Microsoft Defender for Endpoint vs Trellix Advanced Threat Defense comparison

Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense

Download the complete report

Helped 869,566 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Defender for Endp...

Ranking in Advanced Threat Protection (ATP)

3rd

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

198

Ranking in other categories

Endpoint Protection Platform (EPP) (2nd), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (5th)

Trellix Advanced Threat Def...

Ranking in Advanced Threat Protection (ATP)

21st

Average Rating

7.8

Reviews Sentiment

5.6

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of October 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Microsoft Defender for Endpoint is 9.0%, down from 9.6% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 2.0%, up from 1.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Advanced Threat Protection (ATP) Market Share Distribution
Product	Market Share (%)
Microsoft Defender for Endpoint	9.0%
Trellix Advanced Threat Defense	2.0%
Other	89.0%

Advanced Threat Protection (ATP)

Featured Reviews

NaySan @ Suraj Verma

Solution Consultant at BIM Group of Companies

Has effectively blocked sophisticated attacks and malicious activities while providing excellent support

Microsoft Defender for Endpoint is very good, but one suggestion is that in some products, we may need to configure security-related settings, whereas Microsoft Defender for Endpoint works completely differently, providing automatic recommendations and actions that we may need to perform ourselves. Regarding the pricing of Microsoft Defender for Endpoint, during the last three years, we set up the product and sold it, but we faced difficulties because Microsoft pricing is always the same. For example, whether I purchase Microsoft Defender for Endpoint for one year or for the next three years, the pricing remains constant with no discounts available. In contrast, competing products offer reduced pricing for long-term commitments, which makes it difficult for us in that environment. Microsoft should consider this option to remain competitive, but otherwise, everything else is fine.

Read full review

Philippe Panardie

RSSI at SDIS49

Ensuring long-term reliability while seeking internal email management enhancements

Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Its real-time security is the most valuable."

"Provides good vulnerability assessment."

"File protection is the most valuable feature. Antivirus security on the Level OS, Microsoft Defender, and Microsoft Guard for 2019."

"It has Kusto Query Language (KQL), so we can use our own queries to find anything."

"In my opinion, the most valuable aspects are the reporting analytics and integration with Sentinel. Defender does an excellent job of correlating the different entities that comprise threat analysis, analytics data, and log analytics. It helps to piece together investigations into any exploit or malicious activity within a specific tenant. AI and analytics tools are probably the most valuable components."

"One feature I like the most is vulnerability management, which shows any vulnerable software or OS present in my environment. Microsoft Defender for Endpoint provides a complete overview and also recommends the steps to mitigate the vulnerabilities or threats. Most of the other antivirus or EDR solutions generally don't provide vulnerability management. It is an add-on that Microsoft Defender for Endpoint provides."

"The most important and the most relevant features of Defender for Endpoint are the malware and ransomware protection."

"Defender provides useful alerts and groups them. It sends an alert to your portal if it detects any malicious activity, and you can group multiple alerts to form an incident."

More Microsoft Defender for Endpoint pros

"The fact that in 10 years, we have had no problem is the most valuable feature for us; it's really a washing machine, but the only problem we face is that it's difficult to report on this product."

"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."

"It is very scalable."

"The most valuable features are the administration console and its detection and response module."

"It is stable and reliable."

"Provides good exfiltration, and is an all-in-one product."

"It stops in excess of twenty-five malware events per month, all of which could be critical to the business."

"I recommend this solution because of its ease of use."

Cons

"Defender for Endpoint is complex, and the documentation is detailed. At the same time, it's hard to navigate sometimes. You have to go through tons of documentation to find what you want."

"The interface isn't necessarily intuitive to a nontechnical person. You can get stuck in the little endpoint security portal. Sometimes, if you uninstall a competitive product, the end user doesn't always know if it's running or if they're protected even though it's silently running. There could be a notification, widget, or something that's resident on the screen for at least a bit, especially if you're doing remote support. You want to talk them through it, but sometimes, we're not allowed to look at the PCs we support."

"Microsoft Defender for Endpoint's licensing is confusing. It has conflicting information on the website. We also faced integration issues with other systems. It makes laptops slower than traditional antivirus systems."

"If a threat actor comes in, and creates a global administrative account, they can gain access to everything and whitelist then block everything else. Having everything, including Defender, under one brand is like having all of your eggs in one basket."

"Microsoft Defender for Endpoint is secure but when it comes to security all solutions could improve security."

"There's a lot of manual effort involved to configure what we need."

"The onboarding and deployment could be more user-friendly, and there is room to grow in some of the reports. I don't want them to be oversimplified or overly complex, but there is room for improvement in the reporting it can do. It's relatively minor."

"This solution is not secure, which is why I have moved to Linux."

More Microsoft Defender for Endpoint cons

"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."

"I would like to see future versions of the solution incorporate artificial intelligence technology."

"This solution needs to be made "cloud ready"."

"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."

"We'd like them to be better at dealing with script threats."

"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."

"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."

"Lacks remote capabilities not dependent on the internet."

Pricing and Cost Advice

"We sell this product as part of Office 365 and it is not expensive."

"Compared to ESET, the pricing for Microsoft Defender for Endpoint is on the higher side."

"Most people don't realize M365/E5 licenses are an amazing deal. They think "Oh, it's expensive," and I'll ask, "Compared to what?" If you don't have it you will have to buy licenses for multiple products to fill the same security space that you would have gotten with the Microsoft product. Go figure out how much it costs you per product, per user, and then come back and tell me how things add up financially."

