Try our new research platform with insights from 80,000+ expert users

Fortinet FortiEDR vs Trellix Advanced Threat Defense vs Trellix Network Detection and Response comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

Endpoint Detection and Response (EDR) Market Share Distribution
ProductMarket Share (%)
Fortinet FortiEDR3.5%
CrowdStrike Falcon10.3%
Microsoft Defender for Endpoint9.8%
Other76.4%
Endpoint Detection and Response (EDR)
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Trellix Advanced Threat Defense2.0%
Palo Alto Networks WildFire10.7%
Microsoft Defender for Endpoint9.0%
Other78.3%
Advanced Threat Protection (ATP)
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Trellix Network Detection and Response5.2%
Palo Alto Networks WildFire10.7%
Microsoft Defender for Endpoint9.0%
Other75.1%
Advanced Threat Protection (ATP)
 

Featured Reviews

Anoop K Jayan - PeerSpot reviewer
Has strengthened endpoint protection for on-premise networks and supported migration to Linux environments
What really stands out in Fortinet FortiEDR is that we are integrating it with some private clouds at the customer's premises with secure SD-WAN networks. I don't know how much it contributes to this SD-WAN network in the own premises cloud solution, but that is what we are doing. This is especially relevant for government projects where the SD-WAN solution is within their private network, not touching the Internet or any other access. Their first requirement is centralized management. Additionally, they need antivirus updates and other things to be done through a centralized platform within that private cloud. That is their requirement, and currently, we temporarily allow internet access, but it is not preferred. We are moving towards a complete air gap, providing full isolation from the internet for that. We have started to work with machine learning capabilities in Fortinet FortiEDR. We are not that well-versed yet, but we have begun using machine learning for intrusion detection and other purposes. Regarding forensic analysis in Fortinet FortiEDR, it is useful in understanding attack vectors because our projects are based on the voice side, such as cloud PBX solutions and call center management. There are media activities and many attacks coming from the outside, as well as vulnerabilities from endpoints. In those cases, we need detailed analysis through an AI platform to inspect how these attacks are coming. We also require a proactive protection mechanism, including an alarm system for threat detection before attacks occur.
PP
Ensuring long-term reliability while seeking internal email management enhancements
Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.
BiswabhanuPanda - PeerSpot reviewer
Offers in-depth investigation capabilities, integrates well and smoothly transitioned from a lower-capacity appliance to a higher one
The in-depth investigation capabilities are a major advantage. When the system flags something as malicious, it provides a packet capture of that activity within the environment. That helps my team quickly identify additional context that most other tools wouldn't offer – like source IP or base64 encoded data. We can also see DNS requests and other details that aren't readily available in solutions like Check Point or others that we've tried. The detection itself is solid, and their sandboxing is powerful. There's a learning curve – you need a strong grasp of OS-level changes, process forking, registry changes, and the potential impact of those. But with that knowledge, the level of information Trellix provides is far greater than what we've seen elsewhere. The real-time response capability of Trellix has been quite effective, although it's not very fast. The key is this solution's concept of 'preference zero.' They don't immediately act on a zero-day. For example, the solution has seen a piece of malware for the first time. It'll let it in, then do sandboxing. Maybe after four or five minutes, it identifies that specific file's DNX Secure Store as malicious. At that point, they update the static analysis engine, and it gets detected if anything else tries to download the same file. There is that initial 'preference zero' concept, like with Panda. You may not hold traffic in the network. That's standard in the industry; we don't do much about it. To address that, we also have endpoint solutions. We use SentinelOne in our environment, which helps us identify threats like Western Bureaus and others.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We have a specific policy to protect most of the software our employees use on EvoraMet, whether cloud-based or installed on Microsoft machines. We enforce a security rule where any software with a security score lower than three is blocked within the network."
"The product detects and blocks threats and is more proactive than firewalls."
"We have FortiEDR installed on all our systems. This protects them from any threats."
"The setup is pretty simple."
"Ability to get forensics details and also memory exfiltration."
"Fortinet FortiEDR made our clients feel secure and more at ease, knowing that they had an EDR solution that would close the gap in their security posture."
"The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers."
"It's easy to configure and integrate the solution with the current network because it is used by Fortinet clients."
"It is very scalable."
"Provides good exfiltration, and is an all-in-one product."
"The most valuable features are the administration console and its detection and response module."
"The fact that in 10 years, we have had no problem is the most valuable feature for us; it's really a washing machine, but the only problem we face is that it's difficult to report on this product."
"It is stable and reliable."
"It stops in excess of twenty-five malware events per month, all of which could be critical to the business."
"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."
"I recommend this solution because of its ease of use."
"Support is very helpful and responsive."
"Trellix NDR provides an essential defense by automatically responding to network incidents that firewalls may not catch."
"If we are receiving spam emails, or other types of malicious email coming from a particular email ID, then we are able to block them using this solution."
"Initially, we didn't have much visibility around what is occurring at our applications lower level. For instance, if we are exposed to any malicious attacks or SQL injections. But now we've integrated FireEye with Splunk, so now we get lots of triggers based on policy content associated with FireEye. The solution has allowed for growth and improvement in our information security and security operations teams."
"The scalability has not been a problem. We have deployed the product in very high bandwidth networks. We have never had a problem with the FireEye product causing latency issues within our networks."
"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."
"Trellix Network Detection and Response helps increase response to attacks. One benefit is increased visibility and simplicity in maintaining it. AI analyzes and relates data based on past performance over the last five days."
"It is stable and quite protective. It has a lot of features to scan a lot of malicious things and vulnerabilities."
 

