Try our new research platform with insights from 80,000+ expert users

Check Point SandBlast Network vs Microsoft Defender for Endpoint comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 1, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Check Point SandBlast Network
Ranking in Advanced Threat Protection (ATP)
10th
Average Rating
8.4
Reviews Sentiment
7.4
Number of Reviews
37
Ranking in other categories
No ranking in other categories
Microsoft Defender for Endp...
Ranking in Advanced Threat Protection (ATP)
2nd
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
194
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (5th)
 

Mindshare comparison

As of May 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Check Point SandBlast Network is 5.7%, up from 5.4% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 9.2%, down from 11.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP)
 

Featured Reviews

GaneshKhutwad - PeerSpot reviewer
Provides advanced threat prevention and utilizes geographic-based policies to mitigate attacks
Check Point offers three types of support: Gold, Platinum, and Diamond. The level of support you receive should be based on the criticality of the issue, not solely on your client's support tier. While there are established support levels, I have experienced instances where the support provided was not categorized as Gold, Platinum, or Diamond but rather a standard support level. In such cases, the response times were slower, and getting support personnel on the call was more difficult.
AnuragSrivastava - PeerSpot reviewer
Provides detailed visibility into threats but the ability to add exceptions needs improvement
One major item for improvement is the ability to add exceptions. We can add some exceptions, but not at the level we need to. The second major area for improvement involves enhanced capabilities for different operating systems or platforms. That is, even though we have coverage for different operating systems or platforms such as Linux, we don't get all of the controls and enhanced capabilities that are available with Windows devices. Reporting could also be improved because, at present, we get limited results at times. For example, in an environment with more than 100,000 devices, you may just get 10,000 results when you run a report.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most efficient and protective characteristics of Check Point's SandBlast solution are that we can see a lot of this protection at the network and mail levels."
"The most valuable feature of Check Point SandBlast Network is the sandboxing of PDF and Microsoft system files."
"It is a stable solution."
"In terms of the scalability, it's expandable across the cloud."
"The most valuable thing about this product is that it keeps the network secure against zero-day threats."
"It has caught some harmful attachments and downloads."
"The Check Point SandBlast Network gives us incredibly good features."
"Preventing zero-day threats and extracting potential threats from incoming files with Threat Extraction is the most valuable feature for us."
"In my opinion, the most valuable aspects are the reporting analytics and integration with Sentinel. Defender does an excellent job of correlating the different entities that comprise threat analysis, analytics data, and log analytics. It helps to piece together investigations into any exploit or malicious activity within a specific tenant. AI and analytics tools are probably the most valuable components."
"The features I have found most valuable are the ransomware and malware protection. The solution detects malware live and whenever it detects suspicious activity, it quarantines it."
"Defender is stable. The performance is good."
"It shows us the risky sign-ins, and if a user's password has been compromised."
"It is a straightforward setup."
"Real-time detection and cloud-based delivery of detections are highly efficient."
"It integrates very well with all Windows workstations or other Microsoft Endpoint products. It also works quite well. So far, I have not had any issue that hasn't been sorted out. It doesn't use too many resources, so you don't have to install different things."
"The solution provides protections and reports about strange behavior and automatically blocks some of it. I love the way that statuses are represented."
 