"I'm not too familiar with costs as I'm an architect, though I know about online pricing, as I help two teams with online purchasing and procurement. Nowadays, everyone has an enterprise agreement, such as an E3 license, which we provide to our customers."

"The cost is high for E5 licenses, but if we go with the E3 license, most of the features are not covered."

"Licenses depend upon what you are looking for and what kind of security do you want to implement. There are costs in addition to the standard licensing fees. When we used to buy Symantec, we used to spend on 100 licenses. We used to spend approximately $2,700 for those many licenses, and they came in packs. To add one more license, I had to buy a pack with a minimum of 10 licenses. I had to spend on nine extra licenses because I can't get a single license, whereas when we go for Microsoft, we can get as many licenses as we want. If I have 100 users today, and tomorrow, I have 90 users, I can release my 10 licenses next month. With any other software vendor, you buy licenses for one year, and you have to stick with that. If today you have 100 licenses, and tomorrow, you have 50, you have already paid for one year's license. You can't go back and tell them that I don't require these 50 licenses because I have lost my 50 users, but with Microsoft Defender, licensing is on a monthly basis. It gives you both options. You can go yearly and save on it, or you can go monthly. You will, again, save on it. It is very fair everywhere."

"Microsoft Defender for Endpoint comes with Windows 10, and it's free. But for you to be able to manage it in the cloud and use the console, you need to have either an Office 365 E5 subscription or a Microsoft M365 subscription. You need to buy an extra license."

"It is built into Windows 10. If our clients are using Microsoft Defender, the cost goes away for them."

More Microsoft Defender for Endpoint pricing and cost advice

"The product is expensive, but it is better than the rest of them in the industry."

"Our licensing fees for this solution are approximately one million dollars per year."

See which vendors are best for you

Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.

See recommendations

869,566 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

13%

Manufacturing Company

Government

Financial Services Firm

Government

16%

Comms Service Provider

14%

Performing Arts

11%

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	79
Midsize Enterprise	34
Large Enterprise	87

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	4
Large Enterprise	5

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...

Which offers better endpoint security - Symantec or Microsoft Defender?

We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...

How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?

The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...

What do you like most about McAfee Advanced Threat Defense?

I recommend this solution because of its ease of use.

What needs improvement with McAfee Advanced Threat Defense?

I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's necessary; today we have an MX interface, and it would be interesting to have an ...

What is your primary use case for McAfee Advanced Threat Defense?

We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex. With FireEye and Trellix, we only work with ETP now because the NDR function wh...

HP Wolf Security vs Microsoft Defender for Endpoint

Comparisons

Compared 5% of the time

CrowdStrike Falcon vs Microsoft Defender for Endpoint

Compared 5% of the time

F-Secure Total vs Microsoft Defender for Endpoint

Compared 4% of the time

Symantec Endpoint Security vs Microsoft Defender for Endpoint

Compared 4% of the time

Trellix Endpoint Security Platform vs Microsoft Defender for Endpoint

Compared 4% of the time

More Microsoft Defender for Endpoint Competitors

Fortinet FortiSandbox vs Trellix Advanced Threat Defense

Compared 32% of the time

Check Point Infinity vs Trellix Advanced Threat Defense

Compared 25% of the time

Microsoft Defender for Identity vs Trellix Advanced Threat Defense

Compared 25% of the time

Microsoft Defender for Office 365 vs Trellix Advanced Threat Defense

Compared 19% of the time

More Trellix Advanced Threat Defense Competitors

Product Reports

Microsoft Defender for Endpoint

Download Microsoft Defender for Endpoint product report

Trellix Advanced Threat Defense

Download Trellix Advanced Threat Defense product report

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus

McAfee Advanced Threat Defense

Interactive Demo

Microsoft

Demo not available

Trellix

Overview

Microsoft Defender for Endpoint is a comprehensive security solution that provides advanced threat protection for organizations. It offers real-time protection against various types of cyber threats, including malware, viruses, ransomware, and phishing attacks.

With its powerful machine-learning capabilities, it can detect and block sophisticated attacks before they can cause any harm. The solution also includes endpoint detection and response (EDR) capabilities, allowing organizations to quickly investigate and respond to security incidents. It provides detailed insights into the attack timeline, enabling security teams to understand the scope and impact of an incident.

Microsoft Defender for Endpoint also offers proactive threat hunting, allowing organizations to proactively search for and identify potential threats within their network. It integrates seamlessly with other Microsoft security solutions, such as Microsoft Defender XDR, to provide a unified and holistic security approach. With its centralized management console, organizations can easily deploy, configure, and monitor the security solution across their entire network.

Microsoft Defender for Endpoint is a robust and scalable security solution that helps organizations protect their endpoints and data from evolving cyber threats.

Microsoft

Powerful advanced threat detection

Uncover Hidden Threats

Combine in-depth static code analysis, dynamic analysis (malware sandboxing), and machine learning to increase zero-day threat and ransomware detection.

Threat Intelligence Sharing

Immediately share threat intelligence across your entire infrastructure—including multi-vendor ecosystems—to reduce time from threat encounter to containment.

Enable Investigation

Validate threats and access critical indicators of compromise (IoCs) needed for investigation and threat hunting.

Trellix

Sample Customers

Petrofrac, Metro CSG, Christus Health

The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust

Microsoft Defender for Endpoint vs. Trellix Advanced Threat Defense