No more typing reviews! Try our Samantha, our new voice AI agent.

Sangfor Endpoint Secure vs WatchGuard Firebox comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 15, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
118
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Extended Detection and Response (XDR) (4th), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Sangfor Endpoint Secure
Ranking in Endpoint Detection and Response (EDR)
30th
Average Rating
8.2
Reviews Sentiment
7.4
Number of Reviews
11
Ranking in other categories
No ranking in other categories
WatchGuard Firebox
Ranking in Endpoint Detection and Response (EDR)
10th
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
143
Ranking in other categories
Data Loss Prevention (DLP) (10th), Firewalls (12th), Intrusion Detection and Prevention Software (IDPS) (4th), Anti-Malware Tools (7th), Application Control (4th), Unified Threat Management (UTM) (3rd)
 

Mindshare comparison

As of September 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.6%, down from 3.9% compared to the previous year. The mindshare of Sangfor Endpoint Secure is 0.8%, up from 0.7% compared to the previous year. The mindshare of WatchGuard Firebox is 1.3%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.6%
WatchGuard Firebox1.3%
Sangfor Endpoint Secure0.8%
Other94.3%
Endpoint Detection and Response (EDR)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
OA
Coordinator Associate at National Institute of Cardiovascular Diseases
Quick threat response and behavior analysis while enhancing network security
The main use case is usually related to security. It deals with attacks that come day-to-day such as zero-day attacks and APT attacks. Our main task is to secure the network infrastructure in the hospital where I work It facilitates the departments of IT and other departments to procure and…
Abhishek Saini - PeerSpot reviewer
Professional Services Engineer at Next7 IT
Centralized security management has improved VPN reliability and simplified daily operations
WatchGuard Firebox is a strong and reliable platform overall, but there are a few areas where improvements could make the experience even better. One area is the user interface and navigation in some management tools. While the platform is powerful, certain configurations and troubleshooting workflows can feel less intuitive compared to some newer cloud-native firewall platforms. Another point is reporting and log analysis. Although the logging features are very useful, deeper analytics and more customizable reporting dashboards would make security monitoring much more effective. Firmware upgrades and policy synchronization can sometimes require careful planning to avoid security interruptions. Overall, the core security and VPN functionality are very solid, but improving usability, reporting, and automation would make the platform even stronger. One area that could be improved is the learning curve for new administrators. While experienced engineers can work with the platform effectively, some advanced networking and security configurations can be a bit complex for junior technicians. More guided configuration workflows, smarter recommendations, and simplified troubleshooting tools would make onboarding easier. Another improvement would be more flexible reporting customization for executive-level and client-facing reports.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It blocks malicious files, prevents attacks, and doesn't require many updates because it is a very light application."
"I don't have to do much monitoring with it; I don't have to have anybody manually looking at this, it gives us reports, and it lets us know if something needs to be addressed, and we can easily address it."
"It collects and caches and the knowledge of machine learning from different customers to take to the cloud, it makes it better to use for everybody, it allows for quick learning and updates and can, therefore, offer zero-day malware security, and this sharing of metadata helps make the solution very safe."
"The most valuable feature is that you can select remote access of any machine for sandboxing."
"From the Palo Alto side, whatever they buy, they integrate that really well into their integration suite, and that makes a massive difference."
"If the user leaves our premises or network, Palo Alto Traps will still be on that endpoint and will still apply our policies."
"I've found the solution to be highly scalable for enterprises."
"Cortex is the best tool for endpoint detection, and I have used it to verify hashes or domains to identify malicious activity, trigger playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."
"The tool's AI feature is helpful in endpoint security."
"I like the tool's honeypot feature. Some features include having a honeypot to detect attacks in a certain area. Additionally, there is RDP protection, which means that when we remote into our server or any endpoint, we must enter a password as a second layer of security. It can also integrate with next-generation firewalls."
"What stands out to me is the dual-end user interface they provide."
"Sangfor Endpoint Secure has some good policy certificates."
"The most valuable feature I have found in the system is its comprehensive end-to-end protection."
"We use the product for network protection from any malicious threat."
"It has a quick response time, threat intelligence, cybersecurity features, quick report generation, behavior analysis, dynamic detection, and quarantine features."
"The product's initial setup phase was straightforward."
"It does the job of what it says it does. We set it to what we want it to block and then it blocks it."
"The most valuable features are the VPN and web blocker security."
"It gives us a higher sense of security, there is an easier workflow as well, and it saves us a couple of hours per person per week."
"It protects me against malicious websites, as well as malicious downloads, as a perimeter anti-virus. I've also seen it blocking a lot of pings and different probes."
"The solution is very easy to use."
"The firewall aspect and the branch office VPNs are the most valuable features... We don't have any issues with it. We don't have to spend a lot of time maintaining it."
"The set up was quite straightforward and we handled it in-house. It took a few hours to deploy the product."
"I have far less (50-75%) less admin time trying to figure out why our system is so slow; that's gone."
 

