Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Endpoint vs Tanium comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 18, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Endp...
Ranking in Endpoint Protection Platform (EPP)
2nd
Ranking in Endpoint Detection and Response (EDR)
2nd
Average Rating
8.2
Reviews Sentiment
7.0
Number of Reviews
210
Ranking in other categories
Advanced Threat Protection (ATP) (3rd), Anti-Malware Tools (1st), Microsoft Security Suite (3rd)
Tanium
Ranking in Endpoint Protection Platform (EPP)
21st
Ranking in Endpoint Detection and Response (EDR)
21st
Average Rating
7.8
Reviews Sentiment
6.4
Number of Reviews
20
Ranking in other categories
Server Monitoring (3rd), Vulnerability Management (23rd), Unified Endpoint Management (UEM) (7th)
 

Mindshare comparison

As of January 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Microsoft Defender for Endpoint is 8.1%, down from 11.5% compared to the previous year. The mindshare of Tanium is 2.2%, down from 2.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Endpoint8.1%
Tanium2.2%
Other89.7%
Endpoint Protection Platform (EPP)
 

Q&A Highlights

 

Featured Reviews

Robert Arbuckle - PeerSpot reviewer
Security Analyst III at a healthcare company with 10,001+ employees
Automatically isolates threats and integrates with logging to reduce response time
Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.
VK
Infra Vulnarability Manager at Rezilyens
Immediate results in patching promptly address vulnerabilities
When working with Tanium, there are some older devices that haven't been patched for a long time, and certain patches are not included in Tanium. I have to search outside to download patches, create bundles, and then perform the task. It would be easier if Tanium provided the patches directly. Some other brands provide the patch with a direct download link, which facilitates the process. Also, I feel that if there were more detailed documents and remediations readily available online for troubleshooting, especially more up-to-date information, it would be beneficial. Currently, some resources online are very out-of-date.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We have very good visibility on our endpoints. The level of information it throws back is helpful."
"The patch management is very easy, as it can be done automatically or added to a schedule."
"The protection that it provides is quite good."
"It's one of the best antiviruses on the market."
"It's free. There is no additional cost. It's part of Windows."
"I like the real-time protection features. Windows Defender will detect if there's a threat like a Trojan or something like that but Kaspersky lets it run normally."
"Microsoft Defender for Endpoint is beneficial because we are using Microsoft Windows and all the core solutions are made by Microsoft, such as the authentic platform, operating system, and antivirus protection. It is a heterogeneous environment. We had to use third-party solutions before and update everything separately. For example, the policy for antivirus. With Microsoft Defender for Endpoint, when Microsoft Windows receives updates it will update with it. This is one main advantage of this solution."
"Provides good security features and you can view it in the central console."
"Tanium has made the process of detecting threats more proactive with its detection. So, the process is easier and more efficient."
"When I push a quick update, it's done right away, and I can rescan immediately to confirm completion within minutes."
"The solution is scalable and helps to understand how infrastructure works. It helps to improve the health of the organization."
"I would say Tanium is the best tool for vulnerability management."
"The solution's technical support is very responsive."
"Tanium's most valuable feature is its instant discovery aspect."
"I like the tool's incident response and security patching."
"The security features are very valuable."
 

Cons

"There is no behavior analytics for devices and endpoints. There is no behavior-based protection."
"The deployment of Microsoft Defender for Endpoint on Windows 10 is not quite so straightforward. This could be made easier."
"They can improve it on the online protection front since people nowadays are moving online and working from home."
"Microsoft Defender for Endpoint can improve by making the reporting faster. It takes some time to reflect back to the administration portal of what has been updated. For example, out of 100 Computers, approximately 90 computers received updates, but when you check the administration portal over one or two days, you will only see 75, even though 90 were updated."
"The profiling method currently in use is not very user-friendly and has ample scope for improvement."
"Auto recovery is the most important feature that we would need from this solution. For decryption, similar to Malwarebytes, there should be something to be able to recover the data up to the last normal status. Its ability to recover data to the last normal copy must not exceed 5 to 10 minutes."
"Notifications are always popping up — I hate that."
"The time it takes to implement policies has room for improvement."
"Most of the time, agent-relative issues have to be more equipped with self-healing features. At times, the agent is there, but for some reason, it doesn't report a status. It gives certain problems that are obviously agent-based."
"I would like to have more integrations and custom plugins to input. Integration is always a big deal in a lot of different environments."
"They could improve the UI."
"Any movement into a SaaS solution has challenges since the processes and data flows are not well defined. Hence, you need to build it at the same time."
"The performance could improve in future releases. We have had performance issues in specialized web environments, but overall I think the problems are less than 2% of the computer systems being used."
"The main issues are the network connection because different customers have issues with their networks. It's difficult implementing this type of solution because the network is the main feature in the architecture for these types of solutions. Tanium could improve by creating some network optimization."
"The solution lacks mobility."
"We had some issues with the solution's OS upgrade."
 

Pricing and Cost Advice

"As we operate in the educational sector, we are eligible for an educational discount."
"Microsoft Defender is an expensive product in my country."
"Microsoft Defender ATP is expensive."
"Microsoft Defender for Endpoint is an expensive solution."
"It is within the same range as other products. It is not too expensive, and it is also not cheap. Its price can be better, but, well, it is Microsoft."
"The base price for an E5 license, which includes Enterprise Mobility + Security E5, is $57 per user per month."
"Defender doesn't cost that much. When you use Microsoft technology, you can start with the free version and see how much the technology helps your organization solve security problems before you use the subscription. They also do this pay-as-you-go model, so you only pay when you use it."
"Microsoft Defender for Endpoint is cost-effective because there's one unified license, and with this unified license, you get the capabilities for your cloud applications, servers, and endpoints as well. Therefore, it saves us a lot of money because the cost with other solutions is for just one piece of OS or maybe an urban environment. The licensing process is not complex as well."
"It is higher than some competitors in the market."
"The product's pricing differs from region to region depending on negotiations and the number of endpoints."
"The solution offers value for money."
"Tanium is a more expensive solution in Latin America than some of the competitors, such as BigFix."
"The solution is expensive but it's a good investment."
"It's an expensive solution. It would be nice if the cost were lower."
"There is an annual license required to use this solution."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
880,901 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
11%
Financial Services Firm
9%
Manufacturing Company
8%
Government
8%
Financial Services Firm
16%
Government
11%
Manufacturing Company
9%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business80
Midsize Enterprise40
Large Enterprise92
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise3
Large Enterprise11
 

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What needs improvement with Tanium?
While there is always room for improvement, I am pleased with Tanium.
What is your primary use case for Tanium?
The primary use case for Tanium ( /products/tanium-reviews ) is compliance, patching, and inventory as part of the core functions.
What advice do you have for others considering Tanium?
For smaller companies, Tanium is quite a big investment, and one needs to have a considerable setup to make it economically viable. I would recommend it to others with a similar use case. The solut...
 

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
Tanium Inc Cloud, Tanium XEM
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Petrofrac, Metro CSG, Christus Health
JPMorgan Chase, eBay, Amazon, US Bank, MetLife, pwc, Cerner, Delphi, MGM Grand, New York Life
Find out what your peers are saying about Microsoft Defender for Endpoint vs. Tanium and other solutions. Updated: January 2026.
880,901 professionals have used our research since 2012.