..
..
..
..
..

The Radicati Group, Inc.
www.radicati.com

THE RADICATI GROUP, INC.

Endpoint Security - Market
Quadrant 2020 *
.

.

.

.

.

.

.

.

.

An Analysis of the Market for
Endpoint Security Revealing
Top Players, Trail Blazers,
Specialists and Mature Players.
November 2020

Radicati Market QuadrantSM is copyrighted November 2020 by The Radicati Group, Inc. This
report has been licensed for distribution. Only licensee may post/distribute. Vendors and products
depicted in Radicati Market QuadrantsSM should not be considered an endorsement, but rather ameasure of The Radicati Group’s opinion, based on product reviews, primary research studies,
vendor interviews, historical data, and other metrics. The Radicati Group intends its Market
Quadrants to be one of many information sources that readers use to form opinions and makedecisions. Radicati Market QuadrantsSM are time sensitive, designed to depict the landscape of aparticular market at a given point in time. The Radicati Group disclaims all warranties as to theaccuracy or completeness of such information. The Radicati Group shall have no liability forerrors, omissions, or inadequacies in the information contained herein or for interpretations
thereof.
*.

Endpoint Security - Market Quadrant 2020

TABLE OF CONTENTS
RADICATI MARKET QUADRANTS EXPLAINED............................................................................... 3
MARKET SEGMENTATION – ENDPOINT SECURITY........................................................................ 5
EVALUATION CRITERIA ................................................................................................................. 7
MARKET QUADRANT – ENDPOINT SECURITY ............................................................................. 11
KEY MARKET QUADRANT TRENDS............................................................................................ 12
ENDPOINT SECURITY - VENDOR ANALYSIS ................................................................................. 12
TOP PLAYERS .......................................................................................................................... 12
TRAIL BLAZERS ....................................................................................................................... 33
SPECIALISTS ............................................................................................................................ 44===============================================================
This report has been licensed for distribution. Only licensee may post/distribute.
Please contact us at admin@radicati.com if you wish to purchase a license.
===============================================================

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

2

Endpoint Security - Market Quadrant 2020

RADICATI MARKET QUADRANTS EXPLAINEDRadicati Market Quadrants are designed to illustrate how individual vendors fit within specifictechnology markets at any given point in time. All Radicati Market Quadrants are composed offour sections, as shown in the example quadrant (Figure 1).
1. Top Players – These are the current market leaders with products that offer, bothbreadth and depth of functionality, as well as possess a solid vision for the future. Top
Players shape the market with their technology and strategic vision. Vendors don’t
become Top Players overnight. Most of the companies in this quadrant were firstSpecialists or Trail Blazers (some were both). As companies reach this stage, they mustfight complacency and continue to innovate.
2. Trail Blazers – These vendors offer advanced, best of breed technology, in some areas of
their solutions, but don’t necessarily have all the features and functionality that would
position them as Top Players. Trail Blazers, however, have the potential for “disrupting”
the market with new technology or new delivery models. In time, these vendors are most
likely to grow into Top Players.
3. Specialists – This group is made up of two types of companies:
a. Emerging players that are new to the industry and still have to develop some
aspects of their solutions. These companies are still developing their strategy andtechnology.
b. Established vendors that offer very good solutions for their customer base, andhave a loyal customer base that is totally satisfied with the functionality they are
deploying.
4. Mature Players – These vendors are large, established vendors that may offer strong
features and functionality, but have slowed down innovation and are no longer
considered “movers and shakers” in this market as they once were.
a. In some cases, this is by design. If a vendor has made a strategic decision to movein a new direction, they may choose to slow development on existing products.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

3

Endpoint Security - Market Quadrant 2020

b. In other cases, a vendor may simply have become complacent and be outdeveloped by hungrier, more innovative Trail Blazers or Top Players.
c. Companies in this stage will either find new life, reviving their R&D efforts andmove back into the Top Players segment, or else they slowly fade away as legacy
technology.
Figure 1, below, shows a sample Radicati Market Quadrant. As a vendor continues to develop its
product solutions adding features and functionality, it will move vertically along the “y”
functionality axis.
The horizontal “x” strategic vision axis reflects a vendor’s understanding of the market and theirstrategic direction plans. It is common for vendors to move in the quadrant, as their products
evolve and market needs change.

High

Radicati Market QuadrantSM
Mature Players

Top Players•
Company L

Functionality•
Company Z•
Company Y•
Company J•
Company H

Low•

Company D••• Company B
Company C
Company A

Specialists
Low•
Company E••
Company F
Company G

Trail Blazers

Strategic VisionHigh

Figure 1: Sample Radicati Market Quadrant

INCLUSION CRITERIA
We include vendors based on the number of customer inquiries we receive throughout the year.
We normally try to cap the number of vendors we include to about 10-12 vendors. Sometimes,
however, in highly crowded markets we need to include a larger number of vendors.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

4

Endpoint Security - Market Quadrant 2020

MARKET SEGMENTATION – ENDPOINT SECURITY
This edition of Radicati Market QuadrantsSM covers the “Endpoint Security” segment of the
Security Market, which is defined as follows:•

Endpoint Security – are appliances, software, cloud services, and hybrid solutions that
help to secure and manage endpoints for business organizations of all sizes. Endpoint
security solutions must be able to prevent, detect, block and remediate all threats to theendpoint. Often these solutions also combine deep forensic capabilities, and managed
services for threat hunting and neutralization. Leading vendors in this market, include:
Bitdefender, BlackBerry, Cisco, CrowdStrike, Cybereason, ESET, F-Secure, Kaspersky,
McAfee, Microsoft, Panda, SentinelOne, Sophos, Symantec, Trend Micro, VMware
Carbon Black, and Webroot.

•

Vendors in this market often target both consumer and business customers. However, thisreport deals only with solutions aimed at businesses, ranging from SMBs to very largeorganizations. Government organizations are considered “business/corporate organizations”
for the purposes of this report.

•

The line between traditional and next generation endpoint solutions no longer exists as nearly
all vendors offer behavior-oriented solutions which include endpoint detection and response(EDR) or extended detection and response (XDR), sandboxing, advanced persistent threat(APT) protection, managed detection and response (MDR), and more.

•

Organizations no longer view endpoint security as an isolated discipline affecting only theendpoint but as an integral part of an organization-wide defense posture, where endpoint
security shares threat intelligence feeds and policy controls with all other major security
components, including firewalls, secure web gateways, secure email gateways, data loss
prevention (DLP), and more.

•

The endpoint security market continues to experience very strong growth as organizations of
all sizes deploy increasingly sophisticated and feature-rich solutions to help protect against
all threats and malicious attacks. The Endpoint Security market is expected to surpass $8.2
billion in 2020, and grow to over $15.6 billion by 2024. Figure 1, shows the projected
revenue growth from 2020 to 2024.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

5

Endpoint Security - Market Quadrant 2020

Endpoint Security - Revenue Forecast, 2020-2024$18,000$15,629$16,000$13,245$14,000$11,224$12,000$10,000$9,512$8,200$8,000$6,000$4,000$2,000
$0
2020

2021

2022

2023

2024

Figure 2: Endpoint Security Market Revenue Forecast, 2020-2024

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

6

Endpoint Security - Market Quadrant 2020

EVALUATION CRITERIA
Vendors are positioned in the quadrant according to two criteria: Functionality and Strategic
Vision.
Functionality is assessed based on the breadth and depth of features of each vendor’s solution.
All features and functionality do not necessarily have to be the vendor’s own originaltechnology, but they should be integrated and available for deployment when the solution ispurchased.
Strategic Vision refers to the vendor’s strategic direction, which comprises: a thoroughunderstanding of customer needs, ability to deliver through attractive pricing and channel
models, solid customer support, and strong on-going innovation.
Vendors in the Endpoint Security space are evaluated according to the following key features andcapabilities:•

Deployment Options – availability of the solution in different form factors, such as onpremises, appliance and/or virtual appliance, cloud-based services, or hybrid.

•

Platform Support – the range of computing platforms supported, e.g. Windows, macOS,
Linux, iOS, Android, and others.

•

Malware detection – is usually based on signature files, reputation filtering (proactive
blocking of malware based on its behavior, and a subsequent assigned reputation score), andproprietary heuristics. The typical set up usually includes multiple filters, one or more bestof-breed signature-based engines as well as the vendor’s own proprietary technology.
Malware engines are typically updated multiple times a day. Malware can include spyware,viruses, worms, rootkits, and much more.

•

Antivirus Removal Tools – serve to uninstall previously used security software on a user’smachine. Running multiple security solutions on one device can cause conflicts on theendpoints, which can result in downtime.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

7

Endpoint Security - Market Quadrant 2020•

Directory integration – can be obtained via Active Directory or a variety of other protocols,such as LDAP. By integrating with a corporate directory, organizations can more easily
manage and enforce user policies.

•

Firewall – functionality typically comes with most endpoint security solutions, and offers amore granular approach to network protection, such as blocking a unique IP address.
Intrusion prevention systems are also commonly included as a feature in firewalls. Intrusion
detection and prevention systems protect against incoming attacks on a network.

•

URL Filtering – enables organizations to manage and control the websites their employees
are allowed to visit. Solutions can block particular websites, or define categories of websites(e.g. gambling) to block, as well as integrate with sandboxing and or threat intelligence feeds
to detect and stop malicious URLs.

•

Third Party Patch Assessment – is a common feature included in many endpoint security
solutions. It serves to inventory software on protected endpoints to determine if any of thesoftware on the endpoint is out-of-date. It is meant to alert administrators about important
software updates that have not yet been deployed.

•

Third Party Patch remediation – lets administrators deploy a missing software update
discovered during the patch assessment phase. It should be possible for administrators to
deploy software updates directly from the management console.

•

Reporting – lets administrators view activity that happens on the network. Endpoint Security
solutions should offer real-time interactive reports on user activity. Summary views to givean overall view of the state of the network should also be available. Most solutions allow
organizations to run reports for events that occurred over the past 12 months, as well as toarchive event logs for longer-term access.

•Web and Email Security – features enable organizations to block malware that originatesfrom web browsing or emails with malicious intent. These features are compatible withapplications for web and email, such as browsers, email clients, and others. These features
also help block blended attacks that often arrive via email or web browsing.

•

Device control – allows control on the use of devices on endpoints, such as USB drives,
CD/DVDS, and more. Some solutions provide only basic binary control policies (i.e.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

8

Endpoint Security - Market Quadrant 2020

allow/disallow), while others allow more granular controls, e.g. blocking a device by user, orgroup of users, and more.
•

Encryption – support for full-disk encryption (FDE) to lock an entire drive, or file-based
encryption to lock specific files.

•

Network access control (NAC) – lets administrators block network access to certain
endpoints for various reasons. It is commonly used to bar new endpoints from joining the
network that have yet to deploy the organization’s security policies.

•

Mobile device protection – many endpoint security vendors integrate some form of mobile
protection into their endpoint solutions. Some endpoint security vendors offer mobile
protection through separate add-ons for Mobile Device Management (MDM) or Enterprise
Mobility Management (EMM).

•

Data Loss Prevention (DLP) – allows organizations to define policies to prevent loss of
sensitive electronic information. There is a range of DLP capabilities that vendors offer intheir solutions, ranging from simple keyword based detection to more sophisticated ContentAware DLP functionality.

•

Administration – should provide easy, single pane-of-glass management across all users andresources. Many vendors still offer separate management interfaces for their on-premises andcloud deployments. As more organizations choose a hybrid deployment model, an integrated
management experience that functions across on-premises and cloud is required.

•

Sandboxing – does the solution include sandboxing capabilities, or integrate with a third
party sandboxing solution for pre- or post-execution malware detection.

•

Advanced Persistent Threat (APT) – endpoint protection solutions should integrate with
APT solutions for real-time threat correlation across the entire customer environment.

•

EDR/XDR – endpoint protection solutions should include Endpoint Detection and Response(EDR) or Extended Detection and Response (XDR) solutions, or integrate with third party
EDR/XDR solutions.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

9

Endpoint Security - Market Quadrant 2020•

Managed Detection and Response (MDR) – managed services which allow organizations to
outsource their security services for 24/7 threat detection, response and remediation.

In addition, for all vendors we consider the following aspects:•

Pricing – what is the pricing model for their solution, is it easy to understand and allows
customers to budget properly for the solution, as well as is it in line with the level offunctionality being offered, and does it represent a “good value”.

•

Customer Support – is customer support adequate and in line with customer needs andresponse requirements.

•

Professional Services – does the vendor provide the right level of professional services forplanning, design and deployment, either through their own internal teams, or throughpartners.

Note: On occasion, we may place a vendor in the Top Player or Trail Blazer category even if
they are missing one or more features listed above, if we feel that some other aspect(s) of theirsolution is particularly unique and innovative.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

10

Endpoint Security - Market Quadrant 2020

MARKET QUADRANT – ENDPOINT SECURITY

Radicati Market QuadrantSM
High

Top Players

Mature Players

Symantec •Cisco •

Functionality

Bitdefender •Low

ESET •
Kaspersky •SentinelOne •McAfee •CrowdStrike •Webroot •Cybereason •Panda •
F-Secure •BlackBerry (Cylance) •VMware Carbon Black •Microsoft •Trend Micro •Specialists

Low

Sophos •Trail Blazers
High

Strategic Vision
Figure 3: Endpoint Security Market Quadrant, 2020**

Radicati Market QuadrantSM is copyrighted November 2020 by The Radicati Group, Inc. This reporthas been licensed for distribution. Only licensee may post/distribute. Vendors and products depicted in
Radicati Market QuadrantsSM should not be considered an endorsement, but rather a measure of The
Radicati Group’s opinion, based on product reviews, primary research studies, vendor interviews,
historical data, and other metrics. The Radicati Group intends its Market Quadrants to be one of many
information sources that readers use to form opinions and make decisions. Radicati Market QuadrantsSM
are time sensitive, designed to depict the landscape of a particular market at a given point in time. The
Radicati Group disclaims all warranties as to the accuracy or completeness of such information. The
Radicati Group shall have no liability for errors, omissions, or inadequacies in the information contained
herein or for interpretations thereof.
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

11

Endpoint Security - Market Quadrant 2020

KEY MARKET QUADRANT TRENDS•

The Top Players in the Endpoint Security market are Symantec, Cisco, Bitdefender, ESET,
Kaspersky, and SentinelOne.

