Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSandbox vs Microsoft Defender for Endpoint comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 1, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortinet FortiSandbox
Ranking in Advanced Threat Protection (ATP)
3rd
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
38
Ranking in other categories
Threat Deception Platforms (7th)
Microsoft Defender for Endp...
Ranking in Advanced Threat Protection (ATP)
4th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
197
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (5th)
 

Mindshare comparison

As of August 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Fortinet FortiSandbox is 9.4%, down from 9.8% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 9.0%, down from 10.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP)
 

Featured Reviews

Abdelhamid Saber - PeerSpot reviewer
Enhanced network security with adaptable integration and really good support
We use FortiSandbox for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues. The adapter is beneficial as it…
John Rallo - PeerSpot reviewer
Offers excellent visibility into vulnerabilities and the attack surface itself
Attack surface reduction and limiting attack surface vectors are valuable features. It's helpful to isolate specific devices and get super granular with the features they offer. The visibility into the attack surface is good. It gets highly granular. I don't work on that side, but the people who do tell me they get more visibility.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"FortiSandbox analyzes the behavior of processes in a sandbox environment, which is useful for threat hunting. The solution has an excellent standard configuration, and you can prioritize the types of files of VMs you want to analyze. It also integrates seamlessly with other Fortinet solutions, like FortiGate, FortiMail, and FortiEMS."
"The solution is very good because it catches a lot of threats in emails."
"The solution has the highest stability...The solution's setup is not complex as they are already included in Fortinet."
"The technical support is very good."
"The most valuable features of Fortinet FortiSandbox are customization, ICAP protocol, and integration with other vendors. Additionally, the security work very well."
"The most valuable feature was the EDR, endpoint detection and response."
"The real-time analysis capability of FortiSandbox is beneficial for email analysis."
"The adapter is beneficial as it allows integration with various devices, not just Fortinet."
"It's effective against most types of infection, and the firewall is perfect for protection."
"The performance of Microsoft Defender for Endpoint has been good."
"The feature I find most valuable in Microsoft Defender for Endpoint is that it blocks the process and keeps the endpoint from getting infected with malware."
"The notification and reporting features are most valuable because we are part of a compliance project, and maintaining SOC 2 compliance is critical."
"Offers good protection."
"It is a very advanced system based on AI. It has a very large database of places or sites on the internet where you should not go. It is continuously online."
"The intelligence mechanisms are good."
"One of the features which differentiates it from other EDR providers is the Automated Investigation and Response, which reduces the workload of SOC analysts or engineers. They don't have to manually investigate each and every alert on the endpoint, since it does so automatically. And you can automate the investigation part."
 

Cons

"The initial setup is not too complex but could be easier."
"The delivery feature in my country is extremely bad."
"The product is good but it could be speedier. In addition, it's quite complex."
"At least once a week we have a false alarm. This needs to be adjusted so that we get fewer of these occurrences."
"The main area of concern in Fortinet FortiSandbox is its detection capabilities."
"Not practical for real-time web traffic analysis because users won't wait for the FortiSandbox to complete its analysis before accessing content"
"If updated, Fortinet FortiSandbox could cover other risks."
"When you reach the maximum capacity, you cannot upgrade the solution because its hardware is very expensive."
"The detection of viruses could be a little bit better."
"There's a lot of manual effort involved to configure what we need."
"If the solution could be integrated more with Defender for Cloud, to be more unified, that would help. It is good now, but even more integration could be done with Defender for Cloud. We see two different portals. If Defender for Endpoint could be ported to the CSPM, Defender for Cloud, that would make things even easier for us."
"There are likely some technical improvements or features that could be added, however, I cannot say, off the top of my head, what they would be."
"Where we stand right now, compared to other products that are there in the market, they still have to work on their threat intelligence and the overall maturity of detecting the malware."
"I would like to see better integration with their other security products to give better visibility from a higher level."
"I would just like them to have more consistency, and that's a comment that's across the board with Microsoft. They change things a lot."
"A challenge is that it is not a multi-tenant solution. Microsoft's tenant is a licensed tenant. I'm an MSSP. So, I have multiple customers. In Microsoft's world, that means that I can't just buy an E5 license and give that out to all my customers. That won't work because all of the customer data resides within a single tenant in Microsoft's world. Other products—such as SentinelOne, Palo Alto Cortex, CrowdStrike, et cetera—are multi-tenant. So, I can have it at the top of the pyramid for my analyst to look into it and see all the customers, but each customer's data is separate. If the customer wants to look at what we see, they would only see their data, whereas in the Microsoft world, if I've got multiple customers connected to the same Microsoft tenant, they would see everybody else's data, which is a privacy problem in Europe. It is not possible to share the data, and it is a breach of privacy."
 

Pricing and Cost Advice

"There are no costs in addition to the standard licensing fees."
"I rate the product's pricing a five or six on a scale of one to ten, where one is low, and ten is high."
"The license for Fortinet FortiSandbox depends on the use case."
"The solution is not expensive at all."
"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."
"We are on an annual license to use the solution. We have an additional feature that is integrated with S5, which is working well."
"There are additional costs, which isn't included in the licensing fee."
"The price of Fortinet FortiSandbox is not expensive."
"The cost is competitive and reasonable because most of the expense is log analytics, storage, and data consumption and ingestion. These things can be throttled and controlled, so they are highly flexible. Defender has a lot of advantages over competing products."
"The solution comes as a part of Windows 10 and it is covered under its license."
"Even if you are not registered as a not-for-profit, the offering that they have is definitely worth consideration. This is in the sense that the E5 stack just gives you so many benefits. You get your entire productivity suite through Microsoft 365 apps. You get all your security and identity protection. You get the Defender for Endpoint and Defender for Identity. You get the cloud access security broker as well. You get Azure Active Directory Premium P2, which gives you so many good things that you can configure and deploy. You don't have to configure them on day one, but you have access to so many different tools that will protect your data, security, endpoints, and identities that you could build out a security strategy 18 months long, and slowly work your way through it, based on what you have available to you through your license."
"We sell this product as part of Office 365 and it is not expensive."
"Licensing fees are paid annually through a partner."
"The E5 license is the one that I recommend because it comes with Cloud App Security, which is a good thing to have on top of Microsoft Defender."
"Microsoft Defender for Endpoint is more affordable compared to some other endpoint solutions."
"The price for Microsoft Defender for Endpoint is about three euros, which is considered reasonably priced."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Government
11%
Financial Services Firm
9%
Comms Service Provider
8%
Computer Software Company
14%
Manufacturing Company
8%
Financial Services Firm
8%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Fortinet FortiSandbox?
The real-time analysis capability of FortiSandbox is beneficial for email analysis.
What is your experience regarding pricing and costs for Fortinet FortiSandbox?
I think it's affordable. For the six to seven months of usage, the cost has been reasonable.
What needs improvement with Fortinet FortiSandbox?
We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, ...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
 

Also Known As

FortiSandbox
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG
Petrofrac, Metro CSG, Christus Health
Find out what your peers are saying about Fortinet FortiSandbox vs. Microsoft Defender for Endpoint and other solutions. Updated: July 2025.
865,384 professionals have used our research since 2012.