CrowdStrike Falcon vs Microsoft Defender XDR comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary
Updated on Apr 23, 2023

We performed a comparison between Microsoft 365 Defender and CrowdStrike Falcon based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Microsoft 365 Defender’s setup is described as challenging at points, with users noting the need for more flexibility during the process. CrowdStrike Falcon’s deployment is described as very straightforward.
  • Features: Microsoft 365 Defender features an advanced threat hunting tab, allows for real-time threat management, and has an informative compliance dashboard. However, its limited integration abilities with third-party applications and vulnerability management need improvement. CrowdStrike Falcon has always-running real-time threat response capabilities, a self-explanatory UI, and endpoint monitoring. Its offline scanning ability, as well as the correlation of data in the search algorithms, need to be improved.
  • Pricing: The pricing of both solutions is described as reasonable and worthwhile, with users of CrowdStrike Falcon noting that its modular licensing can potentially be a bit expensive for smaller enterprises.
  • Service and Support: While the support teams of both solutions are generally highly rated, some users noted that the services can occasionally be subpar, depending on the agent their ticket is assigned to.
  • ROI: Users of both solutions see an ROI due to decreased detection time and reduced man-hours in incident resolving.

Comparison results: Based on the parameters we compared, CrowdStrike Falcon comes out ahead of Microsoft 365 Defender. While both offer threat-hunting and response features, 365 Defender’s inflexible third-party integration, as well as its lack of support at times leave room for improvement.

To learn more, read our detailed CrowdStrike Falcon vs. Microsoft Defender XDR Report (Updated: March 2024).
765,234 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The product's initial setup phase is very easy.""Fortinet is very user-friendly for customers.""The price is low and quite competitive with others.""The main thing is that I feel safe. Because the processes that have been used to get a handle on the attackers are much better than other competitors""Additionally, when it comes to EDR, there are more tools available to assist with client work.""Exceptions are easy to create and the interface is easy to follow with a nice appearance.""The stability is very good.""It is a scalable solution...The initial setup of Fortinet FortiEDR was straightforward."

More Fortinet FortiEDR Pros →

"CrowdStrike Falcon has done an excellent job at detecting breaches. It has allowed us to stay in business and keep our systems up.""Overall, what I found most valuable in CrowdStrike Falcon is its good mechanism. It also has a good reporting feature. CrowdStrike Falcon is an invaluable tool because, through it, you can take quick action, for example, when an OS is missing specific patches.""The most valuable feature is that we don't need to re-image machines as much as we had to.""The OverWatch is the most valuable feature to me. It's a 24x7 monitoring service, and when they see anything suspicious in my environment, they will investigate.""Among CrowdStrike Falcon's most valuable capabilities are its UEBA and SOAR functionalities, along with its seamless integration with any other SIEM solution.""I like the detection rates of mobile threats.""The initial setup is a very fast process.""It provides very good protection and the ability to crosscheck environments."

More CrowdStrike Falcon Pros →

"The unified view of the threat landscape on a central dashboard is the most valuable feature.""I have found the ability to delete unwanted threats beneficial.""The most valuable feature is the DLP because that's where we can have an added data protection layer and extend it not just to emails but to the documents that users are working on. We can make sure that sensitive data is tagged and flagged if unauthorized parties are using it.""From the perspective of Microsoft 365 XDR, the main benefit is a single, centralized dashboard offering the holistic visibility organizations crave.""It's a great threat intelligence source for us, providing alerts for things it detects on the network and on the machines. We've used it often when there is a potential incident to see what was done on a computer. That works quite nicely because you can see everything that the user has done...""The most valuable features of Microsoft 365 Defender are the combination of all the capabilities and centralized management.""Microsoft 365 Defender's most valuable feature is the ability to control the shadow IP.""There is also one dashboard that shows us the status of many controls at once and the details I can get... It gives a great overview of many areas, such as files, emails, chats, and links. Even with the apps, it gives you a great overview. In one place you can see where you should look into things more deeply..."

