Try our new research platform with insights from 80,000+ expert users

BigFix vs Microsoft Defender for Endpoint vs Webroot Business Endpoint Protection comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of May 2025, in the Endpoint Protection Platform (EPP) category, the mindshare of BigFix is 1.1%, up from 0.8% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 10.8%, down from 14.4% compared to the previous year. The mindshare of Webroot Business Endpoint Protection is 0.7%, down from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP)
 

Featured Reviews

Bella Yakoby - PeerSpot reviewer
Offers third-party patching feature, good scalability, and enhance endpoint management capabilities
From the perspective of the team that's handling the environment, it's not so user-friendly compared to other solutions, the competitors. We hire new teams from time to time, and they are complaining, look, although BigFix is very robust and cross-platform, it's not so fun to work with. The user interface for the technical teams is not so advanced. It's not so intuitive compared to SCCM, compared to ManageEngine. And this is the fact that they have, with the teams, because they have the rejection. The look and feel of the system are old-fashioned. For new employees, it's less easy to find someone I don't need to educate on how to work with BigFix. Although it's easy, it's not as intuitive as the other solutions, and the functionality of the other solutions is less advanced. Let's summarize: The user interface has to be changed from the perspective of the teams that are managing the product. It's old school.
AnuragSrivastava - PeerSpot reviewer
Provides detailed visibility into threats but the ability to add exceptions needs improvement
One major item for improvement is the ability to add exceptions. We can add some exceptions, but not at the level we need to. The second major area for improvement involves enhanced capabilities for different operating systems or platforms. That is, even though we have coverage for different operating systems or platforms such as Linux, we don't get all of the controls and enhanced capabilities that are available with Windows devices. Reporting could also be improved because, at present, we get limited results at times. For example, in an environment with more than 100,000 devices, you may just get 10,000 results when you run a report.
Rick Cassel - PeerSpot reviewer
Lightweight and not hard to set up however, does not offer good reporting
We've had a couple of events both this year and last year where it just didn't seem to catch ransomware, which is impossible to do if someone has hands-on with the system. There were some things that they had or used to have or don't have that I still haven't figured out called journaling. And it was supposed to be a way to roll back changes that were made. However, they're telling me they don't have that. That's not in the system. It’s my understanding that it doesn’t actually scan any files at all. They just look at their database of files they've scanned previously, and either it matches or doesn't. That might be where the shortcoming is, is that it just can't stay up-to-date fast enough to stop new things that are coming in. It's an after-the-fact anti-virus. It doesn't do anything proactive. The virus has to hit the machine before it detects it. There is one thing that is deplorable with the product that I would change as soon as I found a better one. However, the reports are worthless. You go and look at a scan report and cannot get a log of machines. I can log into a console and see the files were scanned every day at 2:00 AM, and they all passed green or something was detected and removed. However, you have to go to the console. I don't have anything that I can send to my client on reports. What they give you is a bunch of bar graphs with no details. You can't drill down. It'll say two infections. However, it doesn't tell you what machines. You've just really got several different reports, and they're all just a bunch of graphs and wasted paper. There's nothing really substantial. The reports that I can use for client-facing, once a month, to say, "Here, we scanned all these workstations. Here are our results," don’t exist. They've got fake reports. I've screamed about that for years, and they just won't do anything. Therefore, I created my own little up-to-date or not ask fail-type report. I send that to them in place of a report directly from a product.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We are able to use BigFix through API connections to automate and reduce resources and time. The product's been great for us. It's increased the security posture ten-fold and it's increased our visibility across our endpoints enormously."
"The solution has many useful features. Its main advantage is simplicity - you can do everything from one console, regardless of the task. It supports many operating systems and is scalable to up to 250,000 clients."
"One of the biggest benefits BigFix has had for our organization is the ease and efficiency to perform many different tasks, across pillars and platforms, all from one pane of glass."
"BigFix has drastically reduced the maintenance window period to patch and reboot servers."
"Being able to intelligently create reports, gather data, export CSVs and give that to the leadership of some of the client groups that my team supports has helped my organization."
"We've had no issues with stability."
"It has improved my organization because we can automate a lot of tasks. We went from manually patching machines or doing our best and having very little visibility into it to us being able to set it and forget it and getting really good results on first-pass patching."
"It enables us to patch our systems quickly and within expectations and to increase our volume as needed. It has also helped us compress our patch sites. We used to do it monthly but now we do it weekly."
"It is stable and very easy to use."
"Microsoft Defender for Endpoint is beneficial because we are using Microsoft Windows and all the core solutions are made by Microsoft, such as the authentic platform, operating system, and antivirus protection. It is a heterogeneous environment. We had to use third-party solutions before and update everything separately. For example, the policy for antivirus. With Microsoft Defender for Endpoint, when Microsoft Windows receives updates it will update with it. This is one main advantage of this solution."
"User-friendly, offering safety and security."
"The features I have found most valuable are the ransomware and malware protection. The solution detects malware live and whenever it detects suspicious activity, it quarantines it."
"It is easy to use because it is already pre-installed in Windows 10. We don't have to do anything to configure it. You can also configure the firewall by using a group policy so that it can be easily adopted in an environment."
"Microsoft Defender for Endpoint is extremely stable."
"For threat-hunting, I'll put some threats in a test scenario. I've downloaded known viruses that are out in the public for testing. They're not really a virus but they've got a signature. Defender for Endpoint will automatically find those, quarantine them for me, and alert me to what it did. It gives me "automated eyes.""
"One feature I like the most is vulnerability management, which shows any vulnerable software or OS present in my environment. Microsoft Defender for Endpoint provides a complete overview and also recommends the steps to mitigate the vulnerabilities or threats. Most of the other antivirus or EDR solutions generally don't provide vulnerability management. It is an add-on that Microsoft Defender for Endpoint provides."
"Its ease of installation is valuable. It has been a low-resource tool and the continuous updates in the past have made it attractive from the standpoint of the trust level on the protection."
"There aren't any features that really stand out — I just want it to keep malware out of my system. To date, I haven't had any malware in my system."
"The ease of use of the centralized admin console is its best asset."
"It is very light. It is the only solution that can be installed on a machine that already has an antivirus. It is a pretty complete solution."
"It is very lightweight on the workstations, not slowing them down while still doing its job very well."
"Doesn't consume resources or affect the computer performance at all."
"I rate the initial setup phase a ten on a scale of one to ten, where one is difficult, and ten is easy."
"They have a lot of features integrated from way back, which shows that the product developers know exactly what they're doing."
 

