Microsoft Defender for Endpoint vs Trellix Advanced Threat Defense comparison

Why PeerSpot?

Microsoft and Trellix are both solutions in the Advanced Threat Protection (ATP) category. Microsoft is ranked #6 with an average rating of 8.4, while Trellix is ranked #21 with an average rating of 9.0. Microsoft holds a 5.6% mindshare in ATP, compared to Trellix’s 2.1% mindshare. Additionally, 95% of Microsoft users are willing to recommend the solution, compared to 76% of Trellix users who would recommend it.

Microsoft Defender for Endp...

Read 212 Microsoft Defender for Endpoint reviews

50,163 Views
4,013 Comparison Views

95% willing to recommend

Trellix Advanced Threat Def...

Read 9 Trellix Advanced Threat Defense reviews

2,071 Views
1,740 Comparison Views

76% willing to recommend

Microsoft Defender for Endp...

Trellix Advanced Threat Def...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 1, 2024

Trellix Advanced Threat Defense and Microsoft Defender for Endpoint compete in the cybersecurity market, focusing on defending against advanced cyber threats. Data analysis shows Microsoft Defender for Endpoint has an upper hand due to its broad feature set, despite Trellix offering advantageous pricing and support.

Features: Trellix Advanced Threat Defense excels in real-time sophisticated threat detection, automated incident responses, and strong threat analysis capabilities. Microsoft Defender for Endpoint stands out with integrated threat intelligence, multi-platform support, and high-quality threat analytics.

Room for Improvement: Trellix could enhance user interface intuitiveness, expand integration capabilities, and optimize threat intelligence updates. Microsoft Defender for Endpoint could improve its initial cost structure, enhance feature customization, and streamline cross-platform interoperability.

Ease of Deployment and Customer Service: Trellix Advanced Threat Defense offers a streamlined deployment process with rich support options, although it can be complex due to customization needs. Microsoft Defender for Endpoint benefits from easy integration within Microsoft environments, backed by comprehensive support documents, making its deployment more straightforward.

Pricing and ROI: Trellix Advanced Threat Defense provides competitive pricing and substantial ROI for budget-conscious organizations. Microsoft Defender for Endpoint, while carrying a higher initial cost, justifies this through its extensive features and long-term integration benefits, making the investment worthwhile in the long run.

To learn more, read our detailed Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense Report (Updated: November 2026).

Buyer's Guide

Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense

November 2026

Download the complete report

Helped 920,929 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Defender for Endp...

Ranking in Advanced Threat Protection (ATP)

6th

Average Rating

8.2

Reviews Sentiment

7.0

Number of Reviews

212

Ranking in other categories

Endpoint Protection Platform (EPP) (2nd), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (3rd), Agentic Endpoint Security (3rd)

Trellix Advanced Threat Def...

Ranking in Advanced Threat Protection (ATP)

21st

Average Rating

7.8

Reviews Sentiment

5.6

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of November 2026, in the Advanced Threat Protection (ATP) category, the mindshare of Microsoft Defender for Endpoint is 5.6%, down from 7.6% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 2.1%, up from 1.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Advanced Threat Protection (ATP) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender for Endpoint	5.6%
Trellix Advanced Threat Defense	2.1%
Other	92.3%

Advanced Threat Protection (ATP)

Featured Reviews

Robert Arbuckle

Security Analyst III at a healthcare company with 10,001+ employees

Automatically isolates threats and integrates with logging to reduce response time

Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.

Read full review

Philippe Panardie

RSSI at SDIS49

Ensuring long-term reliability while seeking internal email management enhancements

Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"As it is, the solution offers great malware features, is ranked pretty highly in Gartner and is easy to implement and use."

"Microsoft Defender can block some viruses or malware, so it can protect my files, and it can save files on Office 365 OneDrive, where I use encryption for some files and can then recover them from OneDrive."

"The initial setup is not difficult or complex; it's very simple and straightforward."

"Defender for Endpoint has one dashboard with security-related information, vulnerability-related information, and basic recommendations from Microsoft, all in different tabs. That's helpful because if we want to fix only the recommended ones, we can go fix all of them..."

"Web filtering is the most valuable feature of Microsoft Defender for Endpoint because it effectively maintains security for website access."

"Microsoft Defender for Endpoint has changed significantly for the better."

"One of the main features is the solution is very light on resources and we do not have any problems with it."

"The most valuable features are that it's easy to use and the updates are very simple."

More Microsoft Defender for Endpoint pros

"It is stable and reliable."

"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."

"It is very scalable."

"I see ROI, as it stops in excess of twenty-five malware events per month, all of which could be critical to the business."

"I recommend this solution because of its ease of use."

"The product is expensive, but it is better than the rest of them in the industry."

