Try our new research platform with insights from 80,000+ expert users

BlackBerry Cylance Cybersecurity vs CrowdStrike Falcon vs Symantec Endpoint Security comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of May 2025, in the Endpoint Protection Platform (EPP) category, the mindshare of BlackBerry Cylance Cybersecurity is 1.1%, down from 1.4% compared to the previous year. The mindshare of CrowdStrike Falcon is 10.9%, up from 9.3% compared to the previous year. The mindshare of Symantec Endpoint Security is 4.0%, down from 4.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP)
 

Featured Reviews

Sooraj Makkancherrry - PeerSpot reviewer
Doesn't have daily updates, which is important for healthcare IT
I face challenges with the exclusion policy - it still scans folders we told it not to, causing issues. When we contact support, they tell us to update the latest agent, but we can't do that immediately due to medical device protocols and validation testing. I wish support would try to understand our issues better instead of giving this standard response. The machine learning feature they use often tells us to upgrade the agent or add things to the exclusion list, which isn't unacceptable. It's a very good and new technology as a tool and antivirus. But sometimes, it doesn't work properly with our medical devices and products, quarantining files it shouldn't even after we add them to exclusions. This is tricky for us.
Chintan-Vyas - PeerSpot reviewer
Easy to set up with good behavior-based analysis but needs a single-click recovery option
Most organizations are currently looking for a scheduled scan to meet their compliance needs. Other players like Symantec and Trend Micro, FireEye, et cetera, are still providing the signature-based regular scheduled scans also, which is not available in CrowdStrike. That is one parameter that we feel should be there in CrowdStrike. CrowdStrike is only working on the dynamic or the files under execution. CrowdStrike is not scanning the static files. The product could be more accurate in terms of performance. We'd like to have a single-click recovery option. With some machines getting corrupted by malware, we need an easy way to start with a blank slate if things happen. That one feature should be there in the EDR.
Hakeem_Abdulkareem - PeerSpot reviewer
The solution has given us visibility into compliance within our whole system and helped us ensure everything is updated
Symantec's application security module needs some improvement. You need to create a lot of fingerprints for application security. For instance, let's say I have different brands of ATMs in my environment, like Wincor and NCR. I use GRG to deploy an application control to whitelist some applications. I have to get the exact image of the different models of ATMs. When I tested in the past, some machines would not connect to the server without that. Only the approved software on the ATM should run. Anything outside that should not even come up at all. We did this so that an outside person doesn't introduce malicious software to the ATM. That's the essence of locking down with application control. Using Symantec for application control has been hectic, so I use Carbon Black to do the lockdown. Checking that data security will work fine with Carbon Black. Carbon Black worked fine. Setting up approval in Carbon Black works differently than Symantec. In Symantec, we first need the fingerprints of the applications running underneath. Before setting up Carbon Black, you first install the agent, allowing it to learn the environment. It will analyze all the software's behavior and provide recommendations for what should be allowed. It's more straightforward, whereas configuring application control in Symantec is a bit cumbersome.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It provides good insight into the programs, applications, or websites that may need attention."
"I rate the tool a ten out of ten when it comes to the ease of use or management part."
"The most functional item that we use is the process to turn off the false flags that it causes."
"The platform's most valuable features are the malware detection capabilities."
"The most valuable feature of CylancePROTECT is the support."
"The solution is stable."
"CylancePROTECT is a fairly decent antivirus."
"The solution is easy to deploy."
"I like the Overwatch feature the most."
"Since we deployed CrowdStrike, the network has become much calmer, and we now understand the sources of infections, which helps us prevent them from spreading."
"The most valuable feature is the indicator of compromise, which show you what file was either quarantined or removed."
"The managed services are distinguished, responsive, dynamic, flexible, and assertive when taking action."
"Probably the most valuable thing to me is the real-time response piece. The fact that I can connect to an endpoint as long as it is on the Internet, no matter where it is globally. I can remove files from the endpoint, drop files on the endpoint, stop processes, reboot it, run custom scripts, and deploy software. Pretty much no other tool can do all that."
"CrowdStrike displays a threat score when it detects an infection. This is helpful because not all detections are the same. It will classify them as ransomware, malware, phishing, etc. This feature helps us prioritize and cross-check with other EDR tools."
"We have a small IT Team, and this allows us to get sleep at night, knowing that someone else is taking care of any incidents that occur."
"The solution can scale easily."
"It's a good proxy to control the user's access to the website."
"The solution is easy to use."
"The initial setup is very simple and straightforward."
"Some of the features that were important were a built-in firewall and device control."
"This solution has helped us because it is really useful for blocking all kinds of viruses."
"It is a scalable product and is average stability-wise."
"I have found the central control console the most valuable feature."
"One important feature is the EDR function, necessary for many public customers due to upcoming laws in Germany, which is available through Symantec Endpoint Security Complete."
 

