Try our new research platform with insights from 80,000+ expert users

Fortinet FortiEDR vs Trellix Advanced Threat Defense vs Trellix Network Detection and Response comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

Endpoint Detection and Response (EDR) Market Share Distribution
ProductMarket Share (%)
Fortinet FortiEDR3.5%
CrowdStrike Falcon10.3%
Microsoft Defender for Endpoint9.8%
Other76.4%
Endpoint Detection and Response (EDR)
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Trellix Advanced Threat Defense2.0%
Palo Alto Networks WildFire10.7%
Microsoft Defender for Endpoint9.0%
Other78.3%
Advanced Threat Protection (ATP)
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Trellix Network Detection and Response5.2%
Palo Alto Networks WildFire10.7%
Microsoft Defender for Endpoint9.0%
Other75.1%
Advanced Threat Protection (ATP)
 

Featured Reviews

Anoop K Jayan - PeerSpot reviewer
Has strengthened endpoint protection for on-premise networks and supported migration to Linux environments
What really stands out in Fortinet FortiEDR is that we are integrating it with some private clouds at the customer's premises with secure SD-WAN networks. I don't know how much it contributes to this SD-WAN network in the own premises cloud solution, but that is what we are doing. This is especially relevant for government projects where the SD-WAN solution is within their private network, not touching the Internet or any other access. Their first requirement is centralized management. Additionally, they need antivirus updates and other things to be done through a centralized platform within that private cloud. That is their requirement, and currently, we temporarily allow internet access, but it is not preferred. We are moving towards a complete air gap, providing full isolation from the internet for that. We have started to work with machine learning capabilities in Fortinet FortiEDR. We are not that well-versed yet, but we have begun using machine learning for intrusion detection and other purposes. Regarding forensic analysis in Fortinet FortiEDR, it is useful in understanding attack vectors because our projects are based on the voice side, such as cloud PBX solutions and call center management. There are media activities and many attacks coming from the outside, as well as vulnerabilities from endpoints. In those cases, we need detailed analysis through an AI platform to inspect how these attacks are coming. We also require a proactive protection mechanism, including an alarm system for threat detection before attacks occur.
PP
Ensuring long-term reliability while seeking internal email management enhancements
Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.
BiswabhanuPanda - PeerSpot reviewer
Offers in-depth investigation capabilities, integrates well and smoothly transitioned from a lower-capacity appliance to a higher one
The in-depth investigation capabilities are a major advantage. When the system flags something as malicious, it provides a packet capture of that activity within the environment. That helps my team quickly identify additional context that most other tools wouldn't offer – like source IP or base64 encoded data. We can also see DNS requests and other details that aren't readily available in solutions like Check Point or others that we've tried. The detection itself is solid, and their sandboxing is powerful. There's a learning curve – you need a strong grasp of OS-level changes, process forking, registry changes, and the potential impact of those. But with that knowledge, the level of information Trellix provides is far greater than what we've seen elsewhere. The real-time response capability of Trellix has been quite effective, although it's not very fast. The key is this solution's concept of 'preference zero.' They don't immediately act on a zero-day. For example, the solution has seen a piece of malware for the first time. It'll let it in, then do sandboxing. Maybe after four or five minutes, it identifies that specific file's DNX Secure Store as malicious. At that point, they update the static analysis engine, and it gets detected if anything else tries to download the same file. There is that initial 'preference zero' concept, like with Panda. You may not hold traffic in the network. That's standard in the industry; we don't do much about it. To address that, we also have endpoint solutions. We use SentinelOne in our environment, which helps us identify threats like Western Bureaus and others.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We have a specific policy to protect most of the software our employees use on EvoraMet, whether cloud-based or installed on Microsoft machines. We enforce a security rule where any software with a security score lower than three is blocked within the network."
"It is very easy to set up. I would rate my experience with the initial setup a ten out of ten, with ten being very easy to set up."
"What really stands out in Fortinet FortiEDR is that we are integrating it with some private clouds at the customer's premises with secure SD-WAN networks."
"This is stable and scalable."
"NGAV and EDR features are outstanding."
"The data collected from the endpoint where the EDR is installed is highly valuable for me."
"Having all monitoring, response, tracking, and mitigation tools in one dashboard provides our analysts and SOC team with a comprehensive view at a glance."
"The setup is pretty simple."
"It is stable and reliable."
"Provides good exfiltration, and is an all-in-one product."
"The most valuable features are the administration console and its detection and response module."
"It is very scalable."
"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."
"I recommend this solution because of its ease of use."
"The fact that in 10 years, we have had no problem is the most valuable feature for us; it's really a washing machine, but the only problem we face is that it's difficult to report on this product."
"It stops in excess of twenty-five malware events per month, all of which could be critical to the business."
"Over the thirteen years of using the product, we have not experienced a single compromise in our environment. During the COVID period, we faced numerous DDoS attacks, and the tool proved highly effective in mitigating these threats."
"The MVX Engine seems to be very capable against threats and the way it handles APTs is impressive."
"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."
"It allows us to be more hands off in checking on emails and networking traffic. We can set up a bunch of different alerts and have it alert us."
"The product is very easy to configure."
"The most valuable feature is the network security module."
"The installation phase was easy."
"Initially, we didn't have much visibility around what is occurring at our applications lower level. For instance, if we are exposed to any malicious attacks or SQL injections. But now we've integrated FireEye with Splunk, so now we get lots of triggers based on policy content associated with FireEye. The solution has allowed for growth and improvement in our information security and security operations teams."
 

