Microsoft Defender for Endpoint vs Zscaler Client Connector comparison

Microsoft Defender for Endpoint vs. Zscaler Client Connector

Download the complete report

Helped 902,456 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of June 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.5%, down from 4.0% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 5.9%, down from 10.5% compared to the previous year. The mindshare of Zscaler Client Connector is 0.7%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender for Endpoint	5.9%
Cortex XDR by Palo Alto Networks	3.5%
Zscaler Client Connector	0.7%
Other	89.9%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Robert Arbuckle

Security Analyst III at a healthcare company with 10,001+ employees

Automatically isolates threats and integrates with logging to reduce response time

Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.

Read full review

Dimitrios Arvanitakis

IT Support Admin at Kuehne & Nagel Inc.

Client activity has been monitored efficiently through in-depth log analysis and traffic filtering

I use the Zscaler speed test, and it is very nice. We use some logs from Zscaler Client Connector to collect data and see what is happening, such as if there is an interruption or something. There is a specific tunnel version that we have to use because, depending on the internet provider, some of them have lower speed, so we have some issues. This is because of the provider, not from Zscaler. We use Office 365 services and Office applications, and because some connections are slow and they do not have full coverage from the internet provider, we have some issues. If the speed is slow for Zscaler Client Connector connection, then we have issues because if the speed is not good, then Zscaler Client Connector goes down. This may be because they put some policy. Of course, if you use Office 365 services such as Outlook, the minimum bandwidth is 5 megabits and more, so this causes issues if the users do not have a good remote connection. This depends on the companies and the users, so they need to fix it. This is not from us or our company. It is very useful, and the logs are very helpful. When we go to logs, we understand what is happening.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The solution allows us to make investigations. Other XDR solutions also provide similar capabilities but for investigation, Cortex XDR is better."

"I have found the solution to be very easy in respect of the integration and configurable."

"Cortex is a very good total solution on the endpoints."

"The multi-layered approach to the product gives you confidence that it will stop exploits, ransomware, worms, or viruses from compromising endpoints, essentially providing peace of mind."

"Cortex XDR alerts us on the dashboard when there's a threat, which allows us to restrict that user and helps secure our infrastructure."

"The most valuable feature of Cortex XDR by Palo Alto Networks is the low consumption of system resources. The solution uses a lot of AI and machine learning."

"The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices."

"It collects and caches and the knowledge of machine learning from different customers to take to the cloud, it makes it better to use for everybody, it allows for quick learning and updates and can, therefore, offer zero-day malware security, and this sharing of metadata helps make the solution very safe."

More Cortex XDR by Palo Alto Networks pros

"One of the best features of Microsoft Defender for Endpoint is called Threat and Vulnerability Management, TVM, which provides real-time visibility of vulnerabilities and misconfiguration at our endpoint level and helps prioritize and remediate based on risk information."

"Microsoft's technical support is fantastic."

"For securing access, USB security helps us block our USB ports and that ensures that users do not plug USB drives into their computers."

"The deployment is seamless and super simple; it's not complex at all, and that's the main selling point for us."

"Microsoft Defender for Endpoint is a very good solution."

"Microsoft Defender for Endpoint is extremely stable."

"The whole bundle of the product, which is similar to other Microsoft products, is valuable. Ten years ago, you had third-party stuff for different things. You had one solution for email archiving and another third-party one for something else. Nowadays, Microsoft Office covers all the stuff that was formerly covered by third-party solutions. It is the same with antivirus. The functionality is just basic. You have the scanning, and then you also have a kind of cloud-based protection and reporting about your environment. With Microsoft Security Center, you have a complete overview of your environment. You know the software inventory, and you have security recommendations. You can not only see that the antivirus is up to date; you can also see where are the vulnerabilities in your system. Microsoft Security Center tells you where you have old, deprecated software and what kind of CVEs are addressed. It's really cool stuff."

"The most valuable features are the Windows Firewall and the regular virus definition updates. These features are very helpful and have helped to improve our security."

More Microsoft Defender for Endpoint pros

"Zscaler Client Connector is quite scalable, and I would rate its scalability as nine or ten out of ten."

"I'd rate the solution nine out of ten."

"The solution operates in the background seamlessly without the user noticing."

"The real-time analytics feature in Zscaler Client Connector is another valuable feature called Digital Experience, or ZDX, which can easily identify the root cause of issues accessing public or internal resources and provide good analysis so relevant teams can quickly resolve them, making it a very good tool that helps customers."

"The best features of Zscaler Client Connector are that it gives the client a much more transparent experience, as they don't have to worry about connecting to a VPN."

"Zscaler Client Connector has eliminated VPN bottlenecks and outages, improved user productivity with instant secure access, and reduced help desk tickets related to VPN issues, overcoming 60% of VPN-related problems while allowing faster onboarding of remote users and better enforcement of zero-trust security policies."

"It is very useful, and the logs are very helpful; when we go to logs, we understand what is happening."

"It is very important to see what is happening between the user and the applications that we have, and to filter the traffic from outbound traffic and inside traffic."

Cons

"Managing the product should be easier."