•

The Trail Blazers quadrant includes Webroot, Cybereason, and Sophos.

•

The Specialists in this market are McAfee, CrowdStrike, Panda, F-Secure, BlackBerry,
VMware Carbon Black, Microsoft, and Trend Micro.

•

There are no Mature Players in this market at this time.

ENDPOINT SECURITY - VENDOR ANALYSISTOP PLAYERSSYMANTEC (A DIVISION OF BROADCOM)
1320 Ridder Park Drive
San Jose, CA 95131
www.broadcom.com
Symantec offers a wide range of security solutions for enterprises. Symantec operates one of thelargest civilian cyber intelligence networks, allowing it to see and protect against the mostadvanced threats. Symantec is an operating division of Broadcom. Broadcom is publicly traded.

SOLUTIONS
Symantec Endpoint Security solutions are powered by the Symantec Global Intelligence
Network that offers real-time updates to prevent attacks, stop breaches, and mitigate risk.
Symantec offers the following endpoint protection solutions:•

Symantec Endpoint Security Complete – supports on-premises, cloud, and hybrid options
for deployment and management. It delivers artificial intelligence-guided security
management by combining multiple technologies to address threats across the entire attack

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

12

Endpoint Security - Market Quadrant 2020

chain. Protections begin with Symantec Endpoint Protection which delivers: malware
protection, advanced machine learning, behavioral analysis, reputation filtering, exploit andintrusion prevention, deception, mail security, web security, firewall, device control,
antivirus removal tools, recovery tools, reporting, REST APIs, and integration with
Symantec intelligent threat cloud capabilities. It also includes Mobile Threat Defense,
endpoint detection and response, protections against Active Directory exploits, attack surface
reduction capabilities, such as smart application isolation, behavioral isolation, application
control, and extended operating system protections. It protects all endpoints including
workstations, laptops, mobile phones, tablets, and servers and is compatible with Windows,
macOS, Linux, Android, iOS, VMware ESX, Citrix XenServer, and other virtual machines.
The solution is managed from a centralized console, which supports the definition of granularmanagement policies. Key capabilities include:o Advanced mobile threat defense – uses predictive technology in a layered approach thatleverages crowd-sourced threat intelligence, in addition to device and server based
analysis, to proactively protect mobile devices from malware, network threats, andapp/OS vulnerability exploits.
o Endpoint Detection and Response (EDR) – detects advanced attacks, provides real-time
analytics, and enables SOC teams to actively hunt threats and pursue forensic
investigations and remediation.
o Application Isolation – limits unusual and risky behaviors of trusted applications withminimal operational impact.
o Application Control – assesses the risk level of applications and their vulnerabilities, andallows only “known good” applications to run.
o Active Directory Security – automatically learns an organization’s entire Active Directory
structure and uses obfuscation to prevent attackers from stealing credentials and moving
laterally within the organization.
Symantec Endpoint Security Enterprise is another product option in the Symantec endpoint
portfolio, which offers a subset of the Symantec Endpoint Security Complete capabilities
including Symantec Endpoint Protection, mobile threat defense and flexible deployment options
across cloud, on-premises, and hybrid.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

13

Endpoint Security - Market Quadrant 2020

STRENGTHS•

Symantec offers a single management console to protect Windows, macOS, Linux, iOS,
Android, Embedded and Virtual machines, as well as a single integrated agent on theendpoint for seamless management and performance. Hybrid management options,combining on-premises and cloud are also available.

•

Symantec Endpoint Security offers multi-layered protection powered by artificial intelligence
and advanced machine learning to provide prevention, detection and response, as well as
deception, Active Directory security, application isolation, and application control.

•

Symantec Endpoint Security has built-in EDR capabilities, including Threat Hunter which
combines advanced machine learning with Symantec’s SOC analyst expertise.

•

The level of granularity and flexibility in the management console is higher than that ofmany competing solutions in the market.

•

The firewall functionality included can block unique IP addresses and leverages reputation
analysis from Symantec’s Global Intelligence Network. It can also do behavioral analysis
and apply application controls.

•

Symantec’s Integrated Cyber Defense (ICD) platform includes a unified cloud management
console as well as a broad portfolio of security solutions (e.g. endpoint security, network
security, information security, and more). It delivers data, analytics, and insights acrossmultiple control points for improved visibility and implementation of extended detection andresponse (XDR).

WEAKNESSES•

Endpoint management (ITMS), powered by Altiris, is available primarily as an on-premises
managed solution currently, and only some features like vulnerability remediation areavailable on the cloud console.

•

Symantec offers strong content-aware DLP capabilities, however these require a separate
add-on.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

14

Endpoint Security - Market Quadrant 2020•

Symantec Endpoint Security offers encryption as a separate option, available for separatepurchase.

•

Symantec sold its Managed Services business, including its MDR services, to Accenture. It
now offers MDR services in partnership with Accenture.

•

Although Symantec is still the market share leader, it has been losing some mindsharefollowing the Broadcom acquisition. The vendor is working to improve and increase
mindshare.

CISCO
170 West Tasman Dr.
San Jose, CA 95134
www.cisco.com
Cisco is a leading vendor of Internet communication and security technology. Cisco’s security
solutions are powered by the Cisco Talos Intelligence Group (Talos), made up of leading threat
researchers. Cisco is publicly traded.
SOLUTIONS
Cisco Secure Endpoint (formerly Advanced Malware Protection for Endpoints) is a cloudbased endpoint security solution designed to detect, prevent, and remediate advanced threats. It
provides a holistic view of servers and endpoints running Windows, Mac, Android, Apple iOS,
Linux (Oracle Enterprise CentOS and RedHat), as well as virtual systems. It is available througha public or on-premise private cloud deployment.
Secure Endpoint comprises the following key capabilities:o Malware Prevention – is provided through a set of technologies including file reputation,
traditional anti-virus, cloud-based sandboxing, file-less in-memory exploit prevention,system process protection, ransomware protection and dynamic behavior-based protection.
Cisco Secure Endpoint can automatically detect and block known and emerging threats

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

15

Endpoint Security - Market Quadrant 2020

through real time technologies that include: behavior analysis, big data analytics, machinelearning, signatures and fuzzy fingerprinting. Malicious verdicts from the detonation of
unknown files in the sandbox are automatically added to the file reputation in the AMP’scollective threat intelligence cloud and can close attack pathways across the AMP Ecosystemof security control points. File analysis reports provide detailed behavioral indicators ofcompromise with mappings to applicable to the MITRE ATT&CK framework. Cisco Talos
further augments this threat intelligence dynamically through the cloud or content updates tothe various engines.
o Malware Detection – Secure Endpoint provides continuous monitoring and detection of files
already on endpoints to help identify malicious behavior and decrease time to detection.
Cloud-based machine learning and cross layer static analysis are also used to scale malware
detection. For instance, if malicious file behavior is detected, the file is automatically blocked
across all endpoints and the AMP Ecosystem of security control points, and security teams
are provided with a recorded history of the malware’s behavior and trajectory. SecureX threat
hunting provides enhanced detection and response by having Cisco threat hunting experts
perform systematic threat hunts across customer assets based on emerging threat intelligence,
anomalies, adversary tactics, techniques and procedures. SecureX, built-in to Secure
Endpoint, accelerates incident investigations through automatic context enrichment andallows customers to leverage Cisco incident management playbooks, or create their own
automated playbooks.
o Malware Response – Secure Endpoint provides a suite of response capabilities to contain andeliminate threats across all endpoints. Administrators can search across endpoints using asimple, web-browser based management console using OpenIOC queries for known
indicators of compromise and/or more advanced live searches of endpoint telemetry built on
top of osquery. A Cisco-curated catalog of queries mapped to the MITRE ATT&CK TTP
detection is provided, including the ability to query for an endpoint forensic snapshot. If a
threat is detected, Secure Endpoint automatically contains and remediates across all
endpoints including PCs, Macs, Linux, and mobile devices (Android and iOS). In addition,
SecureX extends response capabilities by automating response actions across the security
infrastructure.
o Email and Web security – all file disposition and dynamic analysis information is sharedacross the AMP Ecosystem via collective intelligence. If a file is determined to be malicious
via Cisco Secure Email or Cisco Web Appliance that information is shared across all AMP

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

16

Endpoint Security - Market Quadrant 2020

platforms. Native integration between Secure Endpoint and the AMP Ecosystem provides
global outbreak control, threat context enrichment and global trajectory view of malware
ingress across key attack vectors. Secure Endpoint also inspects web proxy logs, and allows
administrators to uncover file-less or memory-only malware, see infections that live only in a
web browser, stop malware before it compromises the OS-level, and get visibility into
devices that don’t have the Secure Endpoint connector installed.
o Firewall – Secure Endpoint integrates with AMP for Networks. All detection information issent to the Cisco Firewall management platform and can be used to correlate against othernetwork threat activity. Cisco Firewall and Cisco Identity Services Engine (ISE) can betightly integrated, which allows Secure Endpoint events to trigger policy responses andenforcement in ISE.
o Patch Assessment – Secure Endpoint uses a feature called Vulnerable Software that identifies
if the installed software is up to date according to the vendor, or if the installed version has
an exploitable vulnerability. Additionally, the advanced live search in Secure Endpoint built
on top of osquery provides cataloged queries to identify Windows hotfixes and/or patchlevels of the endpoint.
o Reporting – Secure Endpoint offers static, dynamic, and historical reports. Threat Hunting
Incident reports highlight critical findings with actionable remediation steps. These include
reporting on high-risk computers, overall security health, including vulnerable software andvirus definition update status, threat root cause activity tracking, identification of various
APTs, Advanced Malware assessments, and mobile-specific root cause analysis.
o Management – Secure Endpoint comes with its own management console and can also
integrate with the Cisco Firewall console (for Cisco NGIPS or Cisco Firewall deployments)
to deliver tighter management across all deployed Cisco security solutions.
o Integrations – Secure Endpoint has an API that allows customers to sync Secure Endpointwith other security tools or SIEMs. Secure Endpoint includes the Secure platform which
integrates Cisco security products, as well as third party solutions.
Cisco AnyConnect Secure Mobility Client offers VPN access through Secure Sockets Layer(SSL), endpoint posture enforcement and integration with Cisco Secure Web Appliance. It
assists with the deployment of Secure Endpoint, and expands endpoint threat protection to VPN-

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

17

Endpoint Security - Market Quadrant 2020enabled endpoints, as well as other Cisco AnyConnect services.
STRENGTHS•

Cisco offers a broad security portfolio, which encompasses threat intelligence, heuristics,
behavioral analysis and sandboxing to prevent threats from entering the endpoint. Cisco has
also integrated unified access security and multi-factor authentication capabilities from its
Duo Security acquisition.

•

Cisco Secure Endpoint delivers Endpoint Protection and Endpoint Detection and Response
capabilities in a single agent.

•

Built-in to Cisco Secure Endpoint, the Cisco SecureX platform delivers threat response with
automatic threat context enrichment and unified threat response capabilities across the entire
security ecosystem, including Endpoints, Network, Email, DNS, and more.

•

Cisco Secure Endpoint offers rich native integrations to Cisco Secure Firewall, Cisco Secure
Email, Umbrella DNS Security other Cisco security solutions to provide a thorough networkedge to endpoint visibility.

•

Cisco offers APIs for their endpoint solutions (as well as Secure Malware Analytics andUmbrella solutions) to integrate with a customer’s existing security architecture, as well asother security tools or SIEMs.

•

Customers report that Secure Endpoint is easy to use, and highly efficient in dealing withprevention and remediation.

WEAKNESSES•

Cisco Secure Endpoint can automatically disable Microsoft Defender, however it does notprovide features to help uninstall other previously installed third party security software.

•

Cisco Secure Endpoint currently offers third party software patch assessment, but does notoffer third party patch software remediation.

•

Cisco Secure Endpoint does not provide its own content-aware DLP functionality, however it

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

18

Endpoint Security - Market Quadrant 2020

integrates with Digital Guardian through Secure Malware Defense.
•

Secure Endpoint does not offer native full-disk encryption (FDE), customers who need thiswill need to leverage the underlying operating system encryption capabilities.

•

While Cisco Secure Endpoint can be deployed independently of other Cisco security
solutions, it’s full strength and rich functionality is best leveraged when deployed inconjunction with other Cisco security solutions.