Cons

"There's room for improvement in the quick response time and technical support for integration issues, especially when dealing with multiple vendors."
"When I implemented FortiEDR, it identified Cisco AnyConnect VPN as malicious data, which led to the VPN being cut off. Consequently, people could not work remotely from home."
"Intelligence aspects need improvement"
"I will have my team provide more details about disadvantages via email later."
"Once, we had an event that was locked and blocked, but information about it came to us two or three days later."
"Everything with Fortinet having to do with their cloud services. They need to invest more in their internal infrastructure that they are running in the cloud. One of the things I find with their cloud environment compared to others' is that they go cheap on the equipment. So it causes some performance degradation."
"In smaller markets like Serbia, Bosnia, Montenegro, and Slovenia, it can be challenging to find customers with 500 endpoints. My suggestion to Fortinet would be to lower this minimum order quantity to one."
"Integration with Azure and SaaS provisioning tools could improve Fortinet FortiEDR."
"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."
"This solution needs to be made "cloud ready"."
"We'd like them to be better at dealing with script threats."
"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."
"Lacks remote capabilities not dependent on the internet."
"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."
"I would like to see future versions of the solution incorporate artificial intelligence technology."
"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."
"The solution's support needs to improve their support."
"Certain features in Trellix Network Detection and Response, such as using AL-type commands, may initially pose a challenge for those unfamiliar with such commands. However, once users become accustomed to the system, it becomes easier to use."
"Technical support needs improvement as sometimes engineers are not available promptly, especially during high-severity incidents."
"I would love to see better reporting. Because you can't export some of the reports in proper formats, it is hard to extract the data from reports."
"It is not a very secure product."
"Stability issues manifested in terms of throughput maximization."
"Cybersecurity posture has room for improvement."
"It would be very helpful if there were better integration with other solutions from other vendors, such as Fortinet and Palo Alto."
 

Pricing and Cost Advice

"I know it is tough to get big budget additions up front, but I highly recommend deploying environment wide and adding the forensic service."
"The solution is not expensive."
"Fortinet FortiEDR has a yearly subscription."
"I'm not familiar with pricing, but it looks a bit costly compared to other vendors I think."
"It is expensive and I would rate it 8 on the scale."
"Offered at a high price"
"It's not cheap, but it's not expensive either."
"The solution costs less than 10,000 for 100 users."
"Our licensing fees for this solution are approximately one million dollars per year."
"The product is expensive, but it is better than the rest of them in the industry."
"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."
"The pricing is a little high."
"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."
"Pricing and licensing are reasonable compared to competitors."
"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."
"We're partners with Cisco so we get a reasonable price. It's cheaper than Palo Alto in terms of licensing."
"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."
"It's an expensive solution."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
872,098 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Manufacturing Company
8%
Government
8%
Financial Services Firm
8%
Government
16%
Comms Service Provider
15%
Performing Arts
11%
Financial Services Firm
9%
Financial Services Firm
13%
Comms Service Provider
12%
Manufacturing Company
11%
Government
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business19
Midsize Enterprise9
Large Enterprise14
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise4
Large Enterprise5
By reviewers
Company SizeCount
Small Business19
Midsize Enterprise8
Large Enterprise19
 

Questions from the Community

What's the difference between Fortinet's FortiEDR and FortiClient?
I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protectio...
What do you like most about Fortinet FortiEDR?
We have FortiEDR installed on all our systems. This protects them from any threats.
What is your experience regarding pricing and costs for Fortinet FortiEDR?
The pricing is moderate; I cannot label it as cheap, but it is moderate compared to other main solutions.
What do you like most about McAfee Advanced Threat Defense?
I recommend this solution because of its ease of use.
What needs improvement with McAfee Advanced Threat Defense?
I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's n...
What is your primary use case for McAfee Advanced Threat Defense?
We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex....
What do you like most about FireEye Network Security?
We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. Wi...
What is your experience regarding pricing and costs for FireEye Network Security?
While I do not handle pricing directly, it is known that there is a variety of customers with different licensing nee...
What needs improvement with FireEye Network Security?
The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would...
 

Also Known As

enSilo, FortiEDR
McAfee Advanced Threat Defense
FireEye Network Security, FireEye
 

Overview

 

Sample Customers

Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust
FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
872,098 professionals have used our research since 2012.