Cisco Secure Endpoint vs Symantec Endpoint Detection and Response comparison

Cisco and Broadcom are both solutions in the Endpoint Detection and Response (EDR) category. Cisco is ranked #13 with an average rating of 8.5, while Broadcom is ranked #30 with an average rating of 7.5. Cisco holds a 1.6% mindshare in EDR, compared to Broadcom’s 0.5% mindshare. Additionally, 96% of Cisco users are willing to recommend the solution, compared to 86% of Broadcom users who would recommend it.

Cisco Secure Endpoint

Read 49 Cisco Secure Endpoint reviews

3,929 Views
2,622 Comparison Views

96% willing to recommend

Symantec Endpoint Detection...

Read 30 Symantec Endpoint Detection and Response reviews

1,136 Views
673 Comparison Views

86% willing to recommend

Cisco Secure Endpoint

Symantec Endpoint Detection...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

Cisco Secure Endpoint and Symantec Endpoint Detection and Response are two leading products in the endpoint protection market. User reviews indicate that Cisco Secure Endpoint has the upper hand in pricing and support, while Symantec Endpoint Detection and Response is favored for its comprehensive features.

Features: Cisco Secure Endpoint is valued for its effective threat detection, real-time monitoring, and user-friendly integrations. Symantec Endpoint Detection and Response is highlighted for its deep forensic capabilities, robust threat intelligence, and comprehensive monitoring tools. Symantec's feature set is more extensive, making it a preferred choice for users prioritizing advanced features.

Room for Improvement: Users suggest Cisco Secure Endpoint could enhance its reporting functionality and reduce false positives. Additionally, improving user documentation would benefit Cisco. Symantec Endpoint Detection and Response could streamline update processes, reduce resource consumption, and improve integration with other tools. Symantec's impact on system performance is a significant concern for users.

Ease of Deployment and Customer Service: Cisco Secure Endpoint is praised for its straightforward deployment process and responsive customer support. Symantec Endpoint Detection and Response receives positive feedback for its deployment, though some users find it more complex. Symantec's customer service is well-regarded but not as highly as Cisco's. Thus, Cisco has the edge in deployment ease and customer service.

Pricing and ROI: Cisco Secure Endpoint offers competitive pricing with a strong ROI, appealing to budget-conscious users. Symantec Endpoint Detection and Response is seen as more expensive, but users deem its extensive features worth the higher cost. While Cisco is better for cost efficiency, Symantec provides greater value through its advanced functionalities.

To learn more, read our detailed Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response Report (Updated: April 2025).

Buyer's Guide

Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response

April 2025

Download the complete report

Helped 851,371 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cisco Secure Endpoint

Ranking in Endpoint Detection and Response (EDR)

13th

Average Rating

8.6

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (12th), Cisco Security Portfolio (5th)

Symantec Endpoint Detection...

Ranking in Endpoint Detection and Response (EDR)

30th

Average Rating

7.6

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of May 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of Cisco Secure Endpoint is 1.6%, down from 2.1% compared to the previous year. The mindshare of Symantec Endpoint Detection and Response is 0.5%, up from 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR)