BITDEFENDER
15A Orhideelor St.
Orhideea Towers, district 6
Bucharest, 060071
Romaniawww.bitdefender.com
Bitdefender, founded in 2001, delivers next-generation anti-virus software, internet security
software, endpoint security, and other security solutions through a network of value-added
alliances, distributors and reseller partners. The company delivers solutions for businesses andconsumers across more than 150 countries. The company is privately held.
SOLUTIONS
Bitdefender’s GravityZone, is a hosted enterprise security platform that provides security
controls and security posture management across endpoints, cloud workloads, network and users.
For customers with restricted cloud usage, GravityZone can also be deployed on-premises.
Bitdefender security agents can be installed on all leading platforms including Windows, Linux,
Mac, Android, iOS and Microsoft Exchange.
The Bitdefender Business Portfolio includes a number of GravityZone security packages, as
follows:•

GravityZone Business Security – is aimed at small businesses. It provides protection for
physical and virtual desktops and servers, combining security with centralized management.
It is available on-premises, or as a cloud service.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

19

Endpoint Security - Market Quadrant 2020•

GravityZone Advanced Business Security – is aimed at the needs of medium sizedbusinesses. It offers the same services as Business Security but adds security services forprotecting Microsoft Exchange servers and mobile devices. It includes a feature called Smart
Central Scan, which allows Security administrators to offload anti-malware processes to acentralized scanning server, thus lowering the resource consumption on protected systems.
The solution is available on-premises or as a cloud service, and can protect desktops, servers
and Microsoft Exchange mailboxes. The mobile security (MDM) component, however, isonly available for on-premises deployment.

•

GravityZone Elite – offers the same services as Advanced Business Security but adds two
pre-execution detection layers; HyperDetect, and Sandbox Analyzer. Hyperdetect uses
specialized local machine models and behavior analysis techniques to detect hacking tools,
exploits and malware obfuscation techniques. Sandbox analyzer detonates payloads in acontained virtual environment, analyzes their behavior, reports malicious intent and provides
actionable insight. The solution is available on-premises or as a cloud service, and canprotect desktops, servers and Microsoft Exchange mailboxes. The mobile security (MDM)
component, however, is only available for on-premises deployment.

•

GravityZone Ultra – offers an integrated endpoint protection and EDR solution, which
offers prevention, automated detection, investigation and response tools in a single agent,
which can be managed through a single console. It provides real-time visibility into
endpoints, insight into suspicious activity, alert triage and incident analysis visualization,
one-click investigation, IOC lookup, helps track live attacks and lateral movements andenables rapid response for containment and remediation. It is available only as a cloud
solution and can protect desktops, servers and Microsoft Exchange mailboxes.

•

GravityZone Ultra Plus – is an integrated solution which combines advanced prevention
capabilities, low overhead EDR (Endpoint Detection and Response) and network traffic
analytics. It extends the endpoint-based threat detection capabilities of traditional EDR byincorporating network incidents (XDR) to counter threats across the infrastructure including:Endpoints, Network, or the Cloud.

•GravityZone Enterprise Security – is aimed at the needs of large enterprises and hybrid
infrastructures. It is available only as an on-premise solution and provides security services
for protecting physical and virtual desktops and servers, Microsoft Exchange servers andmobile devices.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

20

Endpoint Security - Market Quadrant 2020

Bitdefender also offers Email Security, Security for Storage, Patch Management and Full Disk
Encryption add-ons, all of which can be managed via the GravityZone console.
GravityZone Security for Virtualized Environments (SVE) is the security module delivered
within GravityZone Enterprise Security. It uses a vendor-agnostic architecture to support any
hypervisor, whether natively integrated or standalone. SVE leverages multiple techniques toachieve deduplication and provide high operational value. This offloading is also present in the
AWS module, and can also be used in physical environments (e.g. laptops or desktops) since theenforcement point, Bitdefender Enterprise Security Tools (BEST) is common to SVE andEndpoint Security; BEST can operate in full offload, partial offload or traditional local scanning.
GravityZone Hypervisor Introspection (HVI) is aimed at protecting virtual workloads,
enabling data centers and organizations to increase their security posture across their entire
infrastructure.
GravityZone Security for MSPs is a solution portfolio tailored to meet the needs of Managed
Security Service Providers. It offers a multi-tenant management console and simple monthly
licensing. It is available in different packages which include endpoint protection, patch
management, Advanced Threat Security (with HyperDetect and Sandbox Analyzer), andEndpoint Detection and Response.
Bitdefender Managed Detection and Response (MDR) provides customers with outsourced
cybersecurity operations 24x7. It combines Bitdefender security technologies for endpoints,
network, and security analytics, with the threat-hunting expertise of a fully staffed SOC.
STRENGTHS•

Bitdefender relies on various non-signature based techniques including heuristics, machinelearning models, anti-exploit, cloud-based sandbox analyzer and process inspector to keep up
with the latest threats.

•

Bitdefender’s GravityZone Ultra Suite is an integrated platform, easily deployed byorganizations of all sizes, which offers risk analytics, hardening, prevention, and EDR for
endpoints, cloud resources, and network connected devices.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

21

Endpoint Security - Market Quadrant 2020•

Bitdefender tends to receive very high scores in third-party AV testing.

•

All Bitdefender anti-malware technologies are developed in-house. Bitdefender licenses its
technology to a number of OEM partners.

•

Bitdefender GravityZone integrates with Microsoft Active Directory, as well as VMware
vCenter and Citrix XenServer to facilitate syncing of inventories and policy enforcement andmanagement. In addition, Bitdefender can automatically detect other computers within the
network using Windows Network Discovery, and protection can be deployed remotely to all
unprotected systems.

WEAKNESSES•

Bitdefender offers a Mobile Security (MDM) solution for Android and iOS platforms.
However, it is currently available only for its GravityZone on-premises solutions.

•

While offering highly accurate malware and threat detection solutions, Bitdefender currently
lacks integration with SOAR tools. The vendor has this on its roadmap.

•

Bitdefender was somewhat late to add Managed Detection and Response (MDR) capabilities,
compared to other competing vendors.

•

Bitdefender is still best known for its consumer products and lacks greater visibility in theenterprise market. The company is working to address this.

ESET, SPOL. S.R.O.
Einsteinova 24
851 01 Bratislava
Slovak Republicwww.eset.com
ESET, founded in 1992, offers cybersecurity products and services for enterprises, small andmedium businesses and consumers. Headquartered in the Slovak Republic, ESET has research,sales and distribution centers worldwide and a presence in over 200 countries. The company isprivately held.
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

22

Endpoint Security - Market Quadrant 2020

SOLUTIONSESET’s Endpoint protection solutions include the following components:•

ESET Endpoint Security for Windows – is ESET’s flagship endpoint security product for
Windows. It offers a low footprint, support for virtual environments, and combines
reputation-based malware protection with advanced detection techniques enhanced by
ESET’s machine learning engine, Augur.

•

ESET Endpoint Security for macOS – is ESET’s security product for macOS platforms.
Similarly, to its Windows counterpart, it offers a low footprint, support for virtualenvironments, cross-platform protection, and combines reputation-based malware protection
with advanced detection techniques enhanced by ESET’s machine learning engine Augur.

•

ESET Endpoint Security for Android – offers reputation-based malware protection, antiphishing, app control, anti-theft, SMS/call filtering and device security. It integrates with
ESET's Security Management Center, allowing for security polices to be deployed acrossboth PCs and mobiles.

•

ESET Mobile Device Management for iOS – is an integration of the Apple iOS MDM
framework with ESET Security Management Center which supports the configuration of
security settings for iOS devices. Administrators can enroll iPhones and iPads, as well as
setup security profiles and adjust device settings, such as: anti-theft, settings for Microsoft
Exchange, WiFi, VPN accounts, Passcode, iCloud and more.

•

ESET File Security for Microsoft Windows Server – is a lightweight server security
product, which integrates with the ESET LiveGrid® reputation technology for advanced
detection techniques. It features support for virtualization (e.g. optional snapshot
independence, process exclusions, clustering support), Hyper-V and Network Attached
Storage scanning, and a Windows Management Instrumentation (WMI) connector. It is alsoavailable as a VM Extension in Microsoft Azure.

•

ESET Security for Microsoft SharePoint Server – provides advanced protection for
SharePoint servers to protect against malicious uploads and unwanted files.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

23

Endpoint Security - Market Quadrant 2020•

ESET Mail Security for Microsoft Exchange Server – combines server malware
protection, spam filtering and email scanning. It includes the malware protection technology
included in ESET Endpoint solutions (i.e. ESET LiveGrid® reputation technology, ESET
machine learning engine Augur, Anti-Phishing, Exploit Blocker, and Advanced Memory
Scanner), new proprietary antispam engine, and selective database on-demand scanning.

•

ESET Virtualization Security for VMware – is an agentless scanning solution for VMware
environments. It can be managed using the ESET Security Management Center.

•

ESET Full-Disk Encryption – is an add-on to ESET Endpoint solutions enabling full disk
encryption across the entire network from a cloud-based or on-premise console with a single
click. It encrypts system disks, partitions and entire drives.

•

ESET Endpoint Encryption – is a standalone solution which provides data encryption,
including full-disk encryption (FDE), as well as files, folders, removable media, and email
encryption.

•

ESET Security Management Center – is a web-based single pane of glass multi-tenant
management console for all ESET business security products. It can be installed on
Windows, Linux or as a Virtual Appliance in Microsoft Azure. It supports Mobile Device
Management (MDM) for Android and iOS devices.

In addition, ESET provides the following services and solutions:•

ESET Enterprise Inspector – is ESET’s EDR solution. It enables continuous monitoring ofreal-time endpoint activity, in-depth analysis of suspicious processes and immediate
response. It references its detections to the MITRE ATT&CK framework.

•

ESET Dynamic Threat Defense (EDTD) – is ESET’s managed cloud sandboxing solution.
It is managed by the ESET Security Management Center and integrates directly with ESETEnterprise Inspector, ESET Mail Security solutions and ESET Endpoint solutions.

•

ESET’s Threat Intelligence Service – is ESET’s threat reputation network, which provides
IOCs (IP, URL, file hash) and serves as an automated malware analysis portal. It can
integrate with existing SIEM tools and features YARA rules to allow organizations to set up
custom rules.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

24

Endpoint Security - Market Quadrant 2020•

ESET Threat Hunting – is a security service delivered by ESET cybersecurity experts who
perform an on-demand investigation of data, events and alarms generated by the ESETEnterprise Inspector.

•

ESET Threat Monitoring – is a security service delivered by ESET cybersecurity experts
who continuously monitor customer network and endpoint security data. It also provides
actionable advice on risk mitigation.

•

ESET Cloud Administrator – is a cloud-based console, offered as a service, for the remotemanagement of customer networks of up to 250 seats.

•

ESET Secure Authentication – is a mobile-based multi-factor authentication (MFA)
solution that protects organizations from weak passwords and unauthorized access.

•

ESET Cloud Office Security- provides advanced preventive protection for users ofMicrosoft 365 applications. It combines spam filtering, anti-malware scanning and antiphishing to help prevent incoming external email from being used as a channel for targeted
attacks. Anti-malware protection also protects OneDrive, and helps mitigate the risk of
malware spreading to other devices.

STRENGTHS•

ESET Endpoint Security solutions are well-known to offer high performance and highdetection rates.

•

ESET solutions offer a low footprint with low system resource usage. The solutions aredesigned for ease of deployment and use.

•

ESET’s management console provides real-time visibility for on-premise and off-premise
endpoints as well as full reporting for ESET enterprise-grade solutions from a single pane ofglass securely deployed on-premise or in the cloud. It covers desktops, servers, agentless
virtual machines and managed mobile devices.

•

ESET has a global network of installed business solutions that feed information back into the
ESET LiveGrid®, its cloud-based reputation system.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

25

Endpoint Security - Market Quadrant 2020•

ESET Endpoint Security is well suited to offer protection for companies with heterogeneousenvironments, e.g. Windows, macOS, Linux, and more.

WEAKNESSES•ESET products are deployed on-premises. However, cloud-based administration is available
through two solutions: ESET Security Management Center, available as a virtual machine in
Windows Azure or as virtual appliances; and ESET Cloud Administrator, for organizations
with up to 250 seats. A cloud-based management console for larger enterprise customers ison the vendor’s near term roadmap.

•

ESET does not provide its own DLP solution. However, it offers DLP through the ESETTechnology Alliance, its partner program.

•

ESET is widely recognized in Europe but currently lacks market visibility in North America.
The vendor is working to address this.

KASPERSKY
39A Leningradsky Highway
Moscow 125212
Russiawww.kaspersky.com
Kaspersky, founded in 1997, provides a wide range of security products and solutions forenterprise business customers and consumers worldwide. The company’s business solutions are
aimed at a broad range of customers including large enterprises, small and medium-sizedbusinesses. Kaspersky is privately owned.
SOLUTIONS
Kaspersky Integrated Endpoint Security brings together endpoint protection, sandboxing, andEndpoint Detection and Response (EDR) into a single multi-layered security approach. It
comprises the following main components:

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

26

Endpoint Security - Market Quadrant 2020•

Kaspersky Endpoint Security for Business (KESB) – is a multi-layered endpoint
protection platform, which provides security, visibility and manageability of all endpoint
devices, including physical and virtual machines, mobile devices, and servers. Kaspersky
supports a broad array of platforms, including Windows, Linux, macOS, Android, and iOS. It
integrates with Remote Monitoring and Management (RMM) and Professional Services
Automation (PSA) systems from ConnectWise, Autotask, Tigerpaw and SolarWinds.
Kaspersky Endpoint Security for Business is available in three different tiers, as follows:o Select – provides trusted Threat Prevention (for Windows, macOS and Linux) with
Behavior Detection, Exploit Prevention, Host Intrusion Prevention, Remediation Engine,
Web, Device and BadUSB controls, Mobile Threat Defense, Mobile Device Management(MDM), and Security Management.
o Advanced – in addition to Select capabilities, adds Application Control for servers,
Adaptive Anomaly Control to capture deviations from user’s behavior baseline and stop
execution, Data Protection (i.e. OS encryption management, full disk and file-levelencryption), Firewall and OS firewall management, Patch Management, Protection for
terminal servers, OS and third party application deployment.
o Total – in addition to all Select and Advanced capabilities, protects the enterprise
perimeter by preventing the effects of web-based attacks before they reach the endpointlevel, by blocking malware, online phishing, reducing access to unsolicited resources andpreventing illegitimate data transfers at gateway level.

