Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Endpoint vs Trellix Advanced Threat Defense comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 1, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Endp...
Ranking in Advanced Threat Protection (ATP)
4th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
197
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (5th)
Trellix Advanced Threat Def...
Ranking in Advanced Threat Protection (ATP)
21st
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
8
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Microsoft Defender for Endpoint is 9.0%, down from 10.6% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 1.9%, up from 1.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP)
 

Featured Reviews

John Rallo - PeerSpot reviewer
Offers excellent visibility into vulnerabilities and the attack surface itself
Attack surface reduction and limiting attack surface vectors are valuable features. It's helpful to isolate specific devices and get super granular with the features they offer. The visibility into the attack surface is good. It gets highly granular. I don't work on that side, but the people who do tell me they get more visibility.
HS
Easy to set up and use with a nice interface
The scalability could be better. We'd like them to be better at dealing with script threats. In sandboxing, the time to respond is slower than we would like. We'd like them to be able to process faster. For example, Fortinet, they are doing 18,000 files per hour. For Wildfire, it is elastic. It can support as many files as you get. McAfee doesn't react like that. It does not support interfaces with HTTPS.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's not really visible for the user - which is a benefit."
"A few years ago, when I was using a different product, I was affected by a virus that destroyed everything. Since using Microsoft Defender, I have not had this kind of problem."
"Easy to understand and easy to set up endpoint security solution. It's a multifeatured product with web content filtering and automated investigation features. It also has a fantastic vulnerability management dashboard."
"Defender works in the background monitoring the traffic for viruses."
"The most valuable feature is that it comes with the package, so there is no additional installation of third-party software. It's also easy to use."
"Integration between Microsoft products is very easy."
"The integration with all variations of Microsoft Defender, for Endpoint, 365, and Cloud is valuable."
"I like that Defender is integrated and doesn't have a third-party payload trying to advertise subscription renewal."
"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."
"Provides good exfiltration, and is an all-in-one product."
"I recommend this solution because of its ease of use."
"The most valuable features are the administration console and its detection and response module."
"It stops in excess of twenty-five malware events per month, all of which could be critical to the business."
"It is stable and reliable."
"It is very scalable."
 

Cons

"I would like to see improvements made to how it secures activities on web pages."
"The solution could use improvement on the interface."
"The solution should be updated by Microsoft with new features from time to time."
"Something that is unique to Microsoft is its licensing model. When you go out and you buy McAfee or Symantec, you know what you're getting out of the box, but with Microsoft, often, when you're looking to achieve a certain set of capabilities, those capabilities are spread across different products. You might try to do something you could do with CrowdStrike, but then find out that you also need to purchase Microsoft Defender for Identity or Microsoft Defender for Azure. You realize that when they talk about what they can offer within the Microsoft platform, it's really the suite of investments. So, sometimes, you may find yourself buying Defender for Endpoint thinking that it matches CrowdStrike, but then you find that Microsoft really needs to sell you something else. One plus one will equal three, but when you have a very concise platform, such as CrowdStrike, you know what you're going to get."
"Our team's knowledge of the solution needs to be improved, and Microsoft could do a better job conveying the necessary information to users. We could proactively use the tool more and explore capabilities we are not yet utilizing."
"With regards to the interface, a challenge I found was that there was not enough documentation on how to tune it. I had to read multiple sources on the internet to learn how to configure the tool appropriately."
"The reporting in Microsoft Defender for Endpoint should improve. The solution has limited features."
"Defender could be more secure and stable."
"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."
"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."
"Lacks remote capabilities not dependent on the internet."
"This solution needs to be made "cloud ready"."
"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."
"I would like to see future versions of the solution incorporate artificial intelligence technology."
"We'd like them to be better at dealing with script threats."
 

Pricing and Cost Advice

"Microsoft Defender for Endpoint comes with Windows 10, and it's free. But for you to be able to manage it in the cloud and use the console, you need to have either an Office 365 E5 subscription or a Microsoft M365 subscription. You need to buy an extra license."
"The solution is free."
"When compared with other vendors, the pricing is very high."
"The license for Microsoft Windows covers Microsoft Defender for Endpoint."
"The cost is high for E5 licenses, but if we go with the E3 license, most of the features are not covered."
"The product is free of charge and comes integrated into Windows."
"The nice thing about Defender and Sentinel is that the cost is based on the data logs that you ingest from the Defender endpoints and data connectors. I don't have to buy a 25- or 50- or 1,000-user or enterprise license. I can buy one license at a time."
"They are now doing it on an endpoint basis. It is based on the number of endpoints, which is good."
"Our licensing fees for this solution are approximately one million dollars per year."
"The product is expensive, but it is better than the rest of them in the industry."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Manufacturing Company
8%
Financial Services Firm
8%
Government
8%
Government
18%
Comms Service Provider
13%
Financial Services Firm
11%
Computer Software Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What do you like most about McAfee Advanced Threat Defense?
I recommend this solution because of its ease of use.
What needs improvement with McAfee Advanced Threat Defense?
There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client.
What is your primary use case for McAfee Advanced Threat Defense?
We use the solution for client management and security. We used the whole suite for client Firewall, antivirus, and everything provided by Trellix.
 

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
McAfee Advanced Threat Defense
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Petrofrac, Metro CSG, Christus Health
The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust
Find out what your peers are saying about Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense and other solutions. Updated: July 2025.
865,384 professionals have used our research since 2012.