Cons

"The control of scripts could be improved because you use Microsoft Active Directory and unnecessary scripts to keep the roles updated with company policies."
"Intelligence aspects need improvement"
"They can include the automation for the realtime updates. We have a network infrastructure with remote sites. Whenever they send updates, they are not automated. We have to go into the console and push those updates. I wish it was more automated. The update file is currently around 31 MB. It could be smaller."
"FortiEDR can be improved by providing more detailed reporting."
"We've encountered challenges during API deployment, occasionally resulting in unstable environments."
"Cannot be used on mobile devices with a secure connection."
"The EDR console should have more extensive reporting. You shouldn't need to purchase FortiAnalyzer. It should be included in the EDR part. The security adviser cloud platform could be improved with more options for exclusive or intensive rules for devices."
"It takes about two business days for initial support, which is too slow in urgent situations."
"We'd like them to be better at dealing with script threats."
"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."
"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."
"Lacks remote capabilities not dependent on the internet."
"This solution needs to be made "cloud ready"."
"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."
"I would like to see future versions of the solution incorporate artificial intelligence technology."
"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."
"The product's integration capabilities are an area of concern where improvements are required."
"Technical packaging could be improved."
"If you want to search the hashes in the environment, you need to put in IOCs one by one, making it a very hectic job."
"It is very expensive, the price could be better."
"The solution's support needs to improve their support."
"The problem with FireEye is that they don't allow VM or sandbox customization. The user doesn't have control of the VMs that are inside the box. It comes from the vendor as-is. Some users like to have control of it. Like what type of Windows and what type of applications and they have zero control over this."
"I would love to see better reporting. Because you can't export some of the reports in proper formats, it is hard to extract the data from reports."
"It would be great if we could create granular reports based on the protocols, types of attacks, regions of attack, etc. Also we would like to easily be able to add exceptions to rules in cases of false positives."
 

Pricing and Cost Advice

"Fortinet FortiEDR is pretty cheap compared to other EDR products because it provides three-for-one contracts."
"The price is comprable to other endpoint security solutions."
"I'm not familiar with pricing, but it looks a bit costly compared to other vendors I think."
"We got a good deal on licensing, so it is in the competitive range."
"It's not cheap, but it's not expensive either."
"There are no issues with the pricing."
"The solution costs less than 10,000 for 100 users."
"I chose Fortinet FortiEDR because it's more cost-effective than competitors, potentially saving me up to half the price."
"Our licensing fees for this solution are approximately one million dollars per year."
"The product is expensive, but it is better than the rest of them in the industry."
"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."
"The user fee is not as high but the maintenance fee is expensive."
"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."
"Because of what the FireEye product does, it has significantly decreased our mean time in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the meantime to analysis decrease by at least tenfold."
"The pricing is a little high."
"It's an expensive solution."
"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."
"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
872,029 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Manufacturing Company
8%
Government
8%
Financial Services Firm
8%
Government
16%
Comms Service Provider
15%
Performing Arts
11%
Financial Services Firm
9%
Financial Services Firm
13%
Comms Service Provider
12%
Manufacturing Company
11%
Government
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business19
Midsize Enterprise9
Large Enterprise14
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise4
Large Enterprise5
By reviewers
Company SizeCount
Small Business19
Midsize Enterprise8
Large Enterprise19
 

Questions from the Community

What's the difference between Fortinet's FortiEDR and FortiClient?
I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protectio...
What do you like most about Fortinet FortiEDR?
We have FortiEDR installed on all our systems. This protects them from any threats.
What is your experience regarding pricing and costs for Fortinet FortiEDR?
The pricing is moderate; I cannot label it as cheap, but it is moderate compared to other main solutions.
What do you like most about McAfee Advanced Threat Defense?
I recommend this solution because of its ease of use.
What needs improvement with McAfee Advanced Threat Defense?
I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's n...
What is your primary use case for McAfee Advanced Threat Defense?
We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex....
What do you like most about FireEye Network Security?
We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. Wi...
What is your experience regarding pricing and costs for FireEye Network Security?
While I do not handle pricing directly, it is known that there is a variety of customers with different licensing nee...
What needs improvement with FireEye Network Security?
The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would...
 

Also Known As

enSilo, FortiEDR
McAfee Advanced Threat Defense
FireEye Network Security, FireEye
 

Overview

 

Sample Customers

Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust
FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
872,029 professionals have used our research since 2012.