Cons

"The solution should have some kind of a local caching methodology, where the patches can be taken locally into a localized relay server, and from there, the patch can be applied, so that there is not much usage of the network required."
"BigFix should improve its compatibility with other platforms, such as Linux."
"The look and feel of the system are old-fashioned."
"BigFix can improve the way machines report back to the console. In the external relay management environment, it has become more of a hybrid environment with most of the machines not being on-site. The need of having public-facing reporting items interconnected is becoming more and more crucial. In general, the reporting could use some enhancement."
"I would like to see much better web reporting because as it is now, it's convoluted, basic, it's not modern, and there are limitations to it."
"I remember doing restarts a few times. So, making sure that it is rock solid from an executable perspective is important."
"The reporting and dashboard parts have room for improvement."
"Around the scalability concern, I would like to see the ability to run teamed, clustered, or hierarchical root servers, in order to provide a more robust, high availability system. The single monolithic root server model does somewhat bother me."
"The UI for Microsoft Defender for Endpoint needs to be better. Integration with client dashboards is also lacking in this product, e.g. client dashboards shouldn't just be viewable from the cloud, because when the client's computer is offline, you won't be able to see the client dashboard."
"With the XDR dashboard, when you're doing an investigation and you're drilling down to obtain further details it tends to open many different tabs that take you away from your main tabs. You can end up having 10 tabs open for one investigation. This is another area for improvement because you can end up getting lost in the multiple tabs. Therefore, the central console can be improved so that it does not take you to several different pages for each investigation."
"The log searches for Microsoft Defender for Endpoint are pretty difficult to navigate. It needs a better UI or more intuitive search and filter mechanisms to make it easy to get through and filter through all the data logs."
"The onboarding and deployment could be more user-friendly, and there is room to grow in some of the reports. I don't want them to be oversimplified or overly complex, but there is room for improvement in the reporting it can do. It's relatively minor."
"The price, in general, could always be a little bit cheaper."
"It would be helpful if they included XDR features, on top of the EDR functionality."
"The second major area for improvement involves enhanced capabilities for different operating systems or platforms. That is, even though we have coverage for different operating systems or platforms such as Linux, we don't get all of the controls and enhanced capabilities that are available with Windows devices."
"They're in the process of pulling more things together. They can continue with the integrations and provide a better way of seeing the impact of security changes, especially on the endpoint side. Before we actually flip the switch, we should be able to see the impact of security changes on the business or business applications. It would prevent breaking any business applications."
"Webroot Business Endpoint Protection needs to focus on how they can widen their area of scope by not just being an antivirus tool anymore. The shortcoming in the customization area of the tool needs improvement."
"We need to know more details about how the virus interacted with the computer."
"It would be nice if it had a feature for automatically generating reports on the client end for device status, security status and backup information."
"Unified threat management (UTM) integration."
"Since they're dealing with multi-core environments now, the best option would be for them to enhance the product so that the product can automatically do an assessment on the machine."
"It would be great if there was a feature which would allow you to scan an individual file on an endpoint user's computer."
"It needs to improve the problems with the faster connection, and have a huge reduction in false positives."
"It doesn't do anything proactive. The virus has to hit the machine before it detects it."
 

