Cisco Secure Endpoint vs Symantec Endpoint Detection and Response comparison

Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response

Download the complete report

Helped 842,592 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cisco Secure Endpoint

Ranking in Endpoint Detection and Response (EDR)

12th

Average Rating

8.6

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (13th), Cisco Security Portfolio (6th)

Symantec Endpoint Detection...

Ranking in Endpoint Detection and Response (EDR)

25th

Average Rating

7.6

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of March 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of Cisco Secure Endpoint is 1.6%, down from 2.2% compared to the previous year. The mindshare of Symantec Endpoint Detection and Response is 0.5%, up from 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR)

Featured Reviews

Mark Broughton

Level 2 tech at a tech services company with 11-50 employees

Tighter integration with Umbrella and Firepower gave us eye-opening information

We were using a third-party help desk. One of the ways that they were fixing problems was to delete the client and then add the client back if there was an issue where the client had stopped communicating. Any improvement in the client communicating back to the server would be good, particularly for machines that are offline for a couple of weeks. A lot of our guys were working on a rotation where the machine might be offline for that long. They were also terrible about rebooting their machines, so those network connections didn't necessarily get refreshed. So, anything that could improve that communication would be good. Also, an easier way to do deduplication of machines, or be alerted to the fact that there's more than one instance of a machine, would be useful. If you could say, "Okay, we've got these two machines. This one says it's not reporting and this one says it's been reporting. Obviously, somebody did a reinstall," it would help. That way you could get a more accurate device count, so you're not having an inflated number. Not that Cisco was going to come down on you and say, "Oh, you're using too many licenses," right away. But to have a much more accurate license usage count by being able to better dedupe the records would be good. I also sent over a couple of other ideas to our technical rep. A lot of that had to do with the reporting options. It would be really nice to be able to do a lot more in the reporting. You can't really drill down into the reports that are there. The reporting and the need for the documentation to be updated and current would be my two biggest areas of complaint. Also, there was one section when I was playing with the automation where it was asking for the endpoint type rather than the machine name. If I could have just put in the machine name, that would have been great. So there are some opportunities, when it comes to searching, to have more options. If I wanted to search, for example, by a Mac address because, for some reason, I thought there was a duplication and I didn't have the machine name, how could I pull it up with the Mac address? When you're getting to that level, you're really starting to get into the ticky tacky. I would definitely put the reporting and documentation way ahead of that.

Read full review

YusufAhmed

Information Security Specialist at IHV-Nigeria

Easy to use and competitively priced

Honestly, the product needs to continue the way it is, and I feel that everything will be fine. I haven't had any reasons to complain about the product. The product doesn’t offer MDM functionality under its current licensing model. In the future, I want the product to offer MDM. It can allow me to manage my mobile device more efficiently and effectively. Currently, there is a need for a separate license to be added to Symantec Endpoint Detection and Response to be able to use the MDM part. If both are bundled up under the same license, the administration part can be made easier.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I am told that we get over 100 million emails a month. This filters them down and allows only somewhere about three million emails, which is a great help."

"Its most valuable features are its scalability and advanced threat protection for customers."

"The visibility and insight this solution gives you into threats is pretty granular. It has constant monitoring. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. You can see what happened after the threat. You can see what other applications were incorporated into the execution of the threat. For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. Then, after the event, something else was launched by whatever the threat was. Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. This helps you understand and nail down what the threat is and how to fix it."

"The integration with other Cisco products seemed to be really effective. We had Umbrella in place and we were using AnyConnect as well as Firepower. Once a threat was detected, being able to do the threat lookups and the live tracking was really useful."

"The solution is easy to deploy and applies multi-factor authentication."

"Integration is a key selling factor for Cisco security products. We have a Cisco Enterprise Agreement with access to Cisco Email Security, Cisco Firepower, Cisco Stealthwatch, Cisco Talos, Cisco Threat Grid, Cisco Umbrella, and also third-party solutions. This is key to our security and maximizing operations. Because we do have the Email Security appliance and it is integrated with Threat Response, we have everything tied together. Additionally, we are using the Cisco SecureX platform, as we were a beta test for that new solution. With SecureX, we are able to pull all those applications into one pane for visibility and maintenance. This greatly maximizes our security operations."

"Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."

"Another of my favorite features is called the Device Trajectory, where it shows everything that's going on, on a computer. It shows the point in time when a virus is downloaded, so you can see if the user was surfing the internet or had a program open. It shows every running process and file access on the computer and saves it like a snapshot when it detects something malicious. It also has a File Trajectory, so you can even see if that file has been found on any of your other computers that have AMP."

More Cisco Secure Endpoint pros

"I like Symantec EDR's device control and USB security features."

"The most valuable features of the solution are that it is easy to use and has good support."

"The pricing is pretty reasonable."

"The interface is quite easy to use."

"The most valuable features of this product include network isolation for machines and the ability to work with a consistent and defined set of virtual machines."

