Try our new research platform with insights from 80,000+ expert users

CrowdStrike Falcon vs Morphisec vs Symantec Endpoint Security comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of October 2025, in the Endpoint Protection Platform (EPP) category, the mindshare of CrowdStrike Falcon is 7.9%, down from 11.0% compared to the previous year. The mindshare of Morphisec is 0.5%, up from 0.4% compared to the previous year. The mindshare of Symantec Endpoint Security is 3.6%, down from 4.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Market Share Distribution
ProductMarket Share (%)
CrowdStrike Falcon7.9%
Symantec Endpoint Security3.6%
Morphisec0.5%
Other88.0%
Endpoint Protection Platform (EPP)
 

Featured Reviews

Waleed Omar - PeerSpot reviewer
Provides effective real-time threat detection with potential for cost optimization
Some features such as device control, firewall management, and file analysis are standalone products that we need to purchase separately. If these features came out of the box within the product, it would be much more beneficial for us. Other providers such as SentinelOne include these features in their base product. We attended a CrowdStrike Falcon event where they discussed some shallow AI features, but we cannot see these in our panel yet. We work with different solutions such as Darktrace and SocRadar, where AI features are automatically displayed in our dashboards after release. However, for CrowdStrike Falcon, we cannot see these features.
Rick Schibler - PeerSpot reviewer
Offers in-memory protection at a lower price than competitors
Morphisec's in-memory protection is probably the most valuable feature because it stops malicious activity from occurring. If something tries to install or act as a sleeper agent, Morphisec will detect and stop it. Morphisec's Moving Target Defense is critical to hardening our attack surface. If it detects something, it indicates whether it's valid. That means you've got a breach requiring investigation. It detects anomalies but doesn't necessarily point to what caused them. You still need to do that work. The solution is reasonably easy to administer. They made some changes last year, adding a cloud-based monitoring solution that makes deploying and monitoring our endpoints easy.
Kumbesh Rajagopal - PeerSpot reviewer
Management becomes easier with minimal complications, but improvement in support tools needed
Regarding areas of improvement for Symantec Endpoint Security, there are many changes, and the support portal tool is complicated compared to other tools. When trying to get service from Symantec, the process is complex. I'm not sure whether it's because of my project or something else. Though it is easy to manage, easy to get, easy to install, and works efficiently for managing policies, we faced a significant disadvantage. We wanted to add multiple hashes because of numerous new alerts coming, but we could only add them one by one, which is a considerable disadvantage in Symantec.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"CrowdStrike Falcon offers a comprehensive dashboard that is highly effective in protecting against and blocking external infiltration attempts."
"The most valuable aspects of CrowdStrike Falcon for me are its device observability, identification, and software and OS recognition."
"The solution offers great stability."
"There are two things which customers really like about CrowdStrike. If they buy managed services from CrowdStrike, it offers them detection of security issues in one minute. If you buy their professional services, they offer insurance where you can claim up to $5 million if there's a breach. This is a huge upsell for customers."
"The biggest advantage of this solution for my customers is that it is a single solution that fulfills most of their security concerns while being easy to manage."
"CrowdStrike Falcon serves as a next-gen AV, which basically does AI-based behavioral analysis to detect and act on malware or ransomware."
"The platform is very scalable."
"CrowdStrike Falcon is effortless to use, and it's a cloud-specific platform. You only need to deploy the light agents on the licensed endpoints, and you're ready to work. Your dashboards will tell you the number of the endpoints being protected and the incidents. There are also incident dashboards with alerts that will tell you about the details."
"Morphisec stops attacks without needing to know what type of threat it is, just that it is foreign. It is based on injections, so it would know when a software launches. If a software launches and something else also launches, then it would count that as anomalous and block it. Because the software looks at the code, and if it executes something else that is not related, then Morphisec would block it. That is how it works."
"We don't have to do anything as a user or as an admin. It does everything by default with its coding and inbuilt AI-based intelligence. We don't have to instruct it about what to do. It automatically takes corrective actions and quarantines or deletes a virus, malware, etc. That is the best part that I like about it."
"I really like the integration with Microsoft Defender. In addition to having third-party endpoint protection, we're also enabling Defender... I like the reporting that we get from Defender, when it comes in. I like that it's one console showing both Morphisec and Defender where it provides me with full visibility into security events from Defender and Morphisec."
"Morphisec has enabled us to become a lot less paranoid when it comes to staff clicking on things or accessing things that they shouldn't that could infect the whole system. Our original ransomware attack that happened came from someone's Google drive and then just filtered on through that. It has put our minds at ease a lot more in running it. It's also another layer of security that has been proven to be effective for us."
"It also provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard. We've always had that capability with Morphisec. The more recent version appears to do that even a little bit more natively and it's given us visibility that we didn't have otherwise."
"Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. It changes the memory locations of where certain applications run. If you think of Excel, opening a PDF, running an Excel macro, or opening a webpage and clicking on a link, all of those actions run in a certain area of memory. Morphisec changes the memory locations of where those run."
"Morphisec also provides full visibility into security events for Microsoft Defender and Morphisec in one dashboard... in the single pane of glass provided by Morphisec, it's all right there at your fingertips: easy to access and easy to understand. And if you choose to go down further to know everything from the process to the hash behind it, you can."
"Morphisec makes it very easy for IT teams of any size to prevent breaches of critical systems because of the design of their tool. When we evaluated Morphisec, the CIO and I sat and listened. What attracted us to them is the fact that it stops activity at the point of detection. That saves a lot of time because now we are not investigating and trying to trace down what to turn off. We have already prevented it, which makes it very much safer and more secure."
"It is good for detecting signature-based viruses, and it is user friendly."
"We are using it on 1,600 computers. All the systems and servers are protected with the Symantec solution. Our environment has an uptime of 99.9% because we never had any attack or issue related to viruses. There is zero downtime."
"Some of the most valuable features were antivirus, malware, and spyware. They were really good."
"Stability-wise, it is very good and we have had no trouble."
"The most valuable feature of Symantec Endpoint Security is the protection of our systems."
"It's good at detecting signature-based stuff and stopping that."
"The most amazing qualities of Symantec Endpoint Protection is that it provides a total solution to all virus problems."
"Their threat protection is very good. We are managing a good number of users thanks to the solution and we are pretty satisfied with it."
 