"If a system admin can put in the patience to read and constantly update the ePO system in terms of rules, enforcing them at regular intervals, you can safely go to sleep every night."

"The most valuable features are the administration console and its detection and response module."

More Trellix Advanced Threat Defense pros

Cons

"When you get the right person that knows what you are asking the first time, it is excellent. However, when you get someone who may be new or just switched into that role, it can be less effective."

"The major area for improvement is the integration with a managed service provider. We use Microsoft partners to help govern the platform, and as part of an alliance, we want to gather data from each tenant and combine them for a complete view. This process has been complicated, though it has gotten better."

"Some of the integrations that Defender should include involve the use of the web app."

"We encountered some misbehavior between Microsoft Office Suite and Defender. We had issues of old macros being blocked and some stuff going around the usage of Win32 APIs. There is some improvement between the Office products and Defender, and there is a bunch of stuff that you can configure in your antivirus solutions, but you have several baselines, such as security baselines for Edge, security baselines for Defender, and security baselines for MDM. You have configuration profiles as well. So, there a lot of parts where we can configure our antivirus solution, and we're getting conflicting configurations. This is the major part with which we're struggling in this solution. We are having calls and calls with Microsoft for getting rid of all configuration conflicts that we have. That's really the part that needs to be improved."

"Sometimes it is a little lacking, but for the most part, they are able to provide exactly what I need."

"The file scanning has room for improvement. Many people use macros within their files, so there should be a mechanism that helps us to scan them for malicious payloads."

"Microsoft Defender for Endpoint's licensing is confusing. It has conflicting information on the website. We also faced integration issues with other systems. It makes laptops slower than traditional antivirus systems."

"This solution needs to move beyond relying on virus definitions alone and protect the system using behavioral analysis of the processes that are running."

More Microsoft Defender for Endpoint cons

"I would like to see future versions of the solution incorporate artificial intelligence technology."

"Lacks remote capabilities not dependent on the internet."

"This solution needs to be made "cloud ready"."

"We'd like them to be better at dealing with script threats."

"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."

"This product does the job, but it is not flexible enough to do new environments yet."

"It was not complex, but there are things to look out for, because it's an intense product. It scans intensely and there are major obstacles to overcome if it scans while users are using a network, then it is not a good thing."

"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."

More Trellix Advanced Threat Defense cons

Pricing and Cost Advice

"It is built into Windows 10. If our clients are using Microsoft Defender, the cost goes away for them."

"For me, the pricing is very good, but for management it's very expensive. Other solutions are less expensive. But when I present all the information and all the reports they say, "Well, it's expensive, but the cost-benefit is very good.""

"The E5 license is the one that I recommend because it comes with Cloud App Security, which is a good thing to have on top of Microsoft Defender."

"The solution is free and comes with Windows."

"The price is fair for the features Microsoft delivers. If you want tailor-made features, you have to mix different licenses. It isn't straightforward."

"The subscription is part of Windows, so we don't have to pay anything extra for this product."

"If we are acquiring everything in a single place, the front end becomes cost-effective."

"The solution is free with Windows."

More Microsoft Defender for Endpoint pricing and cost advice

"Our licensing fees for this solution are approximately one million dollars per year."

"The product is expensive, but it is better than the rest of them in the industry."

See which vendors are best for you

Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.

See recommendations

920,929 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

10%

Financial Services Firm

Comms Service Provider

Outsourcing Company

Construction Company

15%

Outsourcing Company

15%

Financial Services Firm

13%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	82
Midsize Enterprise	44
Large Enterprise	97

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	4
Large Enterprise	5

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...

See all answers

Which offers better endpoint security - Symantec or Microsoft Defender?

We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...

See all answers

How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?

The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...

See all answers

What needs improvement with McAfee Advanced Threat Defense?

I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's necessary; today we have an MX interface, and it would be interesting to have an ...

See all answers

What is your primary use case for McAfee Advanced Threat Defense?

We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex. With FireEye and Trellix, we only work with ETP now because the NDR function wh...

See all answers

What advice do you have for others considering McAfee Advanced Threat Defense?