•

Kaspersky Endpoint Detection and Response Optimum (KEDRO) – is an EDR tool
which works together with endpoint protection and provides endpoint visibility, root cause
analysis and various response options. It adds an automated layer of defense, providing
attack spread path visualization, and delivers full information on the incident, the host,suspicious objects, and more.

•

Kaspersky Sandbox (KSB) – complements endpoint protection with functionality that caneasily detect new, unknown and complex threats. It creates a virtualized environment, wheresuspicious objects are sent, analyzed with a variety of methods (e.g. simulating user activity,
behavior analysis, monitoring outgoing connections, and more), and their reputation
recorded. If objects are identified as malicious, the whole infrastructure can be scanned andmalicious activity prevented, ensuring an automated response across all endpoints.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

27

Endpoint Security - Market Quadrant 2020•

Kaspersky Hybrid Cloud Security – protects public datacenters (i.e. Microsoft Azure andAmazon AWS), physical servers, desktops and private data centers based on native API
integrations with VMware, Citrix, Microsoft Hyper-V, KVM and Docker virtualenvironments. Kaspersky Hybrid Cloud Security is optimized for integration with public andprivate discovery and deployment tools, and relies on virtualization to optimize resource use
and reduce infrastructure costs.

All endpoint security products are managed by the Kaspersky Security Center console, which
delivers security management and control through a single administrative tool. The management
console allows organizations to identify all endpoint assets (physical, virtual, mobile), conduct
fast vulnerability assessments, achieve a real-time hardware and software inventory, and offer
actionable reporting. The console can be used as a SaaS offering, or be deployed on public cloud
or on-premises environments and accessed through a web-interface.
In addition, Kaspersky EDR provides IT security/SOC enterprise teams with a tool for in-depth
incident investigation and centralized response. It offers advanced threat discovery, deep
investigation and threat hunting, as well as incident response.
Kaspersky offers a full-scale Enterprise Security solution comprising the following products andservices: Endpoint Security, Endpoint Detection and Response, Hybrid Cloud Security, Managed
Detection and Response, Embedded Systems Security for ATM and PoS protection, Private
Security Network, Security Awareness training, Premium Support and Professional Services.
For SMB customers, Kaspersky offers Kaspersky Endpoint Security Cloud, which provides a
cloud-based management solution for securing Windows and macOS endpoints, file servers, iOS
and Android devices.
STRENGTHS•

All Kaspersky solutions leverage the Kaspersky Security Network, a real-time intelligence
network that collects tens of millions of threat samples daily on a worldwide basis to ensure
accurate, up-to-date protection.

•

Kaspersky Endpoint Security for Business supports a broad range of operating systems,
including Windows, Linux, macOS, Android and iOS; as well as virtualized environments
including VMware, Citrix, KVM, MS Hyper-V and Docker.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

28

Endpoint Security - Market Quadrant 2020•

Kaspersky solutions rely on its own low footprint, high-performance security technologies.
Behavior Detection technology implements a Memory Protection mechanism, which guards
system-critical processes and prevents leaking user and administrator credentials.

•

The on premises or cloud-hosted Kaspersky Security Center management consoles provide acomprehensive management tool that allows organizations to identify all endpoint assets (e.g.
physical, virtual, and mobile), as well as conduct fast vulnerability assessments. It can also
automatically perform patch remediation and offer actionable administrator reporting.

•Through the use of Dynamic Whitelisting, Application Control reduces exposure to zero-day
attacks by providing control over what software is allowed to run on desktops and servers.

•

Kaspersky offers strong support for virtual environments. Kaspersky Hybrid Cloud Security
offloads resource intensive anti-malware scans onto a specialized virtual appliance, anapproach which places less load on computing resources and helps businesses maintain highvirtualization densities and performance.

•

Kaspersky Endpoint Security for Business includes MDM, mobile security and mobile
application management capabilities, all of which can be managed through a single console.

WEAKNESSES•

While Kaspersky Endpoint Security for Business is available for macOS, Linux, andWindows platforms, full feature parity was not always available across all platforms.
Kaspersky is addressing this in its development roadmap.

•

Kaspersky Endpoint Security for Business does not provide content-aware DLP, or support
ICAP for integration with third-party DLP solutions.

•Kaspersky Endpoint Security for Business does not support network access control, which
prevents administrators from blocking network access to certain endpoints (e.g. newendpoints that have not yet deployed the organization’s security policies).

•

Kaspersky MDR does not currently provide support for macOS endpoints. The vendor has
this on its future roadmap.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

29

Endpoint Security - Market Quadrant 2020•

While the Kaspersky Security Center console currently allows monitoring of Kaspersky’s
Secure Email Gateway (thus helping integrate visibility across endpoints and email security),
management of email security currently requires a separate console. Integration of email
security management capabilities is on the roadmap for future releases.

SENTINELONE
605 Fairchild Dr.
Mountain View, CA 94043
www.sentinelone.com
SentinelOne, founded in 2013, is a cybersecurity software company that delivers protection andforensics for personal computers, IoT devices, and cloud workloads, to guard against complex
threats across all vectors. SentinelOne is privately held.
SOLUTIONS
SentinelOne offers Singularity, a security platform that delivers endpoint protection, endpoint
detection and response, IoT security, cloud security, and IT operations capabilities by
consolidating multiple existing technologies into one solution. It offers autonomous ‘Sentinel’
agents for Windows, Mac, Linux, and Kubernetes and supports a variety of form factors
including physical, virtual, VDI, customer data centers, hybrid data centers, and cloud service
providers. Sentinels are managed via a globally available multi-tenant SaaS designed for ease-ofuse and flexible management. SentinelOne is available in the following tiered product offerings:•

Singularity Core – is an entry level endpoint security product. It offers basic EDR functions
coupled with traditional endpoint protection capabilities. Key capabilities include: a visual
representation of attack behavior, static artificial intelligence and file-based attack
prevention, threat intelligence, behavioral artificial intelligence file-less attack detection,
autonomous threat response, autonomous remediation response, autonomous rollback
response, the ability to quarantine devices from the network, incident analysis, agent antitamper protection, and application inventory.

•

Singularity Control – adds to the capabilities of Core a “security suite” of features forendpoint management. These include: OS Firewall control with location awareness, USB

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

30

Endpoint Security - Market Quadrant 2020device control, Bluetooth controls, rogue visibility to uncover devices on the network thatneed Sentinel agent protection, and secure remote shell capabilities.
•

Singularity Complete – is intended for enterprises that need modern endpoint protection andcontrol plus advanced EDR features. It also offers patented technology that automaticallycontextualizes all OS process relationships, even across reboots, and stores them for future
investigations. It is designed to lighten the load on security administrators, SOC analysts,
threat hunters, and incident responders by automatically correlating telemetry and mapping it
into the MITRE ATT&CK® framework.

In addition, SentinelOne also offers the following functionality:•

SentinelOne Ranger - delivers enterprise level visibility and control over enterprisenetworks. It provides instant asset inventory and information about rogue devices to help
investigate how managed and unmanaged devices interact with critical assets.

•

SentinelOne Cloud Workload Security - extends security and visibility to assets running inpublic clouds, private clouds, and on-premises data centers, so that security teams canmanage both Linux and Windows servers, and Docker or Kubernetes containers from one
platform.

•

SentinelOne Vigilance Managed Detection & Response (MDR) – is a subscription service
designed to supplement its endpoint security SaaS offerings. The Vigilance MDR Team is
the human side to the AI-based Singularity platform. It offers the expertise of an in-house,
non-outsourced Team of cybersecurity experts monitoring millions of endpoints.

•

Vigilance MDR PRO – is an addition to Managed Detection and Response, that adds
Incident Response (IR) services.

•

SentinelOne Readiness Services – is an offering designed around agent deployment andperiodic health checks. It is designed to help customers accelerate SentinelOne agent rollout
planning, installation execution, policy fine tuning, and to help handle in the short term any
discovered infections.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

31

Endpoint Security - Market Quadrant 2020

STRENGTHS● Unlike other next-generation endpoint protection platforms, SentinelOne can be deployedboth in the cloud and on-premises.
● SentinelOne offers a fully converged Endpoint Protection Platform (EPP) and Endpoint
Detection & Response (EDR) platform in a single lightweight agent. It can run on its own orcomplement existing AV solutions from other vendors.
● SentinelOne’s autonomous endpoint agent provides prevention, detection, and response
without any reliance on cloud systems or look up. This allows for faster detection andresponse to advanced attacks at machine speed.
● SentinelOne’s autonomous agent also provides patented remediation technology. This allows
the agent to automatically return a system to its pre-threat state without any end user impact
or system downtime.
● SentinelOne provides advanced threat hunting, where the indexing of the data done by theautonomous agent allows security analysts to receive full context of any behavior, or
indicators of compromise (IOC) off a single pivot. This includes encrypted TLS sessions.
WEAKNESSES●

While SentinelOne has solid integrations and performance, it needs to improve in-productworkflows, as well as the quality of integration with partner technology solutions. The
vendor is working to address this in future releases.

●

While SentinelOne provides patch assessment, it does not currently provide patch
remediation (i.e. deployment of missing of missing updates discovered during the patch
assessment phase).

●

SentinelOne does not offer application whitelisting.

●SentinelOne does not currently offer full-disk encryption (FDE) functionality. However, thevendor has this on its roadmap.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

32

Endpoint Security - Market Quadrant 2020●

SentinelOne does not offer URL filtering or browser isolation.

●

SentinelOne offers only basic mobile capabilities through a partnership with Lookout
Security, however this is provided as an extra cost option. The vendor is working to address
through further integrations on its near term roadmap.

●

SentinelOne does not currently offer content-aware Data Loss Prevention capabilities.

TRAIL BLAZERSWEBROOT, AN OPENTEXT COMPANY
385 Interlocken Crescent, Suite 800
Broomfield, CO 80021
www.webroot.com
Webroot, an OpenText company, secures businesses and consumers worldwide with threat
intelligence and protection for endpoints and networks. In 2019, Webroot and its parent company
Carbonite, were acquired by OpenText. OpenText is publicly traded.
SOLUTIONS
Webroot offers an integrated platform of three internet security solutions developed for Managed
Service Providers (MSPs) and SMBs, these include: Webroot Business Endpoint Protection,
Webroot DNS Protection, and Webroot Security Awareness Training. The solutions are
powered by the Webroot Threat Intelligence Platform, a security threat intelligence platformthat is continuously collecting, analyzing and correlating security data such as file behaviors andreputations, URL and IP reputation, phishing websites in real-time, mobile application
reputations and more.
Webroot Business Endpoint Protection is a real-time, cloud-based approach to preventing
system compromises through advanced machine learning and threat intelligence. It is compatible
with Microsoft Windows PCs and Servers, as well as Apple Mac devices; Terminal Servers andCitrix; VMware; Virtual Desktops and Servers, and Windows embedded Point of Sale (POS)

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

33

Endpoint Security - Market Quadrant 2020

systems. It offers the following capabilities:
o Real-Time Anti-Virus/Anti-Malware – the Webroot client agent continuously monitorsand shares encrypted meta-data with the Webroot Threat Intelligence Platform to predict,detect, prevent, contain and protect against malicious system compromises. Webroot uses
a lightweight endpoint client agent that moves data intensive malware discovery
processing to the cloud.
o Zero Definition Updates – through the Webroot Threat Intelligence Platform which
processes compromise prediction and detection, Webroot requires no system signatures
or definition updates as the collective file and process security intelligence is held within
the Webroot platform and instantly available to all protected customers’ systems.
o Webroot Evasion Shield – is a propriety, patented anti-malware technology that delivers
new script and code detection capabilities, to stop APT and script-based attacks. It
consists of: Webroot Script Shield, a malicious script detection engine; and WebrootForeign Code Shield a behavioral analysis engine that is applied to untrusted processes todetermine if they are malicious.
o Web Reputation Protection & Filtering – is provided through several different shieldcomponents within the Webroot endpoint security solution. The endpoint Web Threat
Shield uses Webroot’s BrightCloud Threat Intelligence Services (part of the WebrootThreat Intelligence Platform) to score and block sites with poor reputations and known
infected (or malicious) domains.
o Identity & Privacy Shield – secures and isolates the browser (and any other applicationneeded) from the rest of the endpoint.
o Web search results annotations and safety ratings – are provided to clearly highlight tousers the risks associated with clicking on a particular search link.
o Real-time anti-phishing protection – uses machine learning on a ‘time of need’ basis andis activated when a user clicks on a link with a poor reputation score. It determines inreal-time if it is a phishing site, and blocks the connection request as needed.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

34

Endpoint Security - Market Quadrant 2020o Outbound Firewall – ensures all outbound TCP/UDP requests and destinations arechecked against the Webroot Threat Intelligence Platform.
o Last ‘known good’ Auto-restore and Remediation – through monitoring and journaling all
unknown files and processes, any changes made to the endpoint can be reversed andrestored to a last ‘known good’ state.
o Offline Protection – the endpoint agent enacts a separate policy to stop attacks when it is
not connected or available to the Webroot Threat Intelligence Platform. It monitors andjournals all activities, and upon reconnecting to the Webroot Threat Intelligence
Platform, if any new data is analyzed and found to be malicious, the endpoint system is
auto remediated to its last ‘known good’ state.
o Cloud-based centralized remote management – Webroot offers an entirely cloud-based
Management Console.
o Global Management Console – An MSP-focused management console designed to meetthe needs of multi-location and multi-site management. It securely integrates with theWebroot Unity API that allows MSPs to access on-demand real-time threat and otherendpoint telemetry data for use within their own management, reporting, billing, andworkflow applications.
o Automated workflow via RMM and PSA Integrations – an ecosystem of MSP related
workflow and management integrations to facilitate ‘single pane of glass’ management
and automation of remote management tasks. These integrations include MDR tools such
as Perch, Blackpoint and Artic Fox, plus BI tools such as BrightGauge.
o Windows 10 ELAM Support – Webroot supports Windows 10, and also covers
Microsoft’s Edge browser with web filtering and anti-Trojan protection (ID Shield).
Webroot also added Early Launch Anti-Malware protection (ELAM).
o Global Management Dashboards – Offer full endpoint dashboard drill down capabilities,
allowing administrators to respond to events and investigate anomalies or alerts on thedashboard.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

35

Endpoint Security - Market Quadrant 2020o Advanced Reporting – A scheduled reporting engine provides administrators flexibility ingenerating reports based on their preferences. The Webroot Unity API can also be used toprovide highly customized reporting.
o Unity API – supports integration into other IT management platforms, including Remote
Monitoring and Management (RMM), Professional Services Automation (PSA),
customized billing platforms, and internal IS systems. It also can be deployed by MSPs
for custom automation of processes, reports and other services.
STRENGTHS•

Webroot Business Endpoint Protection has a small installation footprint, since it doesn’t
require a local threat database.