Cons

"I would like to see some speed improvements, e.g., how quickly you can get through all the menus. It crashes sometimes because we push so much through it. Therefore, I would like to see more small things behind the scenes, such as, back-end stability in terms of the management application."
"We would like to see this solution reach mobile devices more efficiently, through apps or more specific products."
"We have found a need for the application to be a bit more elastic, bringing it to SAS services and not IAS."
"Check Point SandBlast Network can be improved by adding more integration capabilities, such as integration with third-party firewalls, third-party EDR solutions, and SIEM."
"The initial setup was complex because of the lack of information from the consultant."
"The Threat Emulation software blade significantly affects the performance of the NGFWs, we have a significant increase in the CPU and memory consumption."
"When you have to scan emails that come with attachments, it takes a long time to examine them, which causes other emails not to be scanned, which can cause some danger to our organization."
"Sometimes, Check Point Sandblast requires more resources, which impacts network performance if it has been deployed with limited resources."
"The profiling method currently in use is not very user-friendly and has ample scope for improvement."
"There is a need for improvement in reducing false positives."
"There are some areas in the proactive threats that are just overwhelming the SOC, so we've had to turn those off until we can figure out how to filter out the false positives."
"With increase of cyber threats and cybersecurity issues, I would recommend that the product be developed like an AI product with more features which can counter any threat in the coming eras."
"The solution could improve by providing more integration."
"The major area for improvement is the integration with a managed service provider. We use Microsoft partners to help govern the platform, and as part of an alliance, we want to gather data from each tenant and combine them for a complete view. This process has been complicated, though it has gotten better."
"Defender for Endpoint is complex, and the documentation is detailed. At the same time, it's hard to navigate sometimes."
"It is currently more suitable for end-users rather than enterprises with lots of other processes and third-party tools. It needs improvement on that front. We had many issues while integrating it with our enterprise solutions, such as Splunk, and third-party tools. It provides everything via APIs. Other vendors provide integration with third-party tools, but Microsoft doesn't do that. It is also logging too much and is not serialized from the process aspect. It has all the data, but it is not in a proper format or not properly indexed, which doesn't make it easier for enterprises to use this data. Other vendors provide troubleshooting information that can be used to troubleshoot issues, but Microsoft doesn't provide anything like that."
 

Pricing and Cost Advice

"The product's cost is high."
"We would like to try the Threat Extraction blade, but you need to buy a license. Check Point is expensive. I would like to buy things, but I would need the funding."
"We have seen ROI."
"The cost of Check Point SandBlast Network is annually, and there is only a standard license."
"Choosing the correct set of licenses is essential because, without the additional software blade licenses, the Check Point gateways are just a stateful firewall."
"The pricing is quite effective, not excessively high. On a scale of one to ten, where ten is the highest price, I rate the pricing a nine."
"The cost is not significantly high and it can be negotiated during any purchase of NGFW."
"I think the overall cost for introducing Check Point with SandBlast was reasonable and competitive in the market."
"It is built into Windows 10. If our clients are using Microsoft Defender, the cost goes away for them."
"It isn't cheap, but it's reasonable and fair."
"The E5 license is the one that I recommend because it comes with Cloud App Security, which is a good thing to have on top of Microsoft Defender."
"The solution is free."
"Microsoft Defender for Endpoint is included with a Microsoft E5 license."
"The solutions price could be cheaper."
"It is so expensive. It isn't cheaper than McAfee or other solutions."
"Microsoft Defender for Endpoint is cost-effective because there's one unified license, and with this unified license, you get the capabilities for your cloud applications, servers, and endpoints as well. Therefore, it saves us a lot of money because the cost with other solutions is for just one piece of OS or maybe an urban environment. The licensing process is not complex as well."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
850,028 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
14%
Government
11%
Energy/Utilities Company
6%
Educational Organization
25%
Computer Software Company
12%
Government
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Check Point SandBlast Network?
The solution can detect and prevent attacks that may be encrypted.
What needs improvement with Check Point SandBlast Network?
The cost is a little bit high-end, and you need to get precise performance metrics in order to get the correct size. Improvements are required in both areas of the tool.
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
 

Also Known As

No data available
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
 

Interactive Demo

 

Overview

 

Sample Customers

Edenred, State Transport Leasing Company (STLC), Edel AG, Laurenty, Conseil Départemental du Val de Marne, Koch Media
Petrofrac, Metro CSG, Christus Health
Find out what your peers are saying about Check Point SandBlast Network vs. Microsoft Defender for Endpoint and other solutions. Updated: April 2025.
850,028 professionals have used our research since 2012.