Cons

"The security scripting needs improvement. It needs deeper security for scripting."
"The company that sells us the licenses sometimes doesn't know how to do certain things."
"Having worked with SentinelOne, Cylance is good, however, it probably needs to add a feature similar to SentinelOne's rollback functionality. With this feature, if you get infected, with a click, you can go back to the pre-infection state. If Cylance could add this functionality to their offering as well, that would be ideal."
"It could have integration with industrial base HMIS or Human Machine Interfaces Solutions. This is the industrial environment where you have a control center for all the automation that's happening, whether it is oil, gas, or chemical manufacturing. They often have to set up a computer at the back and watch the other stuff to get alerts. In these autonomous or on-premises environments, they often don't have access to email readily. Integration with other industrial solutions, such as HMIS, will allow them to communicate and get an alert that something has been found. This way, they can react to it sooner than having somebody watch the screen and keep checking the screen. Rockwell has its own suite. Similarly, Honeywell has its own suite. There's also an independent HMI/historian solution provider out there called VTSCADA. We actually get asked if we can get it to show up on a screen, which is difficult. Getting those alerts to work within an industrial environment would be a huge plus."
"The process of whitelisting a script that you want to be able to run can be a little bit difficult, or awkward."
"It's a good solution but some features just need to be updated."
"The price for this EPP platform is expensive and could be improved."
"Additionally, their channel management has been lacking, with a notable disregard for small and medium-sized businesses, focusing primarily on large enterprises and very large MSPs."
"It does take more time to scan than other solutions."
"The support for different OS versions needs improvement because sometimes due to business conditions, updating our OS is impossible."
"The ability to receive text alerts natively in the console would be kind of cool."
"We have had to open a case with the technical support to get some issues and bugs resolved."
"The new interface, the UI, seems a bit messy."
"Crowdstrike Falcon XDR can improve the integration. There are some locks on the cloud to on-premise integrations."
"CrowdStrike Falcon could improve by adding manual scanning or serverless scanning. It is not available at this time."
"In a future release, I would like to see more integrations for data breaches and security features."
"Technical support could be more responsive."
"This solution needs better compatibility with services and applications."
"We were having a problem in Version 14, where the client machines used to go into the health state and once it restarted, and never came back again."
"If a machine is infected by ransomware, it's hard to recover the data. We don't have any data on the client, so we're not overly concerned about that. Still, it would be nice to have this feature if there are any future problems."
"One suggestion I have for both regular and mobile would be to collect all the information about installed software, such as versions, and give that information to the manager to help with software management. That would be a huge advantage for everyone who administers these tools."
"I think the CPU dependence should be enhanced."
"The whitelisting feature does not work as expected."
"It needs to die. In my opinion, Symantec was a really great security company, 10, 15 years ago. They went out, they bought all the great tools and then they never did anything with them. So they've just fallen behind and there's nothing that's going to work now to bring them back up the date that's going to regain user confidence."
 

