We performed a comparison between Microsoft Defender for Endpoint and Trend Micro Deep Security based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.
Comparison Results: Microsoft Defender for Endpoint comes out on top in this comparison. It is flexible and performs well. In addition, it is less expensive than Trend Micro Deep Security and has an impressive ROI.
"I'm only using the AMP (advanced malware protection) which is protecting my file system from all the malicious things that might happen. It should protect all kinds of things that might happen on the servers, things that I cannot see."
"The integration with other Cisco products seemed to be really effective. We had Umbrella in place and we were using AnyConnect as well as Firepower. Once a threat was detected, being able to do the threat lookups and the live tracking was really useful."
"It is extensive in terms of providing visibility and insights into threats. It allows for research into a threat, and you can chart your progress on how you're resolving it."
"Definitely, the best feature for Cisco Secure Endpoint is the integration with Talos. On the backend, Talos checks all the signatures, all the malware, and for any attacks going on around the world... Because Secure Endpoint has a connection to it, we get protected by it right then and there."
"The most valuable feature is its threat protection and data privacy, including its cyber attack and data protection, as we need to cover and protect data on user devices."
"appreciate the File Trajectory feature, as it's excellent for an analyst or mobile analyst. I can track everything that happens on our server from my PC or device. Integration with SecureX is a welcome feature because it connects Cisco's integrated security portfolio with our complete infrastructure. Sandboxing is helpful, and integration with the Cisco environment is excellent as we use many of their products, and that's very valuable for us."
"Another of my favorite features is called the Device Trajectory, where it shows everything that's going on, on a computer. It shows the point in time when a virus is downloaded, so you can see if the user was surfing the internet or had a program open. It shows every running process and file access on the computer and saves it like a snapshot when it detects something malicious. It also has a File Trajectory, so you can even see if that file has been found on any of your other computers that have AMP."
"The threat Grid with the ability to observe the sandboxing, analyze, and perform investigations of different malicious files has been great."
"Defender for Endpoint has one dashboard with security-related information, vulnerability-related information, and basic recommendations from Microsoft, all in different tabs. That's helpful because if we want to fix only the recommended ones, we can go fix all of them..."
"The stability keeps getting better and better."
"The primary advantage is that you don't need to install it. It's included in the Windows 10 delivery."
"The best thing I like about it is its interaction with the other Defender products. It provides the ability to push telemetry up. It gives me endpoint visibility and allows me to take automated actions."
"Stable endpoint manager, antivirus, and antimalware, with fast technical support and a straightforward setup."
"The solution provides protections and reports about strange behavior and automatically blocks some of it. I love the way that statuses are represented."
"One of the features which differentiates it from other EDR providers is the Automated Investigation and Response, which reduces the workload of SOC analysts or engineers. They don't have to manually investigate each and every alert on the endpoint, since it does so automatically. And you can automate the investigation part."
"We have just started to implement it. It is useful for protection from malware and ransomware."
"The traceback feature in XDR is amazing. You can trace back an attack. You can playback where an attack actually occurred and see how the attacker moved. We can easily show this to management, and it makes it easy to make them understand and convince them, which is the best thing."
"Aside from the basic antivirus features, there are additional features such as vulnerability protection, firewall, etc. which are helpful."
"Easy to scale, stable solution for workload and server security and protection. It's easy to set up and has a good ransomware protection feature."
"We've found stability to be great so far."
"Support and threat prevention are the most valuable features of this solution."
"It provides security and protection. The endpoint firewall is valuable."
"Deep Security's most valuable features are antivirus and host intrusion detection."
"It is stable and we have not faced any challenges during the rolled out"
"This product has issues with the number of false positives that it reports."
"The Linux agent is a simple offline classic agent, and it doesn't support Secure Boot, which is important to have on a Linux machine. The Linux agent has conflicts with other solutions, including the Exploit Prevention system found in Windows servers. We didn't find a fix during troubleshooting, and Cisco couldn't offer one either. Eventually, we had to shut down the Exploit Prevention system. We didn't like that as we always want a solution that can fit smoothly into the setup without causing problems, especially where security is concerned. The tool also caused CPU spikes on our production machine, and we were seriously considering moving to another product."