"The solution does its job with no issues."

"There are times when Symantec Endpoint Detection and Response tags an executable as malicious when it is trying to get executed on the machine. In this case, it prevents the execution and it gives you a process view of things where you can look into what has happened and whether it is a genuine process trying to access some system activities, or it's a malicious one. Depending upon the process, it gives you a clear identification, and we can do the containment from the interface itself and isolate the machine from the network. The process review on network isolation is good."

"The solution is stable."

More Symantec Endpoint Detection and Response pros

Cons

"...the greatest value of all, would be to make the security into a single pane of glass. Whilst these products are largely integrated from a Talos perspective, they're not integrated from a portal perspective. For example, we have to look at an Umbrella portal and a separate AMP portal. We also have to look at a separate portal for the firewalls. If I could wave a magic wand and have one thing, I would put all the Cisco products into one, simple management portal."

"In terms of the user experience, if the UX design could be much simpler [that would improve things]... if they could make it more intuitive for someone who is not an engineer so that they still can read what's going on in their webpage and understand, that would be something."

"It's pretty good as it is, but its cost could be improved."

"I would recommend that the solution offer more availability in terms of the product portfolio and integration with third-party products."

"We have had some problems with updates not playing nice with our environment. This is important, because if there is a new version, we need to test it thoroughly before it goes into production. We cannot just say, "There's a new version. It's not going to give us any problems." With the complexity of the solution using multiple engines for multiple tasks, it can sometimes cause performance issues on our endpoints. Therefore, we need to test it before we deploy. That takes one to three days before we can be certain that the new version plays nice with our environment."

"The room for improvement would be on event notifications. I have mine tuned fairly well. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications."

"Its price is okay for us, but it can always be better. There's always room for improvement when it comes to pricing."

"Due to the complexity of the technology that is used and its advanced threat detection capabilities, it is possible to encounter many delays in operation."

More Cisco Secure Endpoint cons

"The interface is very complicated."

"It would be beneficial to have more integration and compatibility with other platforms."

"I would like to see better scanning capabilities."

"In the future, it would be nice to have playbooks in the tool, to allow for some of the common activities to be automated. For example, some of the scannings of the malware can be too manual for a specific device. Additionally, a vulnerability manager would be beneficial."

"The solution’s scalability and stability could be improved."

"The GUI could be better."

"It would be good if it can anticipate zero-day attacks. I don't know how it can be done and if it is even a feature of this product."

"I think we have experienced some technical issues because the company focuses mainly on bigger clients. Also, sometimes the solution fails to detect zero-day attacks, so that feature needs some enhancement because it is lacking compared to other solutions."

More Symantec Endpoint Detection and Response cons

Pricing and Cost Advice

"In our case, it is a straightforward annual payment through our Enterprise Agreement."

"Whenever you are doing the licensing process, I would highly advise to look at what other Cisco solutions you have in your organization, then evaluate if an Enterprise Agreement is the best way to go. In our case, it was the best way to go. Since we had so many other Cisco products, we were able to tie those in. We were actually able to get several Cisco security solutions for less than if we had bought three or four Cisco security solutions independently or ad hoc."

"The solution is highly affordable; I believe we pay $2 or $3 per endpoint. It's significantly cheaper than the competitors on the market."

"We had faced some license issues, but it has been improved. At the beginning of the implementation, we faced a lot of licensing issues, but now, we have EA licensing, which gives us an opportunity to grow."

"Its price is fair for us."

"We can know if something bad is potentially happening instantaneously and prevent it from happening. We can go to a device and isolate it before it infects other devices. In our environment, that's millions of dollars saved in a matter of seconds."

"Cisco's pricing is reasonable. We also do not need to opt for niche players, which would have charged us significantly more than Cisco for ecosystem solutions. We are highly satisfied with the pricing structure of Cisco's solutions they are reasonable."

"It can always be cheaper."

More Cisco Secure Endpoint pricing and cost advice

"We pay around $100,000 for 5000 licenses every year."

"Of late, because of the Broadcom purchase, its price has been increasing."

"Compared to the tools of competitors, Symantec Endpoint Detection and Response is a cheaply priced product."

"It's a yearly subscription."

"The more devices we have the more expensive it becomes, which is where the challenge is."

"The price is reasonable."

"The price is okay, but it really depends on the customer's requirements."

"We are satisfied with the pricing."

More Symantec Endpoint Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

842,592 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Government

Financial Services Firm

Manufacturing Company

Computer Software Company

15%

Financial Services Firm

15%

Manufacturing Company

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Cisco Secure Endpoint?

The product's initial setup phase was very simple.

What is your experience regarding pricing and costs for Cisco Secure Endpoint?

I am not entirely sure about the exact licensing cost. It ranges from 2,000 to 2,500 INR annually.

What needs improvement with Cisco Secure Endpoint?

