Try our new research platform with insights from 80,000+ expert users

Mandiant Advantage vs Microsoft Defender XDR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 15, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Mandiant Advantage
Ranking in Extended Detection and Response (XDR)
26th
Average Rating
8.4
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Attack Surface Management (ASM) (5th)
Microsoft Defender XDR
Ranking in Extended Detection and Response (XDR)
3rd
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
101
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Microsoft Security Suite (3rd)
 

Mindshare comparison

As of July 2025, in the Extended Detection and Response (XDR) category, the mindshare of Mandiant Advantage is 1.0%, up from 0.7% compared to the previous year. The mindshare of Microsoft Defender XDR is 6.2%, down from 8.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR)
 

Featured Reviews

SameepAgarwal - PeerSpot reviewer
In-depth traffic analysis and proactive support reduce investigation time
The live IOC feed identifies the type, technique, and tactics used. This becomes handy since then I know what to refer to from the playbook. For instance, if I take a use case of someone with Mimikatz installed on their system, knowing the nature beforehand reduces investigation time. I can quickly apply the playbook to resolve incidents in less time.
Gabor Nyerd - PeerSpot reviewer
Includes four services and four products, which can help organizations a lot
We found that sometimes integrations work, but testing them can take some time. Sometimes, configurations take much longer than expected. We have a configuration in place that needs to be synchronized with another server. However, the servers are four hours apart, so this can cause delays. In general, I believe that the time it takes to configure and test a service should be shorter. Sometimes, it can take a couple of hours to test a single configuration setting. Other times, it is only ten or fifteen minutes, which is normal. However, sometimes, even immediate actions can be triggered by configuration changes, and some settings can take up to eight hours to complete. I believe that this time can be improved. Microsoft is making a lot of improvements to its services in a short period of time. This is a good thing, as it means that the services are constantly being updated and improved. However, it can be challenging for customers to keep up with the changes. For example, a customer may read about an update, understand it, and share it with their colleagues and boss. However, it may take days or weeks to test the update and get the necessary approvals. This can be especially challenging for large customers with many users or machines. In some cases, Microsoft may change a service before the customer has had a chance to implement the previous update. This can be frustrating for customers, as it means that they have to constantly learn new things and adjust their workflows. On the one hand, it is important for Microsoft to keep updating and improving its services. This helps to ensure that the services are meeting the customers' needs and that they are staying ahead of the competition. Microsoft should also be mindful of the challenges that these changes can create for customers. One way to address this challenge is to provide customers with more time to implement changes. Microsoft could also provide more information about upcoming changes so that customers can plan ahead. Ultimately, Microsoft needs to strike a balance between keeping its services up-to-date and providing customers with a smooth transition to new features.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is so valuable to have someone performing these functions outside of our business hours when we don't have staff in the building. We've seen a lot of solid metrics on the amount of malware that it's detecting and resolving. We're pleased with it so far."
"The live IOC feed identifies the type, technique, and tactics used."
"I have never faced stability issues."
"The feature I have found most valuable is directory monitoring. We experienced an instance of threat actors trying to ensure a complex and massive attack against our customer's infrastructure on the forum. That is, they were animating people on a formum. The solution alerted us to this two days ahead of the attack, which gave us plenty of time to prepare for it."
"The scalability of Mandiant Advantage deserves a ten out of ten."
"The advantage of the solution is being able to go look up threat actors and get a lot of detailed information about different attacks and different tactics and general information about threats."
"Mandiant Advantage is excellent at providing the full context and all the information, where the information was found, and the full data, including the raw data that was uploaded onto the Internet."
"The 'Incidents and Alerts' tab is a valuable feature where we can find triggered alerts."
"The solution is well integrated with applications. It is easy to maintain and administer."
"In our company,we have faced multiple attacks over the last few months, but none of them have been successful, and I think Microsoft Defender XDR has played a major role in it."
"The biggest return on investment when using Microsoft Defender XDR for me is saving time for the most part."
"The comprehensiveness of Microsoft's threat detection is good."
"The common and advanced security policies for threat hunting and blocking attacks are valuable."
"We also use Microsoft Sentinel, Defender for Cloud, Defender for Identity, and Microsoft Defender for Cloud Apps. They are all integrated and it was very easy to integrate them. In my experience with the integrations, it was just a click of a button and things were integrated. It's just a button."
"The feature I find most valuable is Defender for Endpoint."
 