More Microsoft Defender XDR Pros →

Cons
"ZTNA can improve latency.""We find the solution to be a bit expensive.""I would like the solution to extend beyond endpoint protection and include other attack surfaces such as other network components.""The solution's installation from a central installation server could be improved because the engineers had a little bit of trouble getting it installed from a central location.""There's room for improvement in the quick response time and technical support for integration issues, especially when dealing with multiple vendors.""Integration with Azure and SaaS provisioning tools could improve Fortinet FortiEDR.""It takes about two business days for initial support, which is too slow in urgent situations.""We've encountered challenges during API deployment, occasionally resulting in unstable environments."

More Fortinet FortiEDR Cons →

"The overall cost of CrowdStrike Falcon could be reduced.""It would be nice if they did have some sort of Active Directory tie-in, whether that be Azure or on-prem. Sometimes, it is difficult for us to determine if we are missing any endpoints or servers in CrowdStrike. We honestly don't have a great inventory, but it would be nice if CrowdStrike had a way to say this is everything in your environment, Active Directory-wise, and this is what doesn't have sensors. They try to do that now with a function that they have built-in, but I have been unsuccessful in having it help us identify what needs a sensor. So, better visibility of what doesn't have a sensor in our environment would be helpful.""For CrowdStrike to work, all the machines need to have an internet connection. This makes it challenging to assist customers without an internet connection. We would like to have a mechanism or relay to make this possible.""The biggest issue with Falcon as a standalone product is it doesn't have very much reporting.""We can do a threat analysis of any machine at any time, but that threat analysis is very limited.""I would like to see the machine learning feature enhanced.""The solution needs to have integration with on-premises security devices and security facilities. That means all the security products, including the perimeter firewall, the DMZ.""CrowdStrike Falcon needs to improve their host management system."

More CrowdStrike Falcon Cons →

"The capability to not only thwart attacks but also to adapt to evolving threats is crucial.""The dashboard should be easier to use. There is also improvement needed in the reporting when it comes to exporting or scheduling reports.""While the XDR platform offers valuable functionalities, it falls short of other solutions in its ability to deliver a cohesive identity experience.""The onboarding and offboarding need improvement. I work with other vendors as well, and they have an option to add a device or remove a device from the portal, whereas with Microsoft 365 Defender, we need to do that manually. However, once you do that, everything can be controlled through the portal, but getting the device onboarded and offboarded is currently manual. If we have an option to simply remove a device from the portal or get a device added from the portal, it would be more convenient. The rest of the features are similar. This is the only area where I found it different from others. I would also like to be able to simply filter with a few of the queries that are already there.""In the Microsoft Azure Portal, in Active Directory, if there is anything on the user it will provide you with the information, but you still have to go through it a bit. And sometimes, I have experienced difficulties in understanding the information, especially because the synchronization between Microsoft Intune and the devices that are connected to the user in Azure Active Directory takes a lot of time.""A simple dashboard without having to use MS Sentinel would be a welcome improvement.""The Defender agent itself is more compatible with Windows 10 and Windows 11. Other than these two lines, there are so many compatibility issues. Security is not only about Microsoft. The core technical aspects of it are quite good, but it would be good if they can better support non-Microsoft solutions in terms of putting the agents directly into VMware and other virtualization solutions. There should be more emphasis on RHEL and other operating systems that we use, other than Windows, in the server category.""At times, when we have an incident email and we click on the link for that incident, it opens a pop-up, but there is nothing. It has happened a couple of times."

More Microsoft Defender XDR Cons →

Pricing and Cost Advice
  • "I know it is tough to get big budget additions up front, but I highly recommend deploying environment wide and adding the forensic service."
  • "There are no issues with the pricing."
  • "The price is comprable to other endpoint security solutions."
  • "The pricing is typical for enterprises and fairly priced."
  • "I'm not familiar with pricing, but it looks a bit costly compared to other vendors I think."
  • "The pricing is good."
  • "I would rate the solution's pricing an eight out of ten."
  • "The hardware costs about €100,000 and about €20,000 annually for access."
  • More Fortinet FortiEDR Pricing and Cost Advice →