•

System performance requirements are light, allowing the standard agent to be used in botholder machines (where less processing power is available), as well as virtual environments,
where system resources are also defined.

•

Webroot can coexist in an environment with other endpoint security platforms, whereas mostother solutions have difficulty operating on a machine with other security software.

•Management is fully cloud-based and can work with any browser.

•

Webroot Business Endpoint Protection is easy to manage and offers built-in automatic
rollback and auto-remediation of infected endpoints.

•

Webroot offers Dwell Time reporting, which alerts and informs administrators of the precise
time an endpoint was infected and how long it has taken for Webroot to fully remediate theinfection. This can be coupled with forensics and data auditing.

WEAKNESSES•

Webroot Business Endpoint Protection does not include encryption capabilities.

•

Webroot Business Endpoint Protection does not provide DLP functionality, or ICAP support
for integration with third party DLP solutions.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

36

Endpoint Security - Market Quadrant 2020•

Granularity on the firewall is somewhat limited when compared to other vendors.

•

Webroot does not provide protection for mobile devices.

•

Webroot does not provide third party software patch assessment and management.

CYBEREASON
200 Clarendon Street
Boston, MA 021161
www.cybereason.com
Cybereason, founded in 2012, offers solutions that protect organizations from cyberattacks
through prevention, detection, threat hunting and response. Cybereason is privately held.
SOLUTIONSThe Cybereason Defense Platform combines endpoint detection and response (EDR),
intelligence-based behavioral next-generation antivirus (NGAV) prevention, and proactive threat
hunting to deliver context-rich analysis of every element of a malicious operation (i.e. Malop).
The Malop interface replaces single threaded alerts with comprehensive correlations and root
cause analysis across the network and all impacted devices, instantly delivering the insights
required to end attacks. The Cybereason Defense Platform supports multiple deployment
options, including cloud, on premises, hybrid, and air-gapped. The platform comprises thefollowing capabilities:● Cybereason Prevention – leverages signature based, behavioral, and machine-learning
approaches to stop threats from both known and unknown attacks; this includes fileless and.Net attacks, as well as zero day malware. Cybereason also provides Endpoint Controls
which allows organizations to manage specific controls tied to different types of devices,
implement personal firewall policies, and enforce disk encryption. Cybereason Prevention is
deployed quickly within a single, lightweight agent for all operating systems and endpointtypes. Once installed, security analysts can leverage a single console to easily investigate
through a full context, single visual time-line, which helps quickly identify and remediate
threats.
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

37

Endpoint Security - Market Quadrant 2020

● Cybereason EDR – correlates an entire attack across all endpoints in a customer’s
environment to give security teams a single view of an attack in real time, which allows themto quickly examine and respond to attacks at scale. Teams can understand the scope of an
attack in seconds, and can stop threats and remediate issues across all affected machines witha single click.
● Cybereason Investigation & Hunting – allows analysts to easily investigate and uncovermalicious files across operating systems (e.g. Windows, macOS, and Linux), with built ininteractive File Search and native Yara rule support. Security analysts can quickly identify
any malicious activity in their environment and easily hunt for TTPs with syntax-free andvisual based searches. Security analysts are also able to investigate through access to autogenerated end-to-end root cause analysis, real-time telemetry data, and forensics artifacts.
Cybereason also offers a suite of services to augment customers' security teams, through any
combination of detection, investigation, breach containment, and response needs. Services
offered include:● Cybereason MDR – offers 24/7 monitoring, incident triage, recommendations, ongoing,
proactive hunting to identify malicious activity.
● Incident Response – involves immediate and on demand incident response, including
scoping, investigation, consultation, and containment of incidents.
● Assessment Services – offers customized review of customer environments to help identify
and address misconfigurations, identify needed critical patches, and assist with security
policy enforcement.
STRENGTHS● The Cybereason Defense Platform, comprised of EPP and EDR functionality, is available via
multiple deployment options, or as a managed service via a single agent deployment.
● The platform collects endpoint telemetry and correlates both known malware and behavioral
detections of unknown malware across multiple devices to show the full attack timeline, via asingle screen and workflow.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

38

Endpoint Security - Market Quadrant 2020

● Cybereason's Cross-machine Correlation Engine allows customers to understand the fullscope of attacks fast within a single view, easily hunt for threats, and remediate attacks
efficiently across all impacted devices.
● Cybereason provides multi-layered prevention capabilities that include signatureless or fileless prevention, signature based anti-malware, exploit protection, behavioral document
protection, anti-ransomware, as well as endpoint controls such as personal firewall, disk
encryption, and USB blocking.
● Cybereason's interactive investigation console can be easily leveraged by analysts of all skill
levels to investigate every detail on an endpoint including behaviors, processes, and observed
activity across all devices in the enterprise.
● The Cybereason Defense Platform is attractively priced, while delivering an advanced,
comprehensive set of features and functionality.
WEAKNESSES● The Cybereason Defense Platform currently does not have native vulnerability assessment
capabilities. The vendor is working to address this through technology partners.
● The Cybereason Defense Platform does not currently support URL filtering, a capability
which is common with many competing solutions.
● Cybereason does not currently offer its own Sandboxing technology. However, the vendor
integrates with the VMRay solution.
● Cybereason does not provide DLP functionality, however, it can refer customers to partner
solutions.
● Cybereason Defense Platform offers protection for devices on multiple OS (e.g. Windows,
Mac, Linux, IOS, and Android). Additional capabilities, however, are needed to better
protect cloud based applications via containers. The vendor has this on its roadmap.
● Cybereason is currently best known in Europe and Asia/Pacific. The vendor is working toraise awareness of its solutions in North America.
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

39

Endpoint Security - Market Quadrant 2020

SOPHOS
The Pentagon Abingdon Science Park
Abingdon
OX14 3YP
United Kingdom
www.sophos.com
Sophos provides IT security and data protection products for businesses on a worldwide basis.
Sophos offers security solutions for email, network, next-gen endpoint and server protection with
EDR, mobile device protection, encryption, wireless, a range of public cloud security solutions
including cloud security posture management, and a human-led Managed Threat Response team.
In March 2020, Thoma Bravo completed the acquisition of Sophos.
SOLUTIONS
Sophos offers three endpoint security solutions, Intercept X Advanced, Intercept X Advancedwith EDR, and Managed Threat Response. The EDR version contains all the traditional andmodern protection of Intercept X Advanced, but also includes additional endpoint detection andresponse (EDR) functionality on the same agent. The Sophos Managed Threat Response (MTR)
Service adds a 24/7 managed detection and response service in addition to the features inIntercept X Advanced with EDR.
•

Sophos Intercept X Advanced – combines traditional protection and next-generation
endpoint protection in a single solution, with a single agent. It provides signature-less exploit
prevention, antivirus, deep learning malware detection, anti-ransomware, active adversary
protection, HIPS, whitelisting, web security, application control, DLP and more. Sophos’s
Synchronized Security automates incident response and application visibility, via on-goingdirect sharing of threat, security, and health information between endpoints and the network.
Additional features include root cause analysis, and advanced system cleaning technology.

•

Sophos Intercept X Advanced with EDR – also includes integrated endpoint detection andresponse capabilities using the same agent. EDR functionality is available for Windows,
macOS and Linux devices. Intercept X for Server includes all Intercept X functionality
with the addition of Application Lockdown, File Integrity Monitoring and visibility into
organizations’ wider cloud environments (e.g. serverless functions, S3 buckets anddatabases).

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

40

Endpoint Security - Market Quadrant 2020

Intercept X includes the following key capabilities:
o Deep learning malware detection – uses advanced machine learning to examine the“DNA” of files and a determine if they are malicious without ever having seen them
before.
o Anti-exploit and active adversary technology – looks at the tools and techniques used byattackers to distribute malware, steal credentials, and escape detection.
o CryptoGuard – behavior-based ransomware protection that detects malicious encryption,and rolls back any affected files.
o EDR – designed for IT administrators and cybersecurity specialists to handle critical IT
operations and threat hunting questions.
o Endpoint Antivirus – detects viruses, suspicious files and behavior, adware, and othermalware. Real-time antivirus lookups help ensure up-to-date information.
o Host Intrusion Prevention System (HIPS) – is integrated into the endpoint agent andconsole, to identify and block previously unknown malware before damage occurs.
o Web security – is integrated into the endpoint agent platform and provides live URL
filtering. Multiple browsers are supported, such as IE, Firefox, Safari, Chrome, andOpera.
o Web content filtering and policy enforcement – is included to block Web content basedon categories. For Sophos customers that also have the Sophos UTM or secure web
gateway appliance, these appliances leverage the endpoint to enforce web filtering
policies, even when the endpoints are off the corporate network.
o Firewall – capabilities protect endpoints from malicious inbound and outbound traffic.
Location-aware policies are available to add a layer of security when protected endpoints
are out of the office.
o Device control – can be used to block the use of storage devices, optical drives, wirelessdevices (e.g. Bluetooth), and mobile devices. Granular use policies can be created for
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

41

Endpoint Security - Market Quadrant 2020

different groups or individuals.
o DLP – is available for content in motion. Pre-built and custom filters can be enabled thatscan content for infringing data, such as credit card numbers. DLP features are also
extended to email appliances.
o Application control – is available for thousands of applications across dozens ofapplication categories. P2P, IM, and more can be blocked for all users or some users.
Web browsers can also be blocked to force users to use only a company-sanctioned
browser.
o Agentless scanning – managed through the same enterprise console used by Sophos
endpoint clients, ensures that every virtual machine on a VMware host is protected by acentralized scanner.
The following solutions are also available as separate add-ons:
o Sophos Mobile – handles all mobile devices, from the initial setup and enrollment,
through device decommissioning. It includes a fully featured web-based console allowing
administration from any location on any device.
o Intercept X for Mobile – protects mobile devices using up-to-the-minute intelligencefrom Sophos Labs, deep learning malware detection, and more. Apps can be scanned on
installation, on demand or on a schedule.
All Sophos solutions are managed via Sophos Central, a cloud-based platform for all Sophos
solutions. In addition, Sophos offers the following services:
Sophos Managed Threat Response (MTR) – a 24/7 threat hunting, detection, and responsedelivered by an expert team as a fully-managed service.
Sophos Rapid Response – an emergency incident response service for organizations
experiencing an active cyberattack. It is available to existing Sophos customers, as well as noncustomers (included in Sophos MTR service).

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

42

Endpoint Security - Market Quadrant 2020

STRENGTHS•

Sophos Intercept X Advanced employs a single endpoint agent for combined traditional andnext-generation protection, which delivers AV, deep learning, anti-exploit, anti-ransomware,
EDR, HIPS, Application Control, DLP, Device control, firewall, web protection and web
filtering.

•

Sophos offers strong EDR capabilities, in an easy to consume format that is easily accessible
for security teams across a wide expertise range.

•

Sophos’ CryptoGuard technology supports file roll-back capabilities in the event of aransomware incident.

•

Sophos Synchronized Security, delivers protection and context reporting for customers who
use Sophos Intercept X and the Sophos XG firewall.

•

Sophos solutions are easy to deploy and manage, and don’t require extensive training to takeadvantage of all features and functionality.

•

Sophos offers simple per-user license pricing, which covers all devices a user may wish toprotect.

WEAKNESSES•

Sophos offers limited support for patch assessment and remediation of third party software
running on the endpoint.

•

Sophos Intercept X endpoint solutions do not have direct access to Sophos’s Sandstorm
sandboxing functionality.

•

Sophos no longer supports network access control, which prevents administrators fromblocking network access to certain endpoints (e.g. new endpoints that have not yet deployed
the organization’s security policies).

