point maintains a balanced presence across its key industry verticals, such as banking and government. The vendor continues to enhance its on-premises product, narrowing the feature gap with its cloud-delivered offering. Notably, Check Point introduced agent software and security content caching for endpoints without direct internet connectivity.

  Cons:

  • Product strategy: Check Point's recent and planned enhancements do not adequately address enterprise buyer needs, such as the breadth of collected endpoint telemetry, role-based access control granularity, vulnerability prioritization and configuration optimization. The Harmony Endpoint agent remains more resource-intensive compared to other products in this Magic Quadrant.
  • Innovation: In the last year, Check Point's R&D has been focused on addressing technical gaps in its EPP product, such as reducing agent footprint, and enhancing adjacent product capabilities, which are less likely to impact the broader enterprise EPP market.
  • Sales strategy: Based on Gartner end-user client inquiries and Peer Insights customer feedback, Check Point is rarely included on competitive EPP provider shortlists compared to market leaders in this Magic Quadrant.


• Cisco - Niche Player
  

  Pros:

  • Pricing: Cisco's EPP product pricing is competitive compared to other vendors in this research, especially when purchased as part of one of its product suites.
  • Vertical strategy: Cisco has a balanced presence across its key industry verticals, such as education and government. The vendor continues to enhance its on-premises product offering with recent enhancements such as remote agent uninstall, portable device control and additional OS support.
  • Operations: Cisco is a large organization with geographically diverse operations and resources, which help support its customers in addressing security challenges that continue to extend beyond the EPP market.

  Cons:

  • Product strategy: Cisco's recent and planned enhancements do not adequately address enterprise buyer needs such as endpoint detection customization, breadth of collected endpoint telemetry, granular role-based access controls and API maturity. Cisco still has distinct administration consoles for several of its EPP product functions, which impacts the administration experience.
  • Market understanding: Most buyers in the EPP market seek a single EPP product rather than the broad product suite positioned by Cisco. This mismatch with market needs makes Cisco's offering appealing to only a small subset of EPP buyers.
  • Sales strategy: Based on Gartner end-user client inquiries and Peer Insights customer feedback, Cisco is rarely included on competitive EPP provider shortlists compared to market Leaders in this Magic Quadrant.


• Cybereason - Niche Player
  

  Pros:

  • Pricing: Cybereason's EPP product pricing is competitive for the breadth and maturity of behavioral endpoint monitoring and protection capabilities included.
  • Innovation: Cybereason's recent releases, such as infostealer detection and Application Control, are likely to benefit the security of existing customers who successfully adopt them.
  • Product: Cybereason's EDR functionality and hybrid management capabilities are well-regarded by customers for their effectiveness.

  Cons:

  • Product strategy: Cybereason's product lacks features such as native endpoint vulnerability assessment, which most other EPPs already offer. Additionally, Gartner notes an ongoing effort to consolidate administration dashboards across old and new EPP product versions as well as adjacent TDIR-capable products.
  • Operations: In the past year, Cybereason has undergone multiple organizational structure and leadership changes, indicating that the organization remains in flux.
  • Sales strategy: Based on Gartner end-user client inquiries and Peer Insights customer feedback, Cybereason is rarely included on competitive EPP provider shortlists.


• ESET - Challenger
  

  Pros:

  • Customer experience: Customers rate the technical and account management support they receive from ESET as responsive and helpful in addressing issues in a timely manner.
  • Operations: Most ESET resources are dedicated to supporting EPP research and development and most of ESET's revenue comes from selling its EPP product.
  • Geographic strategy: ESET's dashboard and documentation support multiple European and Asian languages in addition to English, making it attractive to customers worldwide.

  Cons:

  • Product strategy: ESET's recent enhancements do not adequately address certain enterprise buyer needs, such as breadth of collected endpoint telemetry (especially on Linux OS), the range of prebuilt third-party integrations and mature vulnerability prioritization. Additionally, ESET's product requires installation of multiple endpoint applications to access its full range of EPP capabilities.
  • Market responsiveness and track record: In the last year, ESET's market share growth has been slower compared to the overall market growth rate.
  • Sales strategy: Based on Gartner end-user client inquiries and Peer Insights customer feedback, ESET is rarely included on competitive EPP provider shortlists compared to Leaders in this research.


• Fortinet - Niche Player
  

  Pros:

  • Geographic strategy: Fortinet has multiple SaaS points of presence in most major geographies, catering to organizations with data residency and regulatory requirements. The vendor continues to enhance its administration dashboard by adding new language support options, including Spanish, Portuguese and German.
  • Vertical strategy: Fortinet maintains a balanced presence across its key industry verticals, such as government and manufacturing. The vendor continues to enhance its on-premises product, maintaining feature parity with its cloud-delivered FortiEDR product offering.
  • Overall viability: Fortinet is a large, well-funded vendor with a strong presence in the market across various lines of business and consistent revenue growth. Fortinet made public statements about its intention to continue to invest in technology for security operations, including FortiEDR.

  Cons:

  • Product strategy: Fortinet's past and planned enhancements do not adequately address certain enterprise buyer needs, such as granular role-based access controls, built-in controls for scheduling endpoint updates, intuitive detection customization UX or a fully streamlined security analyst workflow.
  • Innovation: In the last year, there were limited notable innovative EPP capabilities released by Fortinet compared to the market. R&D was focused on integration (Perception Point acquisition) and unification of endpoint protection and secure access agents.
  • Market responsiveness and track record: Fortinet's share of the EPP market remains low compared to Challengers and Leaders in this Magic Quadrant.


• Trellix - Challenger
  

  Pros:

  • Geographic strategy: The Trellix administration dashboard and documentation support multiple European and Asian languages in addition to English, making it attractive to customers worldwide.
  • Vertical strategy: Trellix maintains a balanced presence across its key industry verticals, such as government and manufacturing. The vendor's offering is attractive to organizations requiring hybrid or on-premises (including air-gapped) management of EPP.
  • Market responsiveness and track record: Trellix's share of the EPP market remains significantly higher than that of Niche Players and Visionaries.

  Cons:

  • Product strategy: Trellix's recent enhancements do not adequately address gaps in its product UX, which remains highly fragmented with numerous role-specific dashboards loosely integrated via single sign-on. Customers report that the current UX can impact the ease of administration and necessitate longer training.
  • Innovation: In recent years, Trellix's R&D has been mostly focused on product integration efforts, aiming to rationalize agents and administration dashboards.
  • Operations: In the past year, Trellix has undergone multiple executive leadership and product management role changes, indicating the organization is in transition.


• WithSecure - Niche Player
  

  Pros:

  • Market understanding: WithSecure's understanding of the EPP market's dynamics and competitors helps it concentrate its efforts on helping organizations in Europe meet their regulatory, product and service needs.
  • Geographic strategy: WithSecure's administration dashboard and documentation support multiple European and Asian languages in addition to English, making it attractive to customers worldwide.
  • Overall viability: WithSecure has a long history in the EPP market and most of its revenue comes from selling EPP software.

  Cons:

  • Product strategy: WithSecure's recent product enhancements, such as advanced response actions for non-Windows OSs and detection customization, appear to be focused on closing the gaps in its product and are less likely to impact the broader enterprise EPP market.
  • Operations: WithSecure remains a comparatively small company with less-diversified operations and geographic presence compared to Leaders in this research.
  • Market responsiveness and track record: WithSecure's share of the EPP market remains lower than that of Leaders or Challengers in this Magic Quadrant.

Reference

• Gartner, Magic Quadrant for Endpoint Protection Platforms, 14 July 2025, ID G00823512

View Market Definition
View Vendor Movements