Cons

"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"Collaboration of data in my view becomes a bit clogged, requiring effort to understand visually."
"I think that the data query that is used for data cloud language should be improved. It's really hard to query actual data from the platform."
"They could have better support. Now that they've merged, they are moving towards a portal system, which isn't very helpful."
"I have already given them feedback that their UI needs improvement since sometimes there is a lag. The side-by-side depiction of request response and action clogs the screen."
"Mandiant's on-prem client is too processor-intensive, so it's putting a strain on the local device's CPU. When a scan is running on the device, the other processing tasks slow to a crawl. We're still trying to figure out the correct settings for the client."
"Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives."
"It would be beneficial to have a more seamless experience with everything consolidated in one place, particularly when dealing with aspects related to the Exchange console."
"Microsoft 365 Defender does not have a unique package with emerging endpoint security technologies, such as EDR and XDR."
"The technical support from Microsoft Defender XDR has been disappointingly slow, to the point that I am considering not renewing my unified support contract."
"There is no comprehensive visibility, making it less user-friendly."
"The design of the user interface could use some work. Sometimes it's hard to find the exact information you need."
"Because of the training model, Defender XDR's automatic response sometimes blocks legitimate users and activities. Also, the UI sometimes responds slowly."
"At times, there may be delays in the execution of certain actions and their effects."
"Stability could be improved by avoiding frequent changes to the interface."
 

Pricing and Cost Advice

Information not available
"While the standalone price of Defender XDR might seem high, its value becomes clear when considering the ease of implementation and smooth integration with our existing Microsoft infrastructure, especially when bundled with other Microsoft products."
"It has consistently offered highly appealing academic pricing, with distinct rates for higher education and general educational purposes."
"On average, we pay around 55 euros per user for the services and features we receive."
"It is 15 dollars per server per month. It is worth it, but it can be costly. It depends on the company's size."
"For Defender, they have Endpoint Plan 1 and Endpoint Plan 2, but I don't know on what basis they have classified Endpoint Plan 1 and Plan 2, but it has given me enough pain to pick and design Endpoint Plan 1 or Endpoint Plan 2 for my organization. In fact, we are still struggling with it. Too many SKUs are confusing. There should not be too many SKUs, and they shouldn't charge for every new feature."
"The functionality is fantastic, but for medium and small-sized companies it's overpriced. It would be better if it were a little bit cheaper."
"Microsoft Defender XDR is expensive."
"The bundling of software makes it easier to manage our setup, but Microsoft purposefully obfuscates this through marketing ploys to hide costs."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
859,957 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
12%
Manufacturing Company
8%
Government
7%
Computer Software Company
17%
Financial Services Firm
9%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What needs improvement with Mandiant Advantage?
Sometimes Mandiant Advantage becomes noisy when dealing with widely recognized companies due to false positives. More fine-tuning is required to handle famous company names. It also handles alerts ...
What is your primary use case for Mandiant Advantage?
I use it for cyber threat intelligence. I gather information about newly created domains around the Internet that can be related to my managed company. I monitor these domains for any phishing acti...
What advice do you have for others considering Mandiant Advantage?
I would advise exploring multiple functions because there are many different capabilities of Mandiant Advantage. For small organizations, try every feature included in the package. Use known source...
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise.
What is your experience regarding pricing and costs for Microsoft 365 Defender?
The pricing for Microsoft Sentinel operates on a pay-as-you-go model based on data ingestion. I recall that Defender XDR pricing is based on the number of endpoints.
What needs improvement with Microsoft 365 Defender?
For Microsoft Defender XDR ( /categories/extended-detection-and-response-xdr ), there is currently no ability to reset passwords for on-premises accounts, which is a key challenge. Incident managem...
 

Also Known As

Mandiant Threat Intelligence
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
 

Overview

 

Sample Customers

Stater Bros. Markets, Rush Copley, Blackboat, CapWealth
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Find out what your peers are saying about Mandiant Advantage vs. Microsoft Defender XDR and other solutions. Updated: June 2025.
859,957 professionals have used our research since 2012.