What is the best EDR or XDR product for a company with 9000 employees?

In my personal technical opinion, FortiEDR (an EDR/XDR product) is a highly effective solution because it’s engineered to sit at the kernel level between any executing application and the OS, NIC, and hard drive. 

This makes the solution effective beyond typical signatures (which every system uses, including FortiEDR to catch the low hanging fruit). Anything outside typical signature still cannot bypass FortiEDR because it listens to every activity as it hits the OS, NIC, and hard drive.

Sophos, if you have people to admin the tool, if not Sophos with MTR.

I deploy and would recommend Deep Instinct. It has a 99%+ detection rate, even on zero days and documents like Word, Excel and PDF, automatically stops malware activation within milliseconds and has a <0.1% false-positive rate. 

In the USA it is backed by a $3M warranty from Munich Re for a single breach, and we expect this to be extended to the UK. It is very easy to implement using self-install or automation, and we have never got anything past it. In the UK it has a major bank as a client. 

Its customers include T-Systems, Honeywell, Taylor Morrison and Seiko. 

@Edgardo Arrieta ​ 

I would confidently recommend SentinelOne as it is the only EDR that has not been breached, offers up to 1 million USD warranty if it is not able to roll back a ransomware encryption attack, automatically mitigates cyber-attacks without human intervention, uses artificial intelligence and does not require internet to mitigate attacks. 

SentinelOne also effectively provides protection against; zero-day, fileless and lateral movement attacks.

Trend Micro Vision One!  This XDR solution can be correlated with other information within the network that could be of huge help in threat hunting and mitigating risks.

@Edgardo Arrieta, You can look out for LimaCharlie too. It's a new product in the market. 

But it has a lot of features. You can build your own rules for detection, response, and control of your data. You can also use many freely available rules for D & R for mitigation. 

Leverage solutions custom designed for your environment and control your security posture without having to rely on external vendors to protect you from bad actors. You also get one-click access to many rulesets from sources like Yara, Soteria, Sigma, and others.

Here (at BlackSwan CyberSecurity) we prefer to stay vendor neutral with an Open XDR approach. 

With that said we utilize Sophos as it provides data we use in our SIEM, and XDR provides us with some automation capabilities: Sophos XDR Fact Sheet

I would recommend SentinelOne. 

Easy deployment, management and daily maintenance. Supporting most operating systems - new, legacy and mobile. 

Never breached 1 million warranty, leading MITRE and Gartner. Cool usable roll-back feature and superior storyline technology that tracks all processes and events, making IR, TH, and documentation fast and sublime.

Bitdefender topped the MITRE ATT&CK tests for consecutive years. 

Look at real performance and not marketing and hype.

Completely automated attack investigation and remediation on a single platform.

Cynet XDR (by Cynet Security) natively unifies NGAV, EDR, NDR, UEBA and Deception technologies with automated attack investigation and remediation on a single, intuitive platform and it's backed by a 24/7 Managed Detection and Response service.