•

Customers we spoke with as part of this research, indicated that reporting features, while
adequate, could be improved to offer greater customization.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

43

Endpoint Security - Market Quadrant 2020

SPECIALISTSMCAFEE
2821 Mission College BoulevardSanta Clara, CA 95054
www.mcafee.com
McAfee delivers security solutions and services for business organizations and consumers. The
company provides solutions, threat intelligence and services that protect endpoints, networks,
servers, the Cloud and more. The company is a joint venture of TPG Capital, Intel, and Thoma
Bravo.
SOLUTIONS
McAfee Endpoint Security uses machine learning analysis, analytics for file-less attacks,
dynamic application containment, and works with local and global threat intelligence to provide
comprehensive insights across all threat vectors: file, web, message, and network. McAfee’s
MVISION portfolio of cloud-native security tools offers cloud-based MVISION EDR which
provides automated, AI-guided investigations for security practitioners of any experience level.
It works with McAfee Endpoint Security, the company’s endpoint protection platform (EPP),
as well as with third-party EPPs. McAfee offers an open security platform that allows multiple
McAfee and third-party products to co-exist and share threat intelligence. All security solutions
are managed through ePolicy Orchestrator (ePO), which is available with a choice of onpremise, virtual, or SaaS-based delivery while providing a single management system that offers
centralized visibility across multiple security products and the entire threat defense lifecycle.
McAfee endpoint protection solutions protect Windows, macOS, and Linux systems, as well as
iOS and Android mobile devices.
McAfee endpoint security solutions are compatible with Windows workstations and servers,
macOS, VMware ESX, Linux, Citrix XenDesktop and XenServer, and other virtual platforms.
McAfee’s MVISION portfolio is sold as a subscription service, with a choice of MVISION
Standard, MVISION Plus, or MVISION Protect Plus EDR for Endpoint, which offer thefollowing components to meet different customer needs at different price points:

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

44

Endpoint Security - Market Quadrant 2020•

McAfee MVISION Endpoint – extends the base security built into Windows 10 withenhanced detection for fileless and zero-day threats. It utilizes a lightweight agent andcombined policy management, to deliver advanced behavioral analytics for collective
defense through a single console.

•

McAfee Endpoint Security – combines granular controls with layers of integrated
capabilities like endpoint detection and response (EDR), and machine learning analysis toprovide full-stack protection for Windows, macOS, and Linux systems. In-depth defenses
collaborate to inform, analyze and automate responses.

•

McAfee MVISION Mobile – offers on-device threat detection and protection for iOS andAndroid mobile devices. It protects against application and network threats, using machinelearning algorithms to help identify malicious behavior.

•

McAfee MVISION EDR– is McAfee’s endpoint detection and response (EDR) solution,
which offers AI-guided investigations and data visualization to enable security analysts toprioritize, investigate and remediate threats.

•

McAfee’s ePolicy Orchestrator (ePO) – offers centralized management to provide instantvisibility into the state of security defenses. Insight into security events allows administrators
to understand and target updates, changes, and installations to systems. McAfee ePO can be
deployed on-premises, or as a cloud service through two options: McAfee ePO on Amazon
Web Services (AWS), or a SaaS option called McAfee MVISION ePO.

•

McAfee MVISION Insights – automates detection, response and defense through a single
console to speed threat assessment and response. It offers real-time intelligence gatheredfrom one billion sensor to proactively identify potential threats, help organizations prioritize
their security posture, as well as provides actionable recommendations for changes to anorganization’s security posture.

•

McAfee XDR – is McAfee’s managed protection service which aggregates all data necessary
to analyze, evaluate and respond to threats across endpoint and network components anddeliver a fully-integrated workflow to track resolution.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

45

Endpoint Security - Market Quadrant 2020

McAfee’s MVISION portfolio also offers Device-to-Cloud suites a three-tier solution bundle
which includes MVISION Insights and the following components:•

MVISION Advanced – brings together endpoint threat prevention, next-generation
defense and rollback remediations.

•

MVISION Premium – adds Endpoint Detection and Response (EDR), and Endpoint DLP.

•MVISION Complete – unifies McAfee’s endpoint security portfolio with MVISION
Unified Cloud Edge, which combines secure web gateway, advanced DLP, and Cloud
Access Security Broker (CASB) capabilities.

STRENGTHS•

McAfee offers on-premise, cloud and SaaS management options while retaining a centralized
management experience.

•

McAfee’s MVISION portfolio delivers a broad range of defenses, including advanced
defense capabilities needed for zero-day threats, while also integrating and working withthird party solutions and native OS security controls.

•

McAfee provides advanced threat defenses, like pre-execution and post-execution machinelearning analysis and advanced analytics for file-less based attacks.

•

McAfee’s Endpoint Security provides a framework which enables IT to easily view, respondto, and manage the threat defense lifecycle.

•

McAfee’s ePolicy Orchestrator is a powerful, single management console that allows
administrators to create and manage policies across most McAfee security solutions.

WEAKNESSES•

While McAfee offers strong content-aware DLP capabilities, these are available as aseparately priced add-on or can be purchased through the more expensive MVISION
Complete solution bundle.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

46

Endpoint Security - Market Quadrant 2020•

McAfee solutions do not provide third party software patch assessment and remediation.

•

Customers we spoke with as part of this research indicated that McAfee’s EDR/XDR
capabilities are still rather basic, and don’t offer the depth and detail provided by competing
solutions.

•

McAfee does not offer its own email gateway solution, which may disappoint customers thatwant to source endpoint, email and web security from a single vendor.

CROWDSTRIKE
150 Mathilda Place
Sunnyvale, CA 94068
www.crowdstrike.com
CrowdStrike, Inc., a wholly owned subsidiary of CrowdSrike Holdings, Inc., delivers endpoint
protection, threat intelligence, incident response, and cyberattack response services. The
company is publicly traded.
SOLUTIONS
CrowdStrike Falcon Endpoint Protection is a cloud-based endpoint protection solution which
combines next-generation antivirus, endpoint detection and response (EDR), managed threat
hunting, IT hygiene, and threat intelligence through a single agent. It combines artificial
intelligence and machine learning techniques to protect against known and unknown threats.
Falcon comprises the following components:
o Falcon Prevent – is CrowdStrike’s next-generation antivirus (NGAV) solution which
delivers protection based on machine learning, as well as exploit blocking, indicator of attack(IOA) behavioral analysis, and more.
o Falcon Insight – is its endpoint detection and response (EDR) solution. It relies on the
CrowdStrike Threat Graph, an advanced graph data model, which collects and inspects event
information in real time.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

47

Endpoint Security - Market Quadrant 2020

o Falcon Discover – offers IT hygiene and asset inventory, to help identify unauthorized
systems and applications in real-time, as well as remediate issues to improve security
posture.
o Falcon OverWatch – is CrowdStrike’s 24/7 Managed Detection and Response (MDR)
service which brings together threat hunting, alert prioritization, and incident response.
o Falcon Device Control – provides visibility and control over USB device usage.
o Falcon for Mobile – extends proactive threat identification and response, and incident
investigation to Android and iOS mobile devices.
o Falcon Firewall Management – offers centralized firewall management, making it easier tomanage and enforce host firewall policies.
o Falcon X – is CrowdStrike’s global threat feed providing customized reports and analysis tohelp predict and prevent zero-day attacks.
o CrowdStrike Services – offers pre and post incident response services through CrowdStrike’s
own team of experts.
Falcon Endpoint Protection is available in four bundles:•

Falcon Pro – which includes Falcon Prevent. Falcon X, Falcon Device Control, and Falcon
Firewall Management are optional add-ons.

•

Falcon Enterprise – which includes Falcon Prevent, and Falcon Insight. Falcon X, Falcon
Device Control, Falcon Firewall Management and Falcon OverWatch are optional add-ons.

•

Falcon Premium – which offers all the protection of Enterprise, and adds Falcon Discover.

•Falcon Complete – offers fully managed endpoint protection as a service, powered by
CrowdStrike experts and backed by a breach warranty guarantee of up to $1 million

The CrowsStrike Store provides access to a broad range of partner solutions, such as User
Entity Behavior Analytics (UEBA), and more.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

48

Endpoint Security - Market Quadrant 2020

STRENGTHS•

CrowdStrike solutions are based on a lightweight agent and managed services cloudarchitecture, which delivers protection features across Windows, macOS, and Linux
platforms.

•

CrowdStrike offers an integrated set of advanced next-generation endpoint protection
capabilities which combine AV, EDR, advanced threat protection (ATP), with Managed
Detection and Response (MDR), making this functionality accessible to organizations which
may not have the IT resources to run this type of capabilities on their own.

•

CrowdStrike solutions are managed through a unified management console which provides
workflows for detection and response.

WEAKNESSES•

Customers we spoke with as part of this research, indicated a high rate of false positives.
CrowdStrike does not participate in extensive third party malware testing, making it difficult
to assess its efficacy.

•

CrowdStrike’s business focuses mainly on OverWatch, its Managed Detection and Response(MDR) solution, as opposed to its product based solutions.

•

CrowdStrike does not offer content-aware DLP functionality, or support ICAP for integration
with third party DLP vendors.

•

CrowdStrike is losing some mindshare, as almost all competing endpoint protection vendors
have added advanced EDR, ATP and MDR capabilities.

•

CrowdStrike solutions tend to be more expensive than many competing next generation
endpoint solutions.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

49

Endpoint Security - Market Quadrant 2020

PANDA, A WATCHGUARD BRAND
C/ Santiago de Compostela 12, 1ª Planta
48003 Bilbao
Spainwww.pandasecurity.com/businessPanda Security, was acquired in 2020 by WatchGuard Technologies, becoming a wholly owned
subsidiary. WatchGuard Technologies, offers network security and intelligence, secure Wi-Fi,
multi-factor authentication and advanced endpoint protection. The company is privately owned.
SOLUTIONS
Panda Security offers a cloud-native approach for endpoint security, which includes traditional
endpoint protection (EPP), as well as advanced endpoint protection complemented by endpoint
detection and response (EDR), and specialized security services. The solutions include:•

Panda Endpoint Protection (EP) – provides anti-malware, anti-spyware, anti-phishingprotection, protection against zero-day exploits, email and web protection, firewall,
IDS/HIDS, device control, disinfection and remediation tools, and more. It is available forWindows, macOS, Linux, and Android.

•

Panda Endpoint Protection Plus (EPP) – offers all the capabilities of Endpoint Protection,plus it adds web access control(URL filtering by category) and antispam and anti-malware
protection for Microsoft Exchange. It is available for Windows, macOS, Linux, and Android,
however, web access control functionality is available for Windows only.

•

Panda Adaptive Defense – is Panda Security’s Endpoint Detection and Response (EDR)
solution, complemented by their managed service offering. It provides protection against
unknown malware and targeted attacks through visibility at the endpoint of users, files,
processes, registry, memory and network behavior. This visibility serves to block attacks
using behavioral analysis and containment strategies, and carry out detailed forensic analysis
to determine the root cause of breaches, as well as implement mechanisms to avoid future
incidents.

•

Panda Adaptive Defense 360 – combines EPP capabilities with EDR capabilities, andmanaged services. It offers protection for desktops, laptops, and servers, delivered from the

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

50

Endpoint Security - Market Quadrant 2020

cloud. It automates the prevention, detection, containment and response against advanced
attacks, zero-day malware, ransomware, phishing, memory exploits, and malwareless attacks,
inside and outside the corporate network. It includes the Zero-Trust Application Service andthe Threat Hunting and Investigation Service (THIS) at no extra charge.
Panda Adaptive Defense and Panda Adaptive Defense 360, both leverage the following services:o Zero-Trust Application Service – is Panda Security’s executable classification service, whichmonitors and prevents the execution of malicious applications and processes on endpoints.
o Threat Hunting and Investigation Service (THIS) – is a managed service which provides realtime and retrospective intelligence on all the events taking place on an organization’s
systems to discover unknown threats by investigating anomalous users, machines andapplication behavior. The data helps investigators conduct forensic analysis that makeremediation processes more efficient and help reduce the attack surface. In addition, any new
indicators of compromise feed the solution's technologies and automate detection in the earlyattack phases without human intervention.
The services leverage EDR capabilities and Endpoint telemetry that is collected and turned into
actionable insights, in real time through applications specifically designed for internal SOCs,
MSSPs and MDR (Managed Detection and Response) service providers.
Panda Security also offers the following complementary add-ons:•

Advanced Reporting Tool (ART) – is an optional module that can be used to augment
Adaptive Defense and Adaptive Defense 360, to provide detailed information on applicationsand vulnerabilities. It provides pre-defined queries, dashboards, and alerts that provide
insights into what is going on at the endpoints out-of-the-box. Managers can also create theirown queries and alerts based on the endpoints telemetry.

•

Panda Patch Management – is an add-on to Panda Endpoint Protection, Panda Endpoint
Protection Plus, Panda Adaptive Defense and Panda Adaptive Defense 360, which manages
vulnerabilities in operating systems and third-party applications on Windows endpoints andservers. It provides a reduced attack surface, strengthening preventive capabilities andincident containment.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

51

Endpoint Security - Market Quadrant 2020•

Panda Data Control – is an add-on to Panda Adaptive Defense and Panda Adaptive Defense
360, which discovers, audits and monitors unstructured sensitive or personal data on
endpoints, from data-at-rest to data-in-use and data-in-motion. It can also run real time, freecustom searches to find files with specific content.

•

Panda Full Encryption – is an add-on to Panda Endpoint Protection, Panda Endpoint
Protection Plus, Panda Adaptive Defense and Panda Adaptive Defense 360, which centrally
controls and manages full disk encryption and key recovery, leveraging BitLocker inWindows systems.

•

SIEMFeeder – is a module that sends in real time, events collected on endpoints andenriched with security intelligence, to integrate into SIEM solutions.

•Aether – is Panda Security’s cloud-based administration console. It provides a wide range ofAPIs and tools to help integrate into organizations' existing applications and processes.

•

WatchGuard DNSWatchGo – is a cloud-based service that provides domain-levelprotection, content filtering, and integrated security awareness training.