Featured Reviews

Mark Broughton

Level 2 tech at a tech services company with 11-50 employees

Tighter integration with Umbrella and Firepower gave us eye-opening information

We were using a third-party help desk. One of the ways that they were fixing problems was to delete the client and then add the client back if there was an issue where the client had stopped communicating. Any improvement in the client communicating back to the server would be good, particularly for machines that are offline for a couple of weeks. A lot of our guys were working on a rotation where the machine might be offline for that long. They were also terrible about rebooting their machines, so those network connections didn't necessarily get refreshed. So, anything that could improve that communication would be good. Also, an easier way to do deduplication of machines, or be alerted to the fact that there's more than one instance of a machine, would be useful. If you could say, "Okay, we've got these two machines. This one says it's not reporting and this one says it's been reporting. Obviously, somebody did a reinstall," it would help. That way you could get a more accurate device count, so you're not having an inflated number. Not that Cisco was going to come down on you and say, "Oh, you're using too many licenses," right away. But to have a much more accurate license usage count by being able to better dedupe the records would be good. I also sent over a couple of other ideas to our technical rep. A lot of that had to do with the reporting options. It would be really nice to be able to do a lot more in the reporting. You can't really drill down into the reports that are there. The reporting and the need for the documentation to be updated and current would be my two biggest areas of complaint. Also, there was one section when I was playing with the automation where it was asking for the endpoint type rather than the machine name. If I could have just put in the machine name, that would have been great. So there are some opportunities, when it comes to searching, to have more options. If I wanted to search, for example, by a Mac address because, for some reason, I thought there was a duplication and I didn't have the machine name, how could I pull it up with the Mac address? When you're getting to that level, you're really starting to get into the ticky tacky. I would definitely put the reporting and documentation way ahead of that.

Read full review

YusufAhmed

Information Security Specialist at IHV-Nigeria

Easy to use and competitively priced

Honestly, the product needs to continue the way it is, and I feel that everything will be fine. I haven't had any reasons to complain about the product. The product doesn’t offer MDM functionality under its current licensing model. In the future, I want the product to offer MDM. It can allow me to manage my mobile device more efficiently and effectively. Currently, there is a need for a separate license to be added to Symantec Endpoint Detection and Response to be able to use the MDM part. If both are bundled up under the same license, the administration part can be made easier.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The product provides sandboxing options like file reputation and file analysis."

"The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."

"The simplicity of use is its most valuable feature. You can very clearly see things."

"The solution’s most valuable feature is malware protection."

"It used to take us a month to find out that something is infected, we now know that same day, as soon it is infected."

"It is extensive in terms of providing visibility and insights into threats. It allows for research into a threat, and you can chart your progress on how you're resolving it."

"Definitely, the best feature for Cisco Secure Endpoint is the integration with Talos. On the backend, Talos checks all the signatures, all the malware, and for any attacks going on around the world... Because Secure Endpoint has a connection to it, we get protected by it right then and there."

"It provides real-time visibility and control over endpoints, allowing its users to promptly respond to any security incidents and remediate any vulnerabilities."

More Cisco Secure Endpoint pros

"It is mostly used for malware detection and antivirus purposes."

"The solution is scalable."

"In Symantec, we have found that the most important feature is Application and Device Control."

"I've mainly found the antivirus and antispyware features valuable. The documentation is okay as well."

"The most valuable features are that it is easy to connect and global settings are good."

"The most valuable feature is that the same agent can act as the endpoint detection and response agent."

"There are times when Symantec Endpoint Detection and Response tags an executable as malicious when it is trying to get executed on the machine. In this case, it prevents the execution and it gives you a process view of things where you can look into what has happened and whether it is a genuine process trying to access some system activities, or it's a malicious one. Depending upon the process, it gives you a clear identification, and we can do the containment from the interface itself and isolate the machine from the network. The process review on network isolation is good."

"The most valuable features of this product include network isolation for machines and the ability to work with a consistent and defined set of virtual machines."

More Symantec Endpoint Detection and Response pros

Cons

"The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications."

"In the next version of this solution, I would like to see the addition of local authentication."

"It could be improved in connection with artificial intelligence and IoT."

"The Linux agent is a simple offline classic agent, and it doesn't support Secure Boot, which is important to have on a Linux machine. The Linux agent has conflicts with other solutions, including the Exploit Prevention system found in Windows servers. We didn't find a fix during troubleshooting, and Cisco couldn't offer one either. Eventually, we had to shut down the Exploit Prevention system. We didn't like that as we always want a solution that can fit smoothly into the setup without causing problems, especially where security is concerned. The tool also caused CPU spikes on our production machine, and we were seriously considering moving to another product."

"In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through."

"It's pretty good as it is, but its cost could be improved."

"One of the things that Cisco Secure Endpoint really needs is that it's not just Secure Endpoint, it's a point product, and I think we really need to move into solution-based selling, designing, and architecting. So that we're not worried about putting things on endpoints and selling 'x' amount of endpoints, but to provide a solution that covers all of the remote access and sell them as solutions that cover multiple things."