"For working with the solution, you only really need a web browser, however, we've found that working on Chrome, for example, is horrible."

"Cortex XDR could improve its sales support team, including better commission structures and referral programs."

"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."

"I have run into some detection issues with Cortex XDR. It needs to be better at detection of internal attacks."

"The price could be a little lower."

"The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."

"The deployment is pretty hard."

More Cortex XDR by Palo Alto Networks cons

"The solution has minimal customization options, especially compared to Mandiant, so we want to see more scope for customization. A single portal for customization would also be a welcome addition."

"There is room to improve the security of the solution."

"Defender's cloud integration could be improved."

"Sometimes the software doesn't work the way we expect it to, and in those cases, we can't communicate with a device because it may be infected."

"For us, Microsoft Defender for Endpoint can be improved by providing better visibility into our developers' environments, especially as we try to integrate a lot of the AI coding environments, such as Windows Services for Linux v2."

"On the Mac OS platform, there is no parity between Windows and Mac OS. The solution is very feature-rich and very well-integrated into Windows, and I guess baked into Windows 10 and Windows 11. Whereas, on the Mac OS platform, there is still some work there to give it a more feature-reach platform."

"The product development team makes frequent changes that affect the stability of the solution."

"Windows Firewall is integrated with Windows Defender. Over the last few days, I have had a problem with defining a wildcard on Windows Firewall. For example, I wanted to pull out the connection of my program and install a software package with a lot of executable files. I wanted to prevent it from accessing the internet. I could not select executables by using a wildcard. I had to select a single executable with its full name."

More Microsoft Defender for Endpoint cons

"I rate this product nine out of ten because I have seen some minor instability issues after updates and some room for UI improvement for deeper analytics, with instances of major issues after updating the GCC that required rollbacks."

"The stability of Zscaler Client Connector needs improvement, as it often disconnects and reconnects."

"There is a hard learning curve for Zscaler Client Connector; their support isn't the greatest all the time."

"Zscaler Client Connector is not low in cost; it is definitely on the higher side."

"If the speed is slow for Zscaler Client Connector connection, then we have issues because if the speed is not good, then Zscaler Client Connector goes down."

"There is room for improvement regarding the price of Zscaler Client Connector, as it is one of the most expensive solutions available."

Pricing and Cost Advice

"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."

"It has reasonable pricing for the use cases it provides to the company."

"The pricing is a little high. It is per user per year."

"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."

"The cost depends on your chosen license type, like Pro or other licenses."

"It's the most expensive solution, but features-wise, it's quite strong. It's very good for protection, so the results are very good in the case of protection. I would rate it a two out of ten in terms of pricing."

"Its pricing is kind of in line with its competitors and everybody else out there."

"The price was fine."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"We have seen ROI. Most of the other competing alternatives will cost up to around $30 per user device. We average 400 devices. Therefore, the amount that we save each year is 400 times $30."

"Most people don't realize M365/E5 licenses are an amazing deal. They think "Oh, it's expensive," and I'll ask, "Compared to what?" If you don't have it you will have to buy licenses for multiple products to fill the same security space that you would have gotten with the Microsoft product. Go figure out how much it costs you per product, per user, and then come back and tell me how things add up financially."

"Microsoft Defender for Endpoint can be costly as a standalone solution."

"The cost is high, compared to other products in the market, if you look at it as a separate product. If you look at the cost where it is part of a bundle, the cost is okay."

"Licensing options vary. Some customers buy it as an enterprise agreement and pay yearly. Others buy it as a CSP, so they pay per month. It completely depends on the customer's needs."

"You don't need to worry about the renewal and purchase of antivirus products. It is bundled with Windows 10, so you don't need to worry about separately purchasing any antiviruses."

"The license for Microsoft Defender for Endpoint is included in the license for the Microsoft Windows operating system."

"You do not need to pay any additional costs for antivirus and anti-malware solutions for endpoint protection."

More Microsoft Defender for Endpoint pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

902,456 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

12%

Financial Services Firm

11%

Manufacturing Company

11%

Comms Service Provider

Manufacturing Company

10%

Financial Services Firm

10%

Computer Software Company

Comms Service Provider

Manufacturing Company

21%

Financial Services Firm

10%

Government

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	46
Midsize Enterprise	21
Large Enterprise	52

By reviewers
Company Size	Count
Small Business	82
Midsize Enterprise	45
Large Enterprise	96

By reviewers
Company Size	Count
Small Business	3
Large Enterprise	5

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

Which offers better endpoint security - Symantec or Microsoft Defender?

We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...

How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?

The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...

What is your experience regarding pricing and costs for Microsoft Defender for Endpoint?

We have been discussing pricing, setup cost, and licensing, and we are currently on an E3. We are discussing going to...

What is your experience regarding pricing and costs for Zscaler Client Connector?

My experience with pricing, setup cost, and licensing is that the pricing is fair, though it is a bit costly. It oper...

What needs improvement with Zscaler Client Connector?

For Zscaler Client Connector, I would appreciate more granular control over the client update rollout and slightly fa...

What is your primary use case for Zscaler Client Connector?