In addition, WatchGuard’s Cytomic business unit, focuses on the needs of organizations withmature security operations centers, and on MSSPs expanding into Managed Detection andResponse services. Cytomic’s flagship solution, Cytomic Covalent, includes Orion, a cloudbased Threat Hunting Platform, which allows to query and analyze real-time events and 12
months of enriched events for hunting, conducting IOC searches, and conducting automatedtemplate-based investigations through integration with the Jupyter Notebooks platform. It canalso take direct remediation and containment actions from the console. Cytomic Orion leverages
the Zero-Trust Application Service from Panda Security, and it can coexist and complement any
incumbent EPP and EDR solution on the endpoints.
STRENGTHS•

Panda Security Adaptive Defense 360 combines in a single solution the capabilities of
endpoint protection, Endpoint Detection & Response (EDR) and managed services. The
solution is delivered in a light agent connected through cloud-based technologies to offer
prevention, detection and response capabilities.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

52

Endpoint Security - Market Quadrant 2020•

Panda Security delivers an easy to use, intuitive administration console with rich, actionable
reporting.

•

Panda Security offers a Data Control module, which provides an unattended solution tocontrol, monitor and search sensitive data and Personal Information at the endpoints. It
doesn’t require any additional agent, and its capabilities are integrated into the Panda
Adaptive Defense 360 agent.

•

Panda Security solutions are attractively priced.

•

The Cytomic ORION solution, which integrates with the Jupyter Notebooks platform toadapt it to threat hunting use cases, is highly innovative.

•

The acquisition of Panda Security by WatchGuard enables the integration of user, endpoint
and network security into a single platform, and the opportunity to expand the company’s
endpoint footprint in North America.

WEAKNESSES•

Panda Security currently supports centralized management of full volume encryption with
BitLocker for Windows devices. However, support for Apple FileVault in still on thevendor’s roadmap.

•

Panda currently provides basic MDM capabilities for Android, however, support for iOS
devices is not provided.

•

Panda Security currently provides only basic DLP capabilities, through its Data Control
module. However, the vendor continues to enhance this with future releases.

•

While Panda Endpoint EPP is available for Windows, macOS, Linux, and Android, the web
access control functionality is only available for Windows.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

53

Endpoint Security - Market Quadrant 2020

F-SECURE
Tammasaarenkatu 7
P.O. Box 2400181 Helsinki
Finlandwww.f-secure.com
F-Secure, founded in 1988, offers cyber security products and services for enterprise andconsumer customers. In the business space, the company offers cloud-based solutions forendpoint protection, detection and response, advanced threat protection and vulnerability
management, as well as security consulting services such as red teaming, security awarenesstraining and cyber security assessments. F-Secure has a global presence, with headquarters inFinland, and is publicly traded.
SOLUTIONS
F-Secure’s cloud-native endpoint protection is available with EDR and vulnerability
management with a single agent and cloud-based management, or as a managed service:•

F-Secure Protection Service for Business (cloud service) – includes the following key
endpoint protection features:
o Management Portal (cloud) – central management portal for deployment, management,
monitoring and reporting, with integrated mobile device management.
o Computer Protection – security for Windows and macOS workstations, including
advanced behavior and heuristic analysis, ransomware protection, as well as application
control, device control and fully integrated patch management.
o Mobile Protection – next generation mobile security for iOS and Android devices.
Personal VPN (Wi-Fi Security), proactive App and Web protection and support for third
party Mobile Device Management (MDM).
o Server Protection – comprehensive server security for Windows, Linux and Citrix.
Additional SharePoint and Exchange components, with application control, device

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

54

Endpoint Security - Market Quadrant 2020

control and fully integrated patch management.
•

F-Secure Rapid Detection & Response (cloud service) – includes the following key EDR
features:o Advanced threat protection with real-time behavioral, reputational and big data analysis
with machine learning that identifies threats and alerts with broad context.
o Endpoint clients allow the execution of remote response actions, like host isolation, on
both Windows and macOS.
o Automated response actions are available to contain attacks whenever high risk levels are
identified.
o On-demand access is available to F-Secure’s managed detection and response team forincident analysis and investigations, with a 2-hour response time.
o The clients are designed to work with any endpoint protection solution, and function with
F-Secure's endpoint security solutions in a single-client and management infrastructure.

F-Secure Business Suite is an on-premise alternative for the endpoint protection. F-Secure
Countercept is F-Secure’s MDR, managed advanced threat hunting and response service, toprotect against skilled cyber adversaries 24/7.
F-Secure also offers F-Secure Cloud Protection for Microsoft Office 365, a solution to protect
cloud-based collaboration from advanced email threats; it shares a management system with thecloud-based endpoint protection and detection and response, as well as with F-Secure Radar, asolution which delivers extensive vulnerability scanning, prioritization and management.
STRENGTHS•

F-Secure offers both a cloud-based solution, as well as an on-premises solution to fit
different customer needs.

•

F-Secure uses a multi-layered architecture for malware detection and endpoint protection.
Including DeepGuard, its advanced behavioral analytics engine.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

55

Endpoint Security - Market Quadrant 2020•

Real-time threat intelligence from F-Secure Security Cloud ensures up-to-date protection.
Updates are transparent and delivered constantly, without disrupting employee productivity.

•

Fully integrated patch management and EDR capabilities, which do not require additional
client agents.

•

The footprint of F-Secure with regards to CPU and RAM usage is much smaller than that ofother vendors in the space.

•

Setting administrative policies is a very easy, simple process.

WEAKNESSES•

F-Secure does not offer DLP capabilities.

•

F-Secure’s Business Suite on-premises offering lags somewhat behind its cloud-based
offering in a number of areas, including: VPN support, iOS, and Android support.

•

F-Secure currently offers Sandboxing only as part of its email security solution, F-Secure
Cloud Protection for Microsoft Office 365.

•

F-Secure has improved its market visibility, especially with its consulting and managed
services, but still needs to make progress in this area in North America.

BLACKBERRY
2240 University Avenue, East
Waterloo, Ontario
Canada N2L 3W8
www.blackberry.com
BlackBerry, founded in 1984, develops software and services aimed at businesses, car makers
and government agencies. In 2019, BlackBerry acquired Cylance, which uses artificial
intelligence, algorithmic science and machine learning to provide technology and services that

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

56

Endpoint Security - Market Quadrant 2020

offer predictive and preventive protection against advanced threats. BlackBerry Limited is a
publicly traded company.
SOLUTIONSBlackBerry Spark UES Suite offers a prevention-first endpoint security platform that applies
artificial intelligence and machine learning to deliver pre-execution threat prevention andautomated detection and remediation against cyberattacks. BlackBerry Spark UES Suite
comprises the following products:•

BlackBerry Protect – is the prevention-focused component of the platform, which delivers
malware prevention powered by artificial intelligence, combined with application and script
control, memory protection, and device policy enforcement to prevent cyberattacks. The
solution delivers protection against malware, ransomware, file-less malware, malicious
scripts, weaponized docs, and other attack vectors, without relying on signatures or streaming
data to the cloud. Protect supports Windows (32bit or 64bit), macOS, and Linux
environments. It is available as a cloud deployment, on-premises (as a virtual appliance), or
as a hybrid deployment. It provides:
o Malware Execution Control – rejects potentially unwanted programs, controls tools usedin lateral movement, and more.
o Device Control – provides control over the use of USB devices, and prevents exfiltrationof data through removable media.
o Applications Control – offers device binary lockdown, prevents bad binaries, preventsmodification of good binaries, and more.
o Script Control – stops unauthorized PowerShell and Active Scripts, stops risky Visual
Basic for Applications (VBA) macro methods, weaponized documents, and file-lessattacks.
o Memory Protection – stops memory misuse and exploitation, halts process injection and
more.

•

BlackBerry Optics – is the endpoint detection and response (EDR) component that enables
easy root cause analysis, threat hunting and automated threat detection and response. It

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

57

Endpoint Security - Market Quadrant 2020

augments Protect’s prevention capabilities without requiring organizations to makesignificant investments in on-premises infrastructure, stream data to the cloud continuously,
or employ highly skilled security resources. It helps organizations automate threat detection
and response tasks using existing resources, reducing the workload on security analysts. It
also supports Remote Forensic Data Collection, to retrieve advanced sets of forensic datafrom endpoints, as well as execute scripts, or applications to capture critical information
related to suspicious events or security incidents.
•

BlackBerry Persona – reduces insider threats, stolen credentials and physical compromises
by providing continuous authentication and user behavior analytics to identify suspicious andmalicious users in real-time.

BlackBerry also offers BlackBerry Spark Suite which combines BlackBerry Spark UES
Suite, for endpoint protection, with BlackBerry Spark UEM Suite, for unified endpoint
management (UEM), to deliver an integrated endpoint security and endpoint management
solution.
BlackBerry Guard is a 24x7 Managed Detect and Response (MDR) offering which provides
proactive threat hunting and actionable intelligence. It provides access to BlackBerry analysts to
help investigate incidents, delivers regular updates on overall threat prevention status, and helps
initiate actions in response to indicators of compromise (IOC).
BlackBerry also offers managed services to provide enterprises with pre-attack penetration andvulnerability testing, compromise assessments, and post-attack incident response.
STRENGTHS•

BlackBerry is a cloud-based security provider, however, all client data is stored locallyremoving the need for an always-on cloud connection. The vendor also supports on-premises
and hybrid deployment options.

•BlackBerry Protect has a small and lightweight footprint compared to other security
products.

•

BlackBerry Optics is highly intuitive and does not require additional hardware or continuous
streaming of data to the cloud, making it one of the more lightweight EDR solutions on the

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

58

Endpoint Security - Market Quadrant 2020

market. It is designed to detect threats and take responsive action, without humanintervention.
•

All BlackBerry products are managed through a single dashboard.

WEAKNESSES•

BlackBerry Spark UES Suite offers basic DLP capabilities. Capabilities such as firewall, andmobile device management are only available through partners.

•

BlackBerry Optics can do patch assessment, however, it is not an automated process.

•Customers we spoke with as part of this research, indicated a high degree of false positives.

•

BlackBerry should make it easier for customers of its UES and UEM solutions to integratewith third party solutions.

•BlackBerry has lost some mindshare in the endpoint security space since nearly all traditional
endpoint protection vendors have now added advanced next-generation capabilities whichwere once key differentiators of the Cylance solution.

VMWARE CARBON BLACK
1100 Winter St.
Waltham, MA 02451
www.carbonblack.com
VMware Carbon Black, formed from the VMware acquisition of Carbon Black in 2019, is a
developer of next-generation endpoint security. It leverages its big data and analytics cloud
platform, the CB Predictive Security Cloud, to enable customers to defend against advanced
cyber threats, including malware, ransomware, and non-malware attacks. VMware is publicly
traded.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

59

Endpoint Security - Market Quadrant 2020

SOLUTIONS
VMware Carbon Black Cloud is a next generation endpoint protection platform that
consolidates multiple endpoint security capabilities into one agent and management console,making it easy to prevent, investigate, remediate, and hunt for threats. It offers the following
modules which can be managed through the same user interface, with a single login:● Endpoint standard – delivers next-generation antivirus (NGAV), and endpoint detection
and response (EDR) functionality. It analyzes attacker behavior patterns to detect malware,
fileless, or living-off-the-land zero-day attacks.
● Managed detection – is a real-time security operations solution that provides managed alert
monitoring and triage. It relies on the CB Predictive Security Cloud to captures and store all
OS events across every individual endpoint. It delivers visibility for security operations
center (SOC) and incident response (IR) teams. Leveraging this data, enables teams toproactively hunt for threats, as well as uncover suspicious and stealthy behavior, disrupt
active attacks and address potential defense gaps. It allows organizations to respond andremediate in real-time, stopping active attacks and quickly repairing damage.
● Audit and remediation – offers real-time device assessment and remediation. It serves toaudit the current system state and track and harden the security posture across protected
devices.
● Enterprise EDR – offers threat hunting and containment. It serves to proactively hunt for
abnormal activity using threat intelligence and customizable detections.
Carbon Black solutions are delivered as cloud services, however, the vendor also offers solutions
for customers which may have on-premises needs. Carbon Black supports all leading OS
platforms, including Windows, macOS, and Linux.
STRENGTHS•

VMware Carbon Black offers its solution through a multi-tenant cloud platform, whichmakes it easier for customers to consume its services while benefiting from broad real-timethreat analysis across a wide number of endpoints.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

60

Endpoint Security - Market Quadrant 2020•

VMware Carbon Black offers strong prevention based on streams of activity delivered via
unfiltered data collection, which enables the Predictive Security Cloud to perform wellinformed analysis to detect new attack patterns and deploy new logic to stop malicious
activity.

•

VMware Carbon Black Predictive Security Cloud, allows customers to choose which productmodules are right for their organization. All modules are easily deployed through the sameuser interface and agent.

•

VMware Carbon Black offers an extensible architecture based on open APIs, which allows
partners and customers to easily extend and integrate with existing security components.

WEAKNESSES•

VMware Carbon Black Cloud does not offer some traditional endpoint protection
functionality, such as firewalls, mobile security, or DLP. However, custom integrations are
possible through the platform’s open APIs.

•

VMware Carbon Black Cloud does not provide device control.

•

VMware Carbon Black Cloud does not provide application control capabilities. VMware
Carbon Black currently offers this through an on-premises application control product.

•

VMware Carbon Black has lost some mindshare following the VMware acquisition. The
vendor is working to address this.