Pricing and Cost Advice

"My company is on a yearly CylancePROTECT subscription. Price-wise, the solution is slightly expensive, so I'd rate it as eight out of ten."
"The price is reasonable for us at the moment. I rate the overall solution an eight out of ten."
"The solution's pricing is around the same as most EDRs but slightly behind some of the major ones."
"Review closely how many endpoints you actually need before buying into a pricing level. Deal and deal with the VAR of your choice."
"The initial end-point cost may seem a little high (~$55/device/year) but when you look at the total peace of mind that the solution provides, with no reboots for updates, and negligible performance impact, it is well worth it."
"We would just add more if there are new users, but right now you just need one license for per user."
"The licensing part of the product is too expensive compared to other solutions in the market."
"The solution provides me with competitive pricing."
"CrowdStrike Falcon is more expensive than other EDR solutions with similar features."
"We pay between $30-50 per user for a yearly license, which is more expensive than SentinelOne or Bitdefender. However, CrowdStrike gives better value for money."
"It's an expensive solution but you get a very good product for the price. Compared to other products, SentinelOne is definitely cheaper and the Microsoft E5 package is probably more expensive. Not many companies are willing to purchase CrowdStrike Falcon in Turkey due to the cost, but the market is changing."
"The price is fixed with no room for negotiation."
"The pricing is definitely high but you get what you pay for, and it's not so high that it prices itself out of the market."
"We bought a very small number of licenses, then ran it for a year. We bought a 100 licenses for a year, so we didn't actually do a proof of concept. We just bought them. Then, the next year, we bought 10,000 licenses."
"It is an expensive product, but I think it is well worth the investment."
"The pricing on CrowdStrike is per license. It was about $42 per seat yearly."
"We pay on a yearly basis..."
"Pricing and licensing for our country is very good. It's not that expensive and the endpoint security is very good. It's not as cheap as some others, but they are not as good."
"It could be cheaper."
"Each annual client license is around 1200 or 1600 INR."
"I rate the product's pricing a six out of ten."
"The pricing is as per the environment. If all the features are there, there will be a cost for them. There were no additional costs for me. Support and other things were included in the pricing."
"The pricing is a little bit more expensive than other competitors, if you compare it to Kaspersky, for example, or McAfee."
"When comparing this solution to others in the current market it is expensive."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
850,236 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Manufacturing Company
11%
Government
8%
Financial Services Firm
7%
Computer Software Company
15%
Financial Services Firm
10%
Manufacturing Company
9%
Government
7%
Computer Software Company
15%
Financial Services Firm
12%
Manufacturing Company
10%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Blackberry Protect?
It is a good endpoint solution. It is very easy to manage and detect the threat immediately. It will take the necessa...
What is your experience regarding pricing and costs for Blackberry Protect?
The price is reasonable for us at the moment. I rate the overall solution an eight out of ten.
What needs improvement with Blackberry Protect?
I face challenges with the exclusion policy - it still scans folders we told it not to, causing issues. When we conta...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
Which is better - Cortex XDR or Symantec End-User Endpoint Security?
Aqua Security is easy to use and very manageable. Its main focus is on Kubernetes and Docker. Security is a very valu...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...
What do you like most about Symantec End-User Endpoint Security?
Symantec have everything – documentation, videos, data sheets.
 

Also Known As

Blackberry Protect
CrowdStrike Falcon, CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface
Symantec EPP, Symantec Endpoint Protection (SEP)
 

Overview

 

Sample Customers

Panasonic, Noble Energy, Apria Healthcare Group Inc., Charles River Laboratories, Rovi Corporation, Toyota, Kiewit
Information Not Available
Audio Visual Dynamics, Red Deer Advocate, Asia Pacific Telecom Co. Ltd., Kibbutz Ein Gedi, and AMETEK, Inc.
Find out what your peers are saying about Microsoft, CrowdStrike, SentinelOne and others in Endpoint Protection Platform (EPP). Updated: April 2025.
850,236 professionals have used our research since 2012.