Cons

"The MAC agent is not as robust feature-wise as the PC version."
"This is a very costly product."
"The solution needs better reports. I think they should let the customer go in and customize the reports."
"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."
"I have run into some detection issues with Cortex XDR. It needs to be better at detection of internal attacks."
"There are some third-party solutions that are difficult to integrate with, which is something that can be improved."
"It takes time to scan the servers and devices."
"The technical support is not very good. I find the process difficult."
"Sangfor Endpoint Secure should include healing capabilities."
"I face issues while migrating from Kaspersky to Sangfor Endpoint Secure."
"There are a few areas for improvement. We have encountered licensing issues on occasion, and sometimes updates don't apply properly."
"The interface has too many buttons, making it cluttered."
"When an issue occurs, the response time for first-level support and the time taken for meetings could be improved."
"It would be much more convenient if the migration tool could be installed directly on the customer's VMs, enabling a smoother migration process to the new infrastructure, with potential restrictions addressed accordingly."
"Currently, the tool lacks reporting functionalities."
"Sangfor Endpoint Secure performs poorly."
"One other shortcoming is that there is no backup for it. We really haven't figured out how we might solve that problem. We may want to put a duplicate in... With WatchGuard, we just have the one box. If that were to fail, we'd probably be really hurting."
"I haven’t dug deeply into the reporting features yet or if they are working well. However, I have generated several reports and there was too much unnecessary information, in comparison with the reporting features in the Sophos firewall. Sophos' reporting is more readable and easier to configure."
"They could expand the amount of applications that are on the list, but it's pretty intensive anyway, so it's pretty good."
"We would like to see granular notification settings and more advanced filtering in traffic monitoring."
"Last year, I had an issue with one of the Fireboxes going down. It was overheated, because my server room became overheated and this fried it."
"The CLI could be improved in WatchGuard Firebox, and I think integration with a cloud solution—such as Microsoft Enterprise and Google Cloud—has room for improvement."
"Proxy actions can be a little bit complicated."
"The way Secure Sign-On authentication is happening needs to be improved."
 

Pricing and Cost Advice

"The cost depends on your chosen license type, like Pro or other licenses."
"The solution is expensive. It's pricing is on a yearly-basis."
"The pricing is a little bit on the expensive side."
"This is an expensive solution."
"The price is on the higher side, but it's okay."
"The pricing is okay, although direct support can be expensive."
"The price was fine."
"The solution has one subscription for endpoint protection and one subscription for detection and response. The two licenses combined give you the BRO version."
"Price-wise, Sangfor Endpoint Secure can be considered a competitively priced product in the market as it offers quite low prices compared to other solutions."
"The product is expensive compared to other vendors."
"Sangfor Endpoint Secure is not a cheap solution."
"Sangfor Endpoint Secure's pricing is cheap. I rate it seven out of ten."
"We were using Hyper-V. So, we switched to Sangfor because of the pricing."
"Its "pay as you grow" model offers cost-effectiveness compared to major cloud providers."
"The solution is cheap. It is cheaper than other products by 15-20 percent."
"We pay about $3,500 every three years."
"WatchGuard had a very competitive price. It was only 10 to 20 percent more than a single instance device but with that extra cost it provided a second load balancing device... unlike other brands whose method of hardware and software licensing would have doubled our cost."
"It's fair pricing, but it could always be reduced."
"It's in the medium range. Its price is pretty good considering the functions and add-ons that are used."
"We don't have any other costs other than the licensing stuff."
"The licensing can be a one-time purchase unless you need the extra services for example twenty-four seven support."
"The price is so small that I don't pay attention to it anymore. I think we pay a few thousand dollars for two to three years, so about $100 per month. That's for all of our users. There is an additional cost if we want to go with a deeper licensing model, but we just pay for antivirus, IPS, and main product support."
"The price of WatchGuard Intrusion Prevention Service is pretty reasonable compared to similar solutions."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
914,109 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
12%
Comms Service Provider
12%
Construction Company
11%
Financial Services Firm
9%
Financial Services Firm
17%
Comms Service Provider
11%
Media Company
7%
Outsourcing Company
6%
Outsourcing Company
13%
Comms Service Provider
12%
Construction Company
8%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise21
Large Enterprise55
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise3
Large Enterprise3
By reviewers
Company SizeCount
Small Business104
Midsize Enterprise30
Large Enterprise17
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Sangfor Endpoint Secure?
The interface has too many buttons, making it cluttered. It would be better if it were a simplified version with fewe...
What is your primary use case for Sangfor Endpoint Secure?
Sangfor Endpoint Secure is easy to handle with its user-friendly interface. The four engines it utilizes for endpoint...
What advice do you have for others considering Sangfor Endpoint Secure?
At first, people might not understand the interface, which is why it should be simplified. However, once they underst...
What is your primary use case for WatchGuard Firebox?
We are providing our services to all WatchGuard customers in the region.
What is your primary use case for WatchGuard Firebox?
We just use it as a secondary WiFi device. We're a small office and we needed to set up a WiFi device for a few of ou...
What is your primary use case for WatchGuard Firebox?
We're a hospital and we use it for developing our incoming and outgoing policies, and we also use it for VPN.
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
WatchGuard Threat Detection and Response, WatchGuard Application Control, WatchGuard Data Loss Prevention, WatchGuard Gateway AntiVirus, WatchGuard Intrusion Prevention Service
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Ellips, Diecutstickers.com, Clarke Energy, NCR, Wrest Park, Homeslice Pizza, Fortessa Tableware Solutions, The Phoenix Residence
Find out what your peers are saying about Sangfor Endpoint Secure vs. WatchGuard Firebox and other solutions. Updated: September 2026.
914,109 professionals have used our research since 2012.