Previously, there were options to uninstall the agent without a password if you had admin access, and this could be improved. It may require a password for uninstalling clients, which would be help...

What do you like most about Symantec Endpoint Detection and Response?

The security is good.

What is your experience regarding pricing and costs for Symantec Endpoint Detection and Response?

I am not aware of the pricing details, as that falls under the management's responsibility.

What needs improvement with Symantec Endpoint Detection and Response?

There are several areas where Symantec Endpoint Detection and Response can improve, including shell features, web control, asset management, and device control. Specifically, the application contro...

Microsoft Defender for Endpoint vs Cisco Secure Endpoint

Comparisons

Compared 14% of the time

CrowdStrike Falcon vs Cisco Secure Endpoint

Compared 12% of the time

Cortex XDR by Palo Alto Networks vs Cisco Secure Endpoint

Compared 5% of the time

SentinelOne Singularity Complete vs Cisco Secure Endpoint

Compared 5% of the time

Check Point Harmony Endpoint vs Cisco Secure Endpoint

Compared 5% of the time

More Cisco Secure Endpoint Competitors

Kaspersky Endpoint Detection and Response Expert vs Symantec Endpoint Detection and Response

Compared 21% of the time

Trend Vision One vs Symantec Endpoint Detection and Response

Compared 13% of the time

Kaspersky Endpoint Security Cloud vs Symantec Endpoint Detection and Response

Compared 11% of the time

Trellix Endpoint Security (ENS) vs Symantec Endpoint Detection and Response

Compared 10% of the time

Sangfor Endpoint Secure vs Symantec Endpoint Detection and Response

Compared 9% of the time

More Symantec Endpoint Detection and Response Competitors

Product Reports

Cisco Secure Endpoint

Download Cisco Secure Endpoint product report

Symantec Endpoint Detection and Response

Download Symantec Endpoint Detection and Response product report

Symantec Endpoint Detection and Response report

Also Known As

Cisco AMP for Endpoints

No data available

Overview

Cisco Secure Endpoint is a comprehensive endpoint security solution that natively includes open and extensible extended detection and response (XDR) and advanced endpoint detection and response (EDR) capabilities. Secure Endpoint offers relentless breach protection that enables you to be confident, be bold, and be fearless with one of the industry’s most trusted endpoint security solutions. It protects your hybrid workforce, helps you stay resilient, and secures what’s next with simple, comprehensive endpoint security powered by unique insights from 300,000 security customers and deep visibility from the networking leader.

Cisco Secure Endpoint was formerly known as Cisco AMP for Endpoints.

Reviews from Real Users

Cisco Secure Endpoint stands out among its competitors for a number of reasons. Two major ones are its ability to enable developers to easily secure their endpoints with one single operation using its management console and its advanced alerting techniques.

Tim C., an IT manager at Van Der Meer Consulting, writes, "The solution makes it possible to see a threat once and block it everywhere across all endpoints and the entire security platform. It has the ability to block right down to the file and application level across all devices based on policies, such as, blacklisting and whitelisting of software and applications. This is good. Its strength is the ability to identify threats very quickly, then lock them and the network down and block the threats across the organization and all devices, which is what you want. You don't want to be spending time working out how to block something. You want to block something very quickly, letting that flow through to all the devices and avoiding the same scenario on different operating systems."

Wouter H., a technical team lead network & security at Missing Piece BV, notes, "Any alert that we get is an actionable alert. Immediately, there is information that we can just click through, see the point in time, what happened, what caused it, and what automatic actions were taken. We can then choose to take any manual actions, if we want, or start our investigation. We're no longer looking at digging into information or wading through hundreds of incidents. There's a list which says where the status is assigned, e.g., under investigation or investigation finished. That is all in the console. It has taken away a lot of the administration, which we would normally be doing, and integrated it into the console for us."

Cisco

Symantec Endpoint Detection and Response (EDR) is a powerful security solution designed to help organizations proactively detect, investigate, and mitigate advanced threats across their endpoint environments. As part of Broadcom's cybersecurity portfolio, Symantec EDR provides comprehensive visibility into endpoint activities, enabling security teams to quickly identify and respond to threats that evade traditional defenses.

Symantec EDR leverages machine learning, behavioral analysis, and global threat intelligence from Symantec's vast network to detect sophisticated threats, including zero-day attacks, ransomware, and advanced persistent threats (APTs). This allows organizations to identify malicious activities early and respond swiftly to mitigate potential damage. The solution offers automated response options that enable security teams to contain and remediate threats quickly.

Symantec EDR provides detailed forensic capabilities, allowing security analysts to dive deep into endpoint data, investigate incidents thoroughly, and understand the scope and impact of attacks. Features such as timeline analysis, incident graphing, and the ability to isolate endpoints enhance investigative efforts and support effective remediation strategies.

With its centralized management console, Symantec EDR offers visibility across the entire endpoint environment, regardless of the operating systems or whether endpoints are on-premise or remote. Symantec