See all answers

Comparisons

Cortex XDR by Palo Alto Networks vs Microsoft Defender for Endpoint

Compared 8% of the time

OpenText Core Endpoint Protection vs Microsoft Defender for Endpoint

Compared 7% of the time

CrowdStrike Falcon vs Microsoft Defender for Endpoint

Compared 3% of the time

Symantec Endpoint Security vs Microsoft Defender for Endpoint

Compared 3% of the time

SentinelOne Singularity Endpoint vs Microsoft Defender for Endpoint

Compared 3% of the time

More Microsoft Defender for Endpoint Competitors

NetWitness Platform vs Trellix Advanced Threat Defense

Compared 18% of the time

Microsoft Defender for Office 365 vs Trellix Advanced Threat Defense

Compared 8% of the time

Fortinet FortiSandbox vs Trellix Advanced Threat Defense

Compared 8% of the time

Digital Guardian vs Trellix Advanced Threat Defense

Compared 6% of the time

Barracuda CloudGen Firewall vs Trellix Advanced Threat Defense

Compared 3% of the time

More Trellix Advanced Threat Defense Competitors

Product Reports

Buyer's Guide

Microsoft Defender for Endpoint

October 2026

Download Microsoft Defender for Endpoint product report

Buyer's Guide

Trellix Advanced Threat Defense

October 2026

Download Trellix Advanced Threat Defense product report

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus

McAfee Advanced Threat Defense

Interactive Demo

Microsoft

Demo not available

Trellix

Overview

Microsoft Defender for Endpoint provides comprehensive threat protection that integrates well with current systems, offering proactive threat detection and automatic updates while reducing manual efforts.

The platform is designed for seamless integration with Microsoft products, facilitating efficient management and use. It offers proactive ransomware protection and valuable threat intelligence, crucial for timely response and increased visibility across devices. Users highlight its ability to secure endpoints from viruses and malware, integrating with Windows and Office 365 to enhance real-time detection capabilities in diverse environments, including hybrid and on-premises setups. However, enhancements are needed in Linux integration, detection accuracy, and policy implementations.

What are the key features of Microsoft Defender for Endpoint?

Seamless Integration: Works smoothly with existing systems and Microsoft products for easy management.
Proactive Threat Detection: Advanced monitoring to identify and mitigate threats swiftly.
Ransomware Protection: Built-in features to protect against ransomware attacks automatically.
Centralized Management: Unified platform for better device visibility and collaboration.
Threat Intelligence: Provides critical data for rapid threat response.

What benefits should be evaluated in Microsoft Defender for Endpoint?

Cost-Effectiveness: Part of Windows bundles, offering comprehensive security at competitive pricing.
Time Efficiency: Reduces manual oversight with automatic updates and management ease.
Real-Time Detection: Enhanced security through seamless Office 365 and Windows integration.
Device Coverage: Supports hybrid and on-premises environments for varied digital infrastructures.

Microsoft Defender for Endpoint is implemented across industries for securing endpoints, relying on its deep integration with Windows and Office 365 to protect against malware and viruses. Organizations benefit from its real-time detection and comprehensive management capabilities, particularly in hybrid environments where diverse digital infrastructures need safeguarding.

Microsoft

Trellix Advanced Threat Defense offers efficient threat detection and automatic threat remediation, featuring seamless management and integration with operating systems and extensions.

Providing robust malware defense, Trellix Advanced Threat Defense is easy to set up and use. Its components work collaboratively, with standout features like behavioral analysis, retro-inspection, and ePolicy Orchestration. Despite its strengths, users suggest improvements in Active Directory integration, cloud readiness, artificial intelligence, and faster sandboxing. The API interface and scalability need enhancement, while better compatibility with platforms like Cisco could elevate its function. Effective for server and endpoint security, it effectively blocks threats like WannaCry and disperses attack data through the DXL client quickly.

What are the notable features of Trellix Advanced Threat Defense?

Management and Automatic Threat Remediation: Facilitates seamless management and handling of threats.
Effective Threat Detection and Response: Delivers efficient and reliable threat detection capabilities.
Behavioral Analysis and Retro-Inspection: Offers advanced analysis for comprehensive threat identification.
ePolicy Orchestration: Streamlines processes for enhanced threat management.
Scalability and Price: Provides a stable and scalable solution at a competitive price point.

What key benefits can be identified from reviews?

Ease of Use and Setup: Known for its straightforward implementation and user-friendly interface.
Integration Capabilities: Works well with different operating systems and technologies like Palo Alto firewalls.
Threat Protection Efficiency: Proven effectiveness in stopping threats such as WannaCry.
Rapid Attack Information Dissemination: Utilizes the DXL client for quick data sharing.

Trellix Advanced Threat Defense is widely used across numerous industries for server and desktop protection, ensuring endpoint security and halting attacks without failure. Its integration with diverse technologies enhances protection in varied environments, making it a valuable tool in enterprise security management.

Trellix

Sample Customers

Petrofrac, Metro CSG, Christus Health

The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust

Buyer's Guide

Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense

November 2026

Free Report: Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense

Find out what your peers are saying about Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense and other solutions. Updated: November 2026.

DOWNLOAD NOW

920,929 professionals have used our research since 2012.

See our Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense report.

See our list of best Advanced Threat Protection (ATP) vendors.

We monitor all Advanced Threat Protection (ATP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.