Cons

"Any kind of integration that you want to do, such as using the API to connect to a SIEM, is complex and it will be expensive to do."
"CrowdStrike needs to quit making up stuff about its features and functionality to bash its competition."
"The console is a little cluttered and at times, finding what you're looking for is not intuitive."
"In CrowdStrike, with the variety of security tools available, learning the different query languages can be challenging."
"They should provide us with good visibility for everything."
"In the six months that I have been using CrowdStrike, it has not been able to detect anything."
"The dashboard does not have the facility to export the reports in a PDF format, which I can quickly share with internal stakeholders."
"The price is too high."
"It would be useful for them if they had some kind of network discovery. That kind of functionality I think would give IT administrators a little bit more confidence that they have 100 percent coverage, and it gives them something to audit against. Network discovery would be one area I would definitely suggest that they put some effort into."
"Those are some of the features that I was looking for on my on-prem platform that they've already instituted in the cloud and that I'm sure will be instituting on their on-prem platform as well. Having to have an on-prem server required a lot of administration. Being able to push that to the cloud and have it managed up there for us is a real nice addition."
"From a company standpoint, a little more interaction with the customers throughout the year might be beneficial. I would like check-ins from the Morphisec account executives about any type of Morphisec news as well as a bit more interaction with customers throughout the year to know if anything new is coming out with Morphisec, e.g., what they are working on in regards to their development roadmap. We tend not to get that up until the time that we go for a yearly renewal. So, we end up talking to people from Morphisec once a year, but it is usually at renewal time."
"We have only had four attacks in the last year, "attacks" being some benign PDF from a vendor that, for some reason, were triggered. There were no actual attacks. They were just four false positives, or something lowly like adware. There have been false positives with both the on-premises solution and the cloud solution."
"Morphisec is a venture startup. They are still early in their growth stage. They need to get mature on their customer support and on how they interface with system tools. For example, they need to get multifactor in place and an API for the major multi-factor systems, e.g., Okta, Duo, Ping, and Microsoft. They don't have them built in yet. They are working on them. It is just not there yet. Also, their stability, customer support, and processes need improvement, which is just part of maturity."
"The dashboard is the area that requires the most improvement. We have about, I would say 5,500 computers currently, and searching through all of those takes some time to filter. So as soon as you apply the filter, it takes a few seconds. It crunches, it thinks, and then it brings up the clients that match."
"In the Windows Defender integration, they have put in a report of computers that need Windows Defender updates. If those updates could be kicked off directly from the dashboard, instead of having to go to another system entirely, that would be good."
"If anything, tech support might be their weakest link. The process of getting someone involved sometimes takes a little time. It seems to me that they should have all the data they need to let me know whether an alert is legitimate or not, but they tend to need a lot of information from me to get to the bottom of something. It usually takes a little longer than I would expect."
"Is not a full anti-ransomware solution."
"The solution could improve by having a better graphical interface."
"The spam filter is something that you can't control, and you can't set the filter to intercept different types of emails."
"Nowadays, threats are changing, and they are moving more towards script control and zero-day attacks. So, we would like to have more control similar to an EDR solution. Symantec Endpoint Protection has certainly come a long way as a traditional antivirus, but because the threats are changing, we would like to have more EDR features so that we have a detailed view of the source from where the infection entered the environment and whether it has tried to connect any other endpoint. It should provide such a detailed view for investigation. It should protect against zero-day threats, etc. These are the key enhancements that can make it a complete solution for any enterprise. Currently, we have seen organizations going for two solutions: antivirus and EDR. With both these capabilities, it would be a complete package."
"The solution is very difficult to uninstall. There isn't really a way to uninstall the product at all, which is quite a headache."
"I would like to see a hybrid version of this solution that covers both in-house and cloud-based servers."
"Using the management console is a bit complex. There are many features that we cannot use and we could use some help. We need some assistance to make them work better. They need to add features to make it simpler."
"I find the documentation on Symantec.com to be not very updated. It seems like Symantec focuses more on their product than on documentation."
 