MICROSOFT
1 Microsoft Way
Redmond, WA 98052
www.microsoft.com
Microsoft develops products and services for businesses and consumers, and delivers anextensive portfolio of solutions which include office productivity, messaging, collaboration, andmore.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

61

Endpoint Security - Market Quadrant 2020

SOLUTIONS
Microsoft has folded much of its endpoint protection directly into the operating system, startingwith Windows 10 and Windows Server 2016 computers. The solutions are branded under the
Windows Defender umbrella name, as follows:•

Windows Defender Antivirus (AV) – is loaded into the system directly at configuration
time, to provide basic endpoint anti-malware protection.

•

Windows Defender Security Center – is a local security dashboard.

•

Windows Defender SmartScreen – provides phishing and malware filtering for Microsoft
Edge browsers and Internet Explorer 11 in Windows 10.

•

Windows Defender Application Guard – helps isolate and sandbox Internet Explorer andEdge browsers.

•

Windows Defender Application Control – is an application whitelisting solution that canalso limit the capabilities of unsigned scripts, as well as enforce established use policies. It
overlaps somewhat in functionality with Microsoft App Locker, another application
whitelisting technology, which was originally available with Windows 7 but has also been
upgraded for use in Windows 10.

•

Secure Boot – helps ensure that a device boots using only trusted software.

•

Windows Defender Device Guard – allows Windows desktops to be locked down to run
only trusted apps (similarly to mobile phones).

•

Windows Defender Exploit Guard – provides exploit mitigation, blocks risky activity, canbe used to restrict HTTP and HTTPS connections to malicious hosts, and can be used torestrict access to designated folders.

•Windows Defender Credential Guard – prevents unauthorized access to OS credential
information.

•

Windows Defender Systems Guard – protects key OS components starting at boot-time.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

62

Endpoint Security - Market Quadrant 2020•

Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) – is a cloudbased EDR analytics protection and response service designed to help detect, block andremediate zero-day threats. It provides protection against phishing, malware and spam
attacks. It can offer near real-time protection against high-volume spam campaigns, with
DKIM and DMARC support. It also adds protection against “zero-day” attachments andharmful URL links, through real-time behavioral analysis and sandboxing. It is available with
Windows 10 Enterprise E5, Windows 10 Education E5, or Microsoft 365 E5 plans. It uses
technology built into Windows 10 and Microsoft cloud services to provide:oEndpoint behavioral sensors – sensors embedded in Windows 10, collect and process
behavioral signals from the operating system and send sensor data to private, cloudinstances of Windows Defender ATP.

o

Cloud security analytics – leverages machine-learning across the across the entire
Microsoft Windows ecosystem to deliver insight, detection, and recommended responses
to advanced threats.

oThreat intelligence – leverages threat intelligence collected by Microsoft, security teams,
and augmented by threat intelligence provided by partners, to enable Windows Defender
ATP to identify attacker tools, techniques, and procedures, and generate alerts when theseare detected.

oManaged Detection and Response – as part of Microsoft Defender ATP, Microsoft alsooffers Microsoft Threat Experts, a managed detection and response (MDR) service
which combines targeted attack notification with on-demand SOC expert services. It isavailable as part of the Microsoft 365 E5 subscription plan.

Microsoft Defender ATP is also available for Mac and Linux platforms, although featureparity is not available across all platforms.
Microsoft Defender ATP can be managed from the Microsoft Security Center console, which
provides a unified control point across the entire enterprise environment encompassing
Intune, Azure ATP, Office 365 ATP, Azure Security Center, Skype for Business, Microsoft
Cloud App Security, and more.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

63

Endpoint Security - Market Quadrant 2020

On earlier Windows 8 and 9 platforms, protection consists of Microsoft System Center Endpoint
Protection (SCEP), and Microsoft Intune. Microsoft has also extended Windows Defender ATP
to support older Windows 7 and Windows 8.1 platforms.
•

Microsoft System Center Endpoint Protection (SCEP) is Microsoft’s solution for antimalware and endpoint protection for traditional endpoint devices (laptops, desktops andservers). It provides real-time, policy-based protection from malware, spyware and otherthreats. It also provides file cleaning, where infected files are replaced with clean versions
downloaded from a Microsoft cloud location, as well as the ability to configure Windows
Firewall settings. SCEP is designed for Windows client workstations and servers, and isincluded at no additional cost as part of the Microsoft Enterprise Client Access License andCore CAL programs. Separate security applications, however, are required for Mac andLinux platforms.

•

Microsoft Intune is Microsoft’s cloud-based Unified Endpoint Management (UEM) solution
for mobile device management of Windows, macOS, iOS, and Android.

SCEP and Intune can both be managed through a single administration console, Microsoft
System Center Configuration Manager (SCCM), recently renamed to Microsoft Endpoint
Manager (MEM), which unifies policy management and device management.
STRENGTHS•

Microsoft offers a strong set of security features for Windows 10 platforms, making it easierfor users and administrators to adopt a strong security posture.

•

SCEP is included at no additional cost as part of the Microsoft Enterprise Client Access
License and Core CAL programs. Microsoft Intune is available as a component ofMicrosoft’s Enterprise Mobility Suite (EMS), which includes Microsoft Azure Active
Directory Premium, and Microsoft Azure Information Protection. This makes SCEP and
Intune some of the least expensive endpoint security solutions on the market, as manycustomers are able to get the solutions at no additional cost as part of their existing licensing
agreements.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

64

Endpoint Security - Market Quadrant 2020•

Microsoft offers customers a complete vision which goes well beyond simply endpoint
malware protection to encompass Advanced Threat Protection (ATP), as well as information
security, data loss prevention and identity management.

•

Microsoft is investing heavily in its security solutions portfolio, to deliver an impressive
ecosystem of solutions that encompass the OS, applications, and services.

WEAKNESSES•

Despite Microsoft’s strong investments in security, customers still cite Microsoft’s malware
detection capabilities as being less accurate than competing security solutions. Most
customers deploy Microsoft technologies as a baseline, while also deploying additional
security solutions from other vendors for advanced protection.

•

In order to benefit from the more advanced security features, customers have to upgrade toWindows 10.

•

In order to obtain Microsoft’s full range of security solutions, including the EDR component,
Microsoft Defender Advanced Threat Protection (ATP), customers must upgrade to the highend Microsoft 365 E5 enterprise license.

•

Microsoft offers a highly complex ecosystem of security solutions involving the operating
system and many additional components. However, integrating all these components
correctly and maintaining them fully integrated throughout Microsoft’s continuous upgrade
cycle can be daunting for many organizations.

•

Encryption capabilities are only offered via the Microsoft Desktop Optimization Pack.

•

Microsoft System Center does not offer granular device control for removable media,
CD/DVDs, and other common devices.

•

Microsoft offers endpoint protection for Mac and Linux platforms, however feature parity is
not provided across all platforms and customers should check carefully on the features andcapabilities they require.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

65

Endpoint Security - Market Quadrant 2020

TREND MICRO
Shinjuku MAYNDS Tower, 1-1,
Yoyogi 2-Chome, Shibuya-ku
Tokyo, 151-0053, Japan
www.trendmicro.com
Founded in 1988, Trend Micro provides security solutions for organizations, service providers,and consumers. Its solutions are powered by the cloud-based Trend Micro Smart Protection
Network, which brings together threat reporting and analysis based on a worldwide threat
assessment infrastructure. Trend Micro is publicly traded.
SOLUTIONS
Trend Micro Smart Protection Suites offers an integrated defense solution for desktops,
laptops, servers and virtualized deployments, with a central management interface. The vendor’s
XGen Endpoint Security functionality, combines machine learning and other techniques, in orderto protect against ransomware and advanced attacks.
The endpoint component of Smart Protection Suites is Apex One, Trend Micro’s flagshipenterprise product which combines traditional endpoint protection with endpoint detection andresponse (EDR) and managed detection and response (MDR) capabilities. It replaces OfficeScan
which was Trend Micro’s previous solution. Apex One supports a broad range of threat detection
techniques including machine learning (both pre-execution and runtime), and IOA behavioral
analysis. It also provides virtual patching powered by early threat intelligence from Trend
Micro’s Zero Day Initiative. It delivers actionable insight through a single console which
includes an EDR investigative toolset option which enables threat hunting, patient zero
identification, and root cause analysis. The EDR investigative capabilities are available for PC
and Mac platforms. Apex One is delivered as single agent and is available in a SaaS or onpremises deployment model.
Apex One can integrate with a number of additional components which include:
Vulnerability Protection – delivers virtual patching to prevent zero-day threats.
Application Control – prevents unknown applications from executing on endpoints. It combinespolicies, whitelisting and blacklisting capabilities, as well as an extensive application catalog.
Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

66

Endpoint Security - Market Quadrant 2020

Data Loss Prevention (DLP) – prevents data loss via USB, email, software as a service
application, web, mobile devices, and cloud storage.
Endpoint Sensor – provides context-aware investigation and response (EDR/XDR), recording
and reporting to allow threat analysts to assess the nature of an attack across email, endpoints
and servers.
Endpoint Encryption – encrypts data stored on endpoints including PCs, Macs, DVDs, and USB
drives. It is available as a separate agent which provides full-disk encryption, folder and file
encryption as well as removable media encryption. Endpoint encryption is only available as an
on-premises component and as a separate agent from Apex One single agent.
Trend Micro Apex Central – is a centralized security management console which provides
visibility and reporting across multiple components. It extends visibility across on-premises,
cloud and hybrid deployment models. It also provides access to actionable threat intelligencefrom the Trend Micro Smart Protection Network which relies on global threat intelligence todeliver real time security.
Security for Mac – provides a layer of protection specific to Mac clients, and adheres to a Mac
OS look and feel.
Apex One also integrates into Trend Micro’s XDR (Extended detection and response) managed
service which offers correlated detection and response across email, endpoints, servers, cloud
workloads, and networks. Apex One customers have access to XDR free of charge for up to
10% of their users, this is intended as a stepping stone into Trend Micro’s Managed XDR
offering.
STRENGTHS•

Trend Micro’s Smart Protection Suites offer a broad portfolio of solutions that bring together
endpoint, server, web, email protection and more, into a cohesive security management
framework to meet diverse customer needs.

•

Apex One delivers the benefits of traditional endpoint protection, as well as EDR/XDR in asingle a single client available for both on-premises and SaaS deployment.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

67

Endpoint Security - Market Quadrant 2020•

Trend Micro prices per user, which is a cost advantage as users typically have multiple
devices.

WEAKNESSES•

Trend Micro has been slow to innovate its portfolio, particularly as it pertains to the additionof advanced threat detection technologies, such as EDR/XDR.

•

Customers report that Trend Micro’s EDR/XDR capabilities are still not as advanced as thoseof competing solutions.

•Trend Micro Endpoint Encryption is available on-premises only and as a separate agent fromthe Apex One single agent.

•

DLP is only available as a separate add-on.

•

Mobile Security is a separate add-on.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

68Endpoint Security - Market Quadrant 2020

THE RADICATI GROUP, INC.
http://www.radicati.com
The Radicati Group, Inc. is a leading Market Research Firm specializing in emerging IT
technologies. The company provides detailed market size, installed base and forecast information
on a worldwide basis, as well as detailed country breakouts, in all areas of:
•
•
•
•
•
•
•

Email
SecurityCompliance
Instant Messaging
Unified Communications
Mobility
Web Technologies

The company assists vendors to define their strategic product and business direction. It also
assists corporate organizations in selecting the right products and technologies to support theirbusiness needs.
Our market research and industry analysis takes a global perspective, providing clients withvaluable information necessary to compete on a global basis. We are an international firm withclients throughout the US, Europe and the Pacific Rim. The Radicati Group, Inc. was founded in
1993.
Consulting Services:
The Radicati Group, Inc. provides the following Consulting Services:
•
•
•
•
•
•

Management Consulting
Whitepapers
Strategic Business Planning
Product Selection Advice
TCO/ROI Analysis
Multi-Client Studies

To learn more about our reports and services,
please visit our website at www.radicati.com.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

69

Endpoint Security - Market Quadrant 2020

MARKET RESEARCH PUBLICATIONSThe Radicati Group, Inc. develops in-depth market analysis studies covering market size, installed
base, industry trends and competition. Current and upcoming publications include:
Currently Released:

Title

Microsoft SharePoint Market Analysis, 2020-2024
Email Market, 2020-2024
Cloud Business Email Market, 2020-2024
Unified Endpoint Management Market, 2020-2024
Corporate Web Security Market, 2020-2024
Microsoft Office 365, Exchange and Outlook Market
Analysis, 2020-2024
Advanced Persistent Threat (APT) Market, 2020-2024
Information Archiving Market, 2020-2024
Email Statistics Report, 2020-2024
Social Networking Statistics Report, 2020-2024
Instant Messaging Statistics Report, 2020-2024
Mobile Statistics Report, 2020-2024
Cloud Access Security Broker (CASB) Market, 2019-2023
Enterprise DLP Market, 2019-2023

Released

Price*

May 2020
Apr. 2020
Apr. 2020
Apr. 2020
Apr. 2020$3,000.00$3,000.00$3,000.00$3,000.00$3,000.00

Apr. 2020$3,000.00

Apr. 2020
Apr. 2020
Mar. 2020Feb. 2020
Jan. 2020
Jan. 2020
Nov. 2019Nov. 2019$3,000.00$3,000.00$3,000.00$3,000.00$3,000.00$3,000.00$3,000.00$3,000.00* Discounted by $500 if purchased by credit card.

Upcoming Publications:

Title

Secure Email Gateways Market, 2020-2024
Endpoint Security Market, 2020-2024

To Be
Released

Price*

Nov. 2020
Nov. 2020$3,000.00$3,000.00* Discounted by $500 if purchased by credit card.
All Radicati Group reports are available online at http://www.radicati.com.

Copyright © November 2020, The Radicati Group, Inc. Licensed for distribution.

70