"Cisco Secure Endpoint is an expensive solution."

More Cisco Secure Endpoint cons

"I think we have experienced some technical issues because the company focuses mainly on bigger clients. Also, sometimes the solution fails to detect zero-day attacks, so that feature needs some enhancement because it is lacking compared to other solutions."

"A significant deterioration in customer support."

"The product doesn’t offer MDM functionality under its current licensing model."

"The GUI could be better."

"I would like to see better scanning capabilities."

"It should be easier to deploy Symantec's client for end-users."

"The network forensics feature could be improved."

"They need to improve their cloud presence."

More Symantec Endpoint Detection and Response cons

Pricing and Cost Advice

"There are a couple of different consumption models: Pay up front, or if you have an enterprise agreement, you can do a monthly thing. Check your licensing possibilities and see what's best for your organization."

"It is quite cost-effective. I would rate it ten out of ten."

"Because we do see the value of what it's bringing, I think they have priced it well."

"The pricing and licensing are reasonable. The cost of AMP for Endpoints is inline with all the other software that has a monthly endpoint cost. It might be a little bit higher than other antivirus type products, but we're only talking about a dollar a month per user. I don't see that cost as being an issue if it's going to give us the confidence and security that we're looking for. We have had a lot of success and happiness with what we're using, so there's no point in changing."

"Licensing fees are on a yearly basis and I am happy with the pricing."

"In our case, it is a straightforward annual payment through our Enterprise Agreement."

"My company does make annual payments towards the licensing costs of the solution. Cisco Secure Endpoint is a little bit expensive."

"The pricing and licensing of the security solutions of Cisco are very good in comparison with the competitors, but sometimes, it's difficult to see all the discounts and other kinds of things. So, you have to be careful, but the pricing is good."

More Cisco Secure Endpoint pricing and cost advice

"We pay around $100,000 for 5000 licenses every year."

"It is an expensive solution."

"The more devices we have the more expensive it becomes, which is where the challenge is."

"The product is cheap."

"Of late, because of the Broadcom purchase, its price has been increasing."

"It's a yearly subscription."

"Symantec Endpoint Detection and Response is expensive."

"We have a yearly subscription, and the pricing is fair."

More Symantec Endpoint Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

851,371 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Government

Financial Services Firm

Manufacturing Company

Computer Software Company

15%

Financial Services Firm

13%

Manufacturing Company

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Cisco Secure Endpoint?

The product's initial setup phase was very simple.

See all answers

What is your experience regarding pricing and costs for Cisco Secure Endpoint?

Cisco is aggressive in pricing, making it competitive and sometimes even cheaper than other good products like CrowdStrike, Microsoft Defender, or SentinelOne.

See all answers

What needs improvement with Cisco Secure Endpoint?

Cisco Secure Endpoint lacks features like DLP which other vendors offer. XDR is new, so integration capabilities with third-party tools need improvement. The forensic capabilities need enhancement,...

See all answers

What do you like most about Symantec Endpoint Detection and Response?

The security is good.

See all answers

What is your experience regarding pricing and costs for Symantec Endpoint Detection and Response?

I am not aware of the pricing details, as that falls under the management's responsibility.

See all answers

What needs improvement with Symantec Endpoint Detection and Response?

There are several areas where Symantec Endpoint Detection and Response can improve, including shell features, web control, asset management, and device control. Specifically, the application contro...

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cisco Secure Endpoint

Compared 15% of the time

CrowdStrike Falcon vs Cisco Secure Endpoint

Compared 12% of the time

SentinelOne Singularity Complete vs Cisco Secure Endpoint

Compared 6% of the time

Cortex XDR by Palo Alto Networks vs Cisco Secure Endpoint

Compared 5% of the time

More Cisco Secure Endpoint Competitors

Kaspersky Endpoint Detection and Response Expert vs Symantec Endpoint Detection and Response