"In terms of the user experience, if the UX design could be much simpler [that would improve things]... if they could make it more intuitive for someone who is not an engineer so that they still can read what's going on in their webpage and understand, that would be something."
"In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms. There isn't enough information to help us with what we're looking for and why we are looking for it with this query. There are probably a dozen queries in there that really focus on what I need to focus on, but they are not always easy to find the first time through."
"An easier way to do deduplication of machines, or be alerted to the fact that there's more than one instance of a machine, would be useful... That way you could get a more accurate device count, so you're not having an inflated number."
"The GUI needs improvement, it's not good."
"They could improve the main dashboard to more clearly show me the things that I want to see. When I open the dashboard right now, I see a million things and they are not always the things that I need."
"We had a lot of noise at the beginning, and we had to turn it down based on exclusions, application whitelisting, and excluding unknown benign applications. Cisco should understand the need for continuous updates on the custom Cisco exclusions and the custom applications that come out-of-the-box with the AMP for Endpoints."
"They can improve it on the online protection front since people nowadays are moving online and working from home."
"Additional security would be beneficial."
"There are some areas in the proactive threats that are just overwhelming the SOC, so we've had to turn those off until we can figure out how to filter out the false positives."
"The frequency of the patching, and the frequency of the updates, are not included with the free version."
"If there were more template queries in the library, that would make it much easier. They could have basic things, like, "Where's the IP for this user?" or, "What file was downloaded from this user?" If there were more of those basic queries that would help."
"Its price could be better."
"They're in the process of pulling more things together. They can continue with the integrations and provide a better way of seeing the impact of security changes, especially on the endpoint side. Before we actually flip the switch, we should be able to see the impact of security changes on the business or business applications. It would prevent breaking any business applications."
"I wish they would extend the use of the Security Central portal, even for the free option of Defender. Because, as companies grow, it is labor intensive to manage the AV and detection part of it. For companies already subscribed to Office 365, I think this would be a good enhancement."
"We have had some issues when it drains some of the resources of the server."
"What this product lacks at this stage is the ability to have automated workbooks to do the response. At this stage, the response is more manual, and it is not automated. If there is a response functionality in Deep Security, similar to what we have in EDR these days, to automatically respond to some of the threats, it would be cool. So, we'd like to have an automated response. There should be a response functionality."
"Some of the reporting and integrations could be more robust."
"I think more work could be done on Deep Security's ability to handle dynamic threat scenarios."
"Trend Micro Deep Security security and scalability could be improved."
"We'd like to see extended capacity in the on-premises versions."
"Deep Security's reporting functionality could be improved."
"I would like to see better pricing. The pricing could be lower."
More Microsoft Defender for Endpoint Pricing and Cost Advice →
Microsoft Defender for Endpoint is ranked 1st in EPP (Endpoint Protection for Business) with 123 reviews while Trend Micro Deep Security is ranked 1st in Virtualization Security with 27 reviews. Microsoft Defender for Endpoint is rated 8.0, while Trend Micro Deep Security is rated 8.4. The top reviewer of Microsoft Defender for Endpoint writes "Enables ingestion of events directly into your SIEM/SOAR, but requires integration with all Defender products to work optimally". On the other hand, the top reviewer of Trend Micro Deep Security writes "Scalable and secure with an easy initial setup". Microsoft Defender for Endpoint is most compared with Sophos Intercept X, CrowdStrike Falcon, Symantec Endpoint Security, Cortex XDR by Palo Alto Networks and Check Point Harmony Endpoint, whereas Trend Micro Deep Security is most compared with Trend Micro Apex One, CrowdStrike Falcon, Carbon Black CB Defense, SentinelOne and Symantec Endpoint Security.
We monitor all EPP (Endpoint Protection for Business) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