My main use case of Zscaler Client Connector is to provide secure, seamless access to the internet and internal appli...

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Comparisons

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Trellix Endpoint Security Platform vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

OpenText Core Endpoint Protection vs Microsoft Defender for Endpoint

Compared 4% of the time

CrowdStrike Falcon vs Microsoft Defender for Endpoint

Compared 4% of the time

HP Wolf Security vs Microsoft Defender for Endpoint

Compared 3% of the time

Symantec Endpoint Security vs Microsoft Defender for Endpoint

Compared 3% of the time

SentinelOne Singularity Endpoint vs Microsoft Defender for Endpoint

Compared 2% of the time

More Microsoft Defender for Endpoint Competitors

Huntress Managed EDR vs Zscaler Client Connector

Compared 12% of the time

SentinelOne Singularity Endpoint vs Zscaler Client Connector

Compared 7% of the time

Tanium vs Zscaler Client Connector

Compared 6% of the time

Trellix Endpoint Security Platform vs Zscaler Client Connector

Compared 6% of the time

Cisco Secure Endpoint vs Zscaler Client Connector

Compared 6% of the time

More Zscaler Client Connector Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Microsoft Defender for Endpoint

Download Microsoft Defender for Endpoint product report

Zscaler Client Connector

Download Zscaler Client Connector product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus

No data available

Interactive Demo

Demo not available

Palo Alto Networks

Microsoft

Demo not available

Zscaler

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Microsoft Defender for Endpoint provides comprehensive threat protection that integrates well with current systems, offering proactive threat detection and automatic updates while reducing manual efforts.

The platform is designed for seamless integration with Microsoft products, facilitating efficient management and use. It offers proactive ransomware protection and valuable threat intelligence, crucial for timely response and increased visibility across devices. Users highlight its ability to secure endpoints from viruses and malware, integrating with Windows and Office 365 to enhance real-time detection capabilities in diverse environments, including hybrid and on-premises setups. However, enhancements are needed in Linux integration, detection accuracy, and policy implementations.

What are the key features of Microsoft Defender for Endpoint?

Seamless Integration: Works smoothly with existing systems and Microsoft products for easy management.
Proactive Threat Detection: Advanced monitoring to identify and mitigate threats swiftly.
Ransomware Protection: Built-in features to protect against ransomware attacks automatically.
Centralized Management: Unified platform for better device visibility and collaboration.
Threat Intelligence: Provides critical data for rapid threat response.

What benefits should be evaluated in Microsoft Defender for Endpoint?

Cost-Effectiveness: Part of Windows bundles, offering comprehensive security at competitive pricing.
Time Efficiency: Reduces manual oversight with automatic updates and management ease.
Real-Time Detection: Enhanced security through seamless Office 365 and Windows integration.
Device Coverage: Supports hybrid and on-premises environments for varied digital infrastructures.

Microsoft Defender for Endpoint is implemented across industries for securing endpoints, relying on its deep integration with Windows and Office 365 to protect against malware and viruses. Organizations benefit from its real-time detection and comprehensive management capabilities, particularly in hybrid environments where diverse digital infrastructures need safeguarding.

Microsoft

Zscaler Client Connector enhances network security by providing seamless access to applications, ensuring a safe and efficient digital experience. It is designed for businesses needing comprehensive protection and optimized resource access within a unified platform.

Organizations deploy Zscaler Client Connector to securely connect users to applications while maintaining robust data protection standards. It eliminates the need for traditional gateways by offering direct-to-cloud security, which enhances performance and reduces complexity. This solution is ideal for remote work environments where secure and efficient application access is required. It simplifies IT infrastructures, allowing businesses to scale without compromising security.

What are the key features of Zscaler Client Connector?

Zero Trust Access: Provides secure connectivity by validating user identities and context.
Cloud Firewall: Ensures robust protection by inspecting all traffic for potential threats.
Bandwidth Control: Manages network resources to optimize application performance.
Seamless User Experience: Integrates smoothly into existing environments with minimal disruption.
Comprehensive Visibility: Offers detailed analytics and reporting for informed decision-making.

What are the benefits users should expect?

Improved Security Posture: Strengthens defenses against cyber threats with advanced protocols.
Cost Efficiency: Reduces operational costs by streamlining IT management and reducing hardware dependencies.
Scalability: Easily adapts to organizational growth or changes in IT requirements.
Enhanced Productivity: Increases workflow efficiency by ensuring secure and rapid access to necessary applications.
Reduced Latency: Direct-to-cloud connectivity minimizes lag and improves user experience.

Zscaler Client Connector is widely adopted across industries such as finance, healthcare, and retail, where secure data transmission and compliance are critical. In finance, it supports secure transactions and data protection. For healthcare, it ensures HIPAA compliance, and in retail, it simplifies secure customer-facing services. Each industry benefits from tailored implementations that address specific security and connectivity challenges.

Zscaler

Sample Customers

CBI Health Group, University Honda, VakifBank

Petrofrac, Metro CSG, Christus Health

Information Not Available

Microsoft Defender for Endpoint vs. Zscaler Client Connector