Compared 20% of the time

Kaspersky Endpoint Security Cloud vs Symantec Endpoint Detection and Response

Compared 12% of the time

Trend Vision One vs Symantec Endpoint Detection and Response

Compared 9% of the time

Cortex XDR by Palo Alto Networks vs Symantec Endpoint Detection and Response

Compared 8% of the time

Trellix Endpoint Security (ENS) vs Symantec Endpoint Detection and Response

Compared 8% of the time

More Symantec Endpoint Detection and Response Competitors

Product Reports

Buyer's Guide

Cisco Secure Endpoint

May 2025

Download Cisco Secure Endpoint product report

Buyer's Guide

Symantec Endpoint Detection and Response

April 2025

Symantec Endpoint Detection and Response report

Download Symantec Endpoint Detection and Response product report

Also Known As

Cisco AMP for Endpoints

No data available

Overview

Cisco Secure Endpoint is a comprehensive endpoint security solution that natively includes open and extensible extended detection and response (XDR) and advanced endpoint detection and response (EDR) capabilities. Secure Endpoint offers relentless breach protection that enables you to be confident, be bold, and be fearless with one of the industry’s most trusted endpoint security solutions. It protects your hybrid workforce, helps you stay resilient, and secures what’s next with simple, comprehensive endpoint security powered by unique insights from 300,000 security customers and deep visibility from the networking leader.

Cisco Secure Endpoint was formerly known as Cisco AMP for Endpoints.

Reviews from Real Users

Cisco Secure Endpoint stands out among its competitors for a number of reasons. Two major ones are its ability to enable developers to easily secure their endpoints with one single operation using its management console and its advanced alerting techniques.

Tim C., an IT manager at Van Der Meer Consulting, writes, "The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."

Wouter H., a technical team lead network & security at Missing Piece BV, notes, "Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."

Cisco

Symantec Endpoint Detection and Response (EDR) is a powerful security solution designed to help organizations proactively detect, investigate, and mitigate advanced threats across their endpoint environments. As part of Broadcom's cybersecurity portfolio, Symantec EDR provides comprehensive visibility into endpoint activities, enabling security teams to quickly identify and respond to threats that evade traditional defenses.

Symantec EDR leverages machine learning, behavioral analysis, and global threat intelligence from Symantec's vast network to detect sophisticated threats, including zero-day attacks, ransomware, and advanced persistent threats (APTs). This allows organizations to identify malicious activities early and respond swiftly to mitigate potential damage. The solution offers automated response options that enable security teams to contain and remediate threats quickly.

Symantec EDR provides detailed forensic capabilities, allowing security analysts to dive deep into endpoint data, investigate incidents thoroughly, and understand the scope and impact of attacks. Features such as timeline analysis, incident graphing, and the ability to isolate endpoints enhance investigative efforts and support effective remediation strategies.

With its centralized management console, Symantec EDR offers visibility across the entire endpoint environment, regardless of the operating systems or whether endpoints are on-premise or remote. Symantec EDR seamlessly integrates with other Symantec security solutions, enhancing its detection capabilities and enabling a unified approach to threat management. Its scalable architecture ensures that businesses of all sizes can benefit from its advanced security features without compromising performance.

Quickly discover and resolve threats with deep endpoint visibility and superior detection analytics, reducing mean time to remediation. Overcome cyber security skills shortages and streamline SOC operations with extensive automation and built-in integrations for sandboxing, SIEM, and orchestration.

Fortify security teams with the unmatched expertise and global scale of Symantec Managed Endpoint Detection and Response services.
Roll out Endpoint Detection and Response (EDR) across Windows, macOS, and Linux devices using Symantec Endpoint Protection (SEP)-integrated EDR or a dissolvable agent.

Broadcom

Sample Customers

Heritage Bank, Mobile County Schools, NHL University, Thunder Bay Regional, Yokogawa Electric, Sam Houston State University, First Financial Bank

Information Not Available

Buyer's Guide

Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response

April 2025

Free Report: Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response

Find out what your peers are saying about Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response and other solutions. Updated: April 2025.

DOWNLOAD NOW

851,371 professionals have used our research since 2012.

See our Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response report.

See our list of best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.