Pricing and Cost Advice

"CrowdStrike is a reasonably priced tool."
"We are on an annual subscription for the solution. There are not any additional costs."
"The pricing is not bad. It's on the higher end of the market, but you get what you pay for."
"The cost of CrowdStrike Falcon could be reduced. It is quite expensive if you compare it to other solutions, such as Blue Coat, Symantec, McAfee, or Kaspersky."
"As I'm part of the technical team, not the budgeting team, I don't have information on CrowdStrike Falcon pricing."
"The pricing will depend upon your volume of usage."
"We are at about $60,000 per year."
"The pricing could be reduced. If it was more reasonable that would be great."
"It is an annual subscription basis per device. For the devices that we have in scope right now, it is about $25,000 a year."
"We are still using a separate tool. I know for our 600 or I think we're actually licensed for up to 700 users, it runs me 23 or $24,000 a year. When you're talking to that many users plus servers being protected, that's well worth the investment for that dollar amount."
"Price-wise, it's on the higher side. A traditional antivirus solution is cheaper, but in terms of security and manageability, its ROI is better than a traditional antivirus. I would recommend it to anybody evaluating or considering an antivirus solution. If your system gets compromised, the cost of ransom would be a lot more. This way, it saves a lot of cost."
"Morphisec is reasonably priced because our parent company's other subsidiaries use different products like CrowdStrike. CrowdStrike is four or five times more expensive than Morphisec. The competitive pricing saves us money in our overall security stack."
"The pricing is definitely fair for what it does."
"It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off."
"It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately."
"It does not have multi-tenants. If South Africa wants to show only the machines that they have, they need their own cloud incidence. It is not possible to have that in a single cloud incidence with multiple tenants in it, instead you need to have multiple cloud incidences. Then, if you have that, it will be more expensive. However, they are going to change that, which is good."
"When it comes to pricing, Sophos is preferrable to Symantec."
"Zero-day threat or advanced attacks should be part of the endpoint. The product should not require you to buy a separate license."
"The licensing costs are huge compared to what is normally included in the licensing with other products such as the Microsoft products that we're using. We're paying between $300 and $400 per seat."
"What we have paid for this product is good value for the work and the services that they are providing to us."
"We pay our licensing fees on a yearly basis, and everything is included in that price."
"This is not the cheapest product and I know others that are most cost-effective, although it is difficult to compare because it depends on the features."
"Pricing and licensing for our country is very good. It's not that expensive and the endpoint security is very good. It's not as cheap as some others, but they are not as good."
"There are subscription costs, we typically purchase the annual subscription. There can be other expenses too, for example, we use CrowdStrike also as part of our policy."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
869,202 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Financial Services Firm
10%
Manufacturing Company
9%
Government
6%
Outsourcing Company
16%
Manufacturing Company
12%
Computer Software Company
9%
Financial Services Firm
9%
Computer Software Company
13%
Financial Services Firm
10%
Manufacturing Company
10%
Comms Service Provider
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise34
Large Enterprise61
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise8
Large Enterprise8
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise32
Large Enterprise62
 

Questions from the Community

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
Ask a question
Earn 20 points
Which is better - Cortex XDR or Symantec End-User Endpoint Security?
Aqua Security is easy to use and very manageable. Its main focus is on Kubernetes and Docker. Security is a very valu...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...
What do you like most about Symantec End-User Endpoint Security?
Symantec have everything – documentation, videos, data sheets.
 

Also Known As

CrowdStrike Falcon, CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface
Morphisec, Morphisec Moving Target Defense
Symantec EPP, Symantec Endpoint Protection (SEP)
 

Overview

 

Sample Customers

Information Not Available
Lenovo/Motorola, TruGreen, Covenant Health, Citizens Medical Center
Audio Visual Dynamics, Red Deer Advocate, Asia Pacific Telecom Co. Ltd., Kibbutz Ein Gedi, and AMETEK, Inc.
Find out what your peers are saying about CrowdStrike, Microsoft, SentinelOne and others in Endpoint Protection Platform (EPP). Updated: September 2025.
869,202 professionals have used our research since 2012.