Pricing and Cost Advice

"We have a subscription-based contract with BigFix."
"The tool's price continues to go up. The cost per endpoint can vary, ranging from approximately 30 to 80 dollars per year. Compared to other products, pricing is in the middle. You need to buy an additional database license, but most users already have it."
"I would stay with the Managed Virtual Server license model, which is a 1-to-1 license per OS whether it is virtual or physical."
"You are charged per server and per workstation when using BigFix. ManageEngine is a lot cheaper than BigFix. There are some additional costs, such as support."
"The price is reasonable, but our customers find it expensive."
"The license is subscription-based."
"It is too costly. It is one of the best tools, but because of pricing, not all clients support it. Its licensing is on a yearly basis."
"The price of BigFix could be lower. However, I am always seeking a lower price."
"The licensing costs for Microsoft Defender for Endpoint are reasonable."
"The pricing is competitive."
"It is an expensive solution. It would be nice if it could be included with the Microsoft Office package."
"We mostly use Microsoft products. We use Office 365, and we use Azure. We're also a Microsoft partner. So, the licensing was much cheaper for us, and at the same time, a lot of the features that we were looking for were included in Defender."
"Microsoft Defender is an expensive product in my country."
"Even if you are not registered as a not-for-profit, the offering that they have is definitely worth consideration. This is in the sense that the E5 stack just gives you so many benefits. You get your entire productivity suite through Microsoft 365 apps. You get all your security and identity protection. You get the Defender for Endpoint and Defender for Identity. You get the cloud access security broker as well. You get Azure Active Directory Premium P2, which gives you so many good things that you can configure and deploy. You don't have to configure them on day one, but you have access to so many different tools that will protect your data, security, endpoints, and identities that you could build out a security strategy 18 months long, and slowly work your way through it, based on what you have available to you through your license."
"Microsoft Defender for Endpoint can be costly as a standalone solution."
"The E5 license is the one that I recommend because it comes with Cloud App Security, which is a good thing to have on top of Microsoft Defender."
"The solution is pretty cheap, actually. At our level, which is at 2,500 endpoints, we're paying 87 cents an agent per month."
"If you purchase for clients, then you are the managing billing entity. It's better to either get a monthly subscription check from your clients, or to prepay for the year (so as to not keep cash in reserve to pay the bill each month) IMHO."
"The solution doesn't cost too much. It's about 30 Euros a year for each endpoint. It's pretty affordable for us and for many other companies."
"We evaluate other options using multiple choices, best value, management and functionality."
"The pricing is high."
"I can't recall the exact pricing, but I believe there is a monthly fee of $20-30 per user."
"Get a trial, then a multi-year license."
"With Webroot Business Endpoint Protection, I can select a yearly billing cycle."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
850,900 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
44%
Financial Services Firm
9%
Government
7%
Computer Software Company
6%
Educational Organization
24%
Computer Software Company
12%
Government
7%
Financial Services Firm
7%
Computer Software Company
17%
Real Estate/Law Firm
13%
Comms Service Provider
9%
Financial Services Firm
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about BigFix?
The most valuable features of the solution are Windows patching and the hardware and software inventory.
What is your experience regarding pricing and costs for BigFix?
The pricing is competitive, but not the most competitive.
What needs improvement with BigFix?
Implementing a business solution with BigFix has some issues, primarily concerning the time required for distribution...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
What do you like most about Webroot Business Endpoint Protection?
I haven't observed any of the instabilities in the solution. It is a stable solution.
What is your experience regarding pricing and costs for Webroot Business Endpoint Protection?
Webroot Business Endpoint Protection is probably on the cheaper side, so I would rate their pricing a one or a two ou...
What needs improvement with Webroot Business Endpoint Protection?
Webroot Business Endpoint Protection needs to improve its ability to detect threats. It does not do what it's adverti...
 

Also Known As

Tivoli Endpoint Manager
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
Webroot SecureAnywhere Business Endpoint Protection
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

US Foods, Penn State, St Vincent's Health US Foods, Sabadell Bank, SunTrust, Australia Sydney, Stemac, Capgemini, WNS Global Services, Jebsen & Jessen, CenterBeam, Strauss, Christian Hospital Centre, Brit Insurance, Career Education Corporation
Petrofrac, Metro CSG, Christus Health
Mytech Partners
Find out what your peers are saying about Microsoft, CrowdStrike, SentinelOne and others in Endpoint Protection Platform (EPP). Updated: April 2025.
850,900 professionals have used our research since 2012.