  • "The pricing will depend upon your volume of usage."
  • "I would like them to further reduce the price, because it is quite pricey at the moment."
  • "Purchasing the product through the AWS Marketplace is just a click away. Since we were using the on-premise version of the product, we continued on the cloud by purchasing it through the AWS Marketplace."
  • "I do not have experience with the cost or licensing of the product."
  • "The other administrator and I can log in to check the exact details of what happened, what was running, and what caused the detection. We know exactly what was happening on the end users PC and we can tell if it's something that we actually need or something that's malicious."
  • "We are at about $60,000 per year."
  • "This solution has a very competitive price."
  • "Our company pays approximately US$ 65,000 annually for 900 machines."
  • More CrowdStrike Falcon Pricing and Cost Advice →

  • "The solutions price is fair for what they offer."
  • "The price could be better. Normally, the costs depend on the country you're located in for the license. When we were in the initial stage, we went with the E5 license they call premium standard. It cost us around $5.20 per month for four users."
  • "The price of the solution is high compared to others and we have lost some customers because of it."
  • "Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
  • "We have a lot of problems in Latin America regarding the price of Microsoft 365 Defender, because the relationship between dollars and the money of the different countries, it's is a lot. Many customers that have small businesses say that they would like the solution but it is too expensive. However, large companies do not find the cost an issue."
  • "The most valuable licensing option is expensive, so pricing could be improved. Licensing options for this solution also need to be consolidated, because they frequently change."
  • "Microsoft should provide lower-level licensing options. They should do it in such a way that even an individual could purchase a license, and it should be entirely flexible."
  • "They have moved from a licensing model to pay-per-use... The question is: What happens if, for any reason, there's not enough budget to accept this model? That could be a great problem."
  • More Microsoft Defender XDR Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which EDR (Endpoint Detection and Response) solutions are best for your needs.
    765,234 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protection… more »
    Top Answer:The product's initial setup phase is very easy.
    Top Answer:Fortinet FortiEDR is available at a very competitive price compared to the other products in the market. Customers also… more »
    Top Answer:Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that… more »
    Top Answer:Both of these products perform similarly and have many outstanding attributes CrowdStrike Falcon offers an amazing… more »
    Top Answer:The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push… more »
    Top Answer:Scanning, vulnerability reporting, and the dashboard are the most valuable features.
    Top Answer:While Microsoft Defender XDR carries a higher cost, its ease of use compared to Defender may justify the investment.
    Top Answer:While the XDR platform offers valuable functionalities, it falls short of other solutions in its ability to deliver a… more »
    Comparisons
    Also Known As
    enSilo, FortiEDR
    CrowdStrike Falcon, CrowdStrike Falcon XDR
    Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
    Learn More
    Interactive Demo
    Fortinet
    Demo Not Available
    CrowdStrike
    Demo Not Available
    Overview

    Fortinet FortiEDR is a real-time endpoint protection, detection, and automated response solution. Its primary purpose is to detect advanced threats to stop breaches and ransomware damage. It is designed to do so in real time, even on an already compromised device, allowing you to respond and remediate incidents automatically so your data can remain protected.

    Fortinet FortiEDR Features

    Fortinet FortiEDR has many valuable key features, including:

    • Easily customizable
    • Real-time proactive risk mitigation & IoT security
    • Pre-infection protection
    • Post-infection protection
    • Track applications and ratings
    • Reduce the attack surface with risk-based proactive policies
    • Achieve analysis of entire log history
    • Optional managed detection and response (MDR) service

    Fortinet FortiEDR Benefits

    Some of the key benefits of using Fortinet FortiEDR include:

    • Protection: Fortinet FortiEDR provides proactive, real-time, automated endpoint protection with the orchestrated incident response across platforms. It stops the breach with real-time postinfection blocking to protect data from exfiltration and ransomware encryption.

    • Single unified console: Fortinet FortiEDR has a single unified console with an intuitive interface, which makes management easier. The solution automates mundane endpoint security tasks so your employees don’t need to do it.

    • Cost savings: With Fortinet FortiEDR you can eliminate post-breach operational expenses and breach damage costs.

    • Flexibility: Fortinet FortiEDR can be deployed on premises or on a secure cloud instance. With Fortinet FortiEDR, endpoints are protected both on- and off-line.

    • Scalability: Because Fortinet can be deployed quickly and has a small footprint, it is easy to scale up to protect hundreds of thousand endpoints.

    Reviews from Real Users

    Below are some reviews and helpful feedback written by Fortinet FortiEDR users.

    An Owner at a security firm says, "The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers. The customer has literally about 800 cash registers. That was the use case for Fortinet FortiEDR - to get that down into a tiny space. The only way to do that was to use this product because it had that ability to unbundle services that were a surplus.”

    Chandan M., Chief Technical Officer at Provision Technologies LLP, mentions, “The ease of deployment and configuration is valuable. It's very easy compared to other vendors like Sophos. Sophos' configuration is complex. Fortinet is a lot easier to understand. You don't need a lot of admin knowledge to do the configuration.” He also adds, “The security is also very good and the firewall response is good.”

    Harpreet S., Information Technology Support Specialist at Chemtrade Logistics, explains, "It notifies us if there's any suspicious file on any PC. If any execution or similar kind of thing is happening, it just alerts us. It doesn't only alert. It also blocks the execution until we allow it. We check whether the execution is legitimate or not, and then approve it or keep it blocked. This gives us a little bit of control over this mechanism. Fortinet FortiEDR is also very straightforward and easy to maintain."

    DeAndre V., Senior Network Administrator at a financial services firm, states, “The dashboard is easy to follow and use. The deployment and uninstalling were easy. I like the detailed information about the path of a file that might be suspicious. Being able to check that out was easy to follow. Exceptions are easy to create and the interface is easy to follow with a nice appearance.

    CrowdStrike Falcon is a comprehensive endpoint protection platform, primarily designed to meet the evolving cybersecurity needs of modern enterprises. It employs machine learning, behavioral analytics, and integrated threat intelligence to combat a wide range of cyber threats. CrowdStrike Falcon stands out for its cloud-native architecture, ensuring real-time protection and threat intelligence, essential for safeguarding dynamic environments. Its lightweight agent architecture minimizes system performance impact while offering extensive network visibility.

    CrowdStrike Falcon offers robust, user-friendly cybersecurity measures that are crucial for protecting digital assets and minimizing the risk of data breaches and cyberattacks. Its proactive threat detection and mitigation help maintain business continuity and protect brand reputation. Additionally, its scalability and ease of use contribute to cost-effectiveness by reducing the need for extensive IT resources and training. The platform's seamless integration with existing IT infrastructures makes it a versatile choice for diverse IT environments.

    During our conversations with CrowdStrike's users, they highly regard CrowdStrike Falcon for its efficiency in detecting and responding to threats, ease of use, and minimal system impact. It's praised for its comprehensive coverage, extending beyond traditional antivirus solutions, with strong customer support and continuous improvements.

    General Feedback and Recommendations:

    • Strengths: Its lightweight agent, stability, scalability, positive technical support experience, and improvements over competitors are notable strengths.
    • Weaknesses: The extraction process did not effectively capture the weaknesses, indicating a need for more precise data analysis.
    • Implementation and Usage: Insights include scalability and stability, particularly in cloud solutions, and ease of implementation without external assistance.

    Key Features and Advantages:

    1. Advanced Threat Detection and Response - utilizes sophisticated algorithms and machine learning to identify and neutralize preemptively, crucial for mitigating risks from advanced persistent threats (APTs) and zero-day exploits.
    2. Comprehensive Visibility and Insight - provides deep endpoint activity visibility, enabling IT teams to detect anomalies and respond to incidents effectively.
    3. Cloud-Native Architecture - offers scalability and flexibility, adapting to changing business needs, beneficial for organizations scaling operations or transitioning to cloud infrastructures.
    4. Integrated Threat Intelligence - backed by CrowdStrike's threat intelligence database, the platform stays ahead of attackers with continuously updated information on emerging threats.
    5. Ease of Deployment and Management - Its lightweight agent and cloud-based management console simplify deployment and management, which is practical for businesses of all sizes.
    6. Compliance and Risk Management - aids in meeting compliance requirements with thorough reporting and audit trails, essential for regulatory scrutiny.
    7. User and Entity Behavior Analytics (UEBA) - Analyzing user behavior patterns enhances detection capabilities against insider threats and compromised accounts.

    CrowdStrike Falcon offers various pricing plans based on endpoints and required features. The plans cater to different organizational sizes and needs, from basic endpoint protection to comprehensive protection with advanced capabilities. Additional features like DLP, UBA, Endpoint Sandboxing, and MDR are available, with pricing upon request.

    CrowdStrike Falcon emerges as a sophisticated solution for enterprise cybersecurity, offering advanced threat detection, scalability, and user-friendly design. It's well-suited for both IT professionals and business executives, protecting against current cyber threats and adaptable to future challenges in the cybersecurity landscape. For a more detailed understanding, especially concerning its use cases and weaknesses, a manual review of user feedback might be necessary.

    Microsoft Defender XDR is a comprehensive security solution designed to protect against threats in the Microsoft 365 environment. 

    It offers robust security measures, comprehensive threat detection capabilities, and an efficient incident response system. With seamless integration with other Microsoft products and a user-friendly interface, it simplifies security management tasks. 

    Users have found it effective in detecting and preventing various types of attacks, such as phishing attempts, malware infections, and data breaches.

    Watch the Microsoft demo video here: Microsoft Defender XDR demo video.

    Offer
    Learn more about Fortinet FortiEDR
    Get Fast and Easy Protection Against All Threats

    Protect your organization from all threats - not just malware - even when computers and servers aren’t connected to the internet. Start your free trial and deploy CrowdStrike Falcon within minutes to start receiving full threat protection.

    Learn more about Microsoft Defender XDR
    Sample Customers
    Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
    Information Not Available
    Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
    Top Industries
    REVIEWERS
    Financial Services Firm21%
    Comms Service Provider11%
    Manufacturing Company11%
    Pharma/Biotech Company5%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Government8%
    Manufacturing Company8%
    Financial Services Firm8%
    REVIEWERS
    Computer Software Company19%
    Financial Services Firm16%
    Comms Service Provider7%
    Manufacturing Company7%
    VISITORS READING REVIEWS
    Computer Software Company15%
    Financial Services Firm10%
    Manufacturing Company8%
    Government7%
    REVIEWERS
    Manufacturing Company18%
    Government12%
    Financial Services Firm12%
    Computer Software Company12%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Financial Services Firm10%
    Government8%
    Manufacturing Company8%
    Company Size
    REVIEWERS
    Small Business50%
    Midsize Enterprise16%
    Large Enterprise34%
    VISITORS READING REVIEWS
    Small Business31%
    Midsize Enterprise19%
    Large Enterprise50%
    REVIEWERS
    Small Business32%
    Midsize Enterprise23%
    Large Enterprise45%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise18%
    Large Enterprise56%
    REVIEWERS
    Small Business43%
    Midsize Enterprise24%
    Large Enterprise33%
    VISITORS READING REVIEWS
    Small Business26%
    Midsize Enterprise18%
    Large Enterprise57%
    Buyer's Guide
    CrowdStrike Falcon vs. Microsoft Defender XDR
    March 2024
    Find out what your peers are saying about CrowdStrike Falcon vs. Microsoft Defender XDR and other solutions. Updated: March 2024.
    765,234 professionals have used our research since 2012.

    CrowdStrike Falcon is ranked 3rd in EDR (Endpoint Detection and Response) with 101 reviews while Microsoft Defender XDR is ranked 8th in EDR (Endpoint Detection and Response) with 74 reviews. CrowdStrike Falcon is rated 8.6, while Microsoft Defender XDR is rated 8.4. The top reviewer of CrowdStrike Falcon writes "Easy to set up with good behavior-based analysis but needs a single-click recovery option". On the other hand, the top reviewer of Microsoft Defender XDR writes "Includes four services and four products, which can help organizations a lot". CrowdStrike Falcon is most compared with Darktrace, Microsoft Defender for Endpoint, Trend Micro Deep Security, SentinelOne Singularity Complete and Trend Vision One, whereas Microsoft Defender XDR is most compared with Microsoft Defender for Cloud, Microsoft Purview Compliance Manager, Wazuh, Microsoft Sentinel and Trend Vision One. See our CrowdStrike Falcon vs. Microsoft Defender XDR report.

    See our list of best EDR (Endpoint Detection and Response) vendors and best Extended Detection and Response (XDR) vendors.

    We monitor all EDR (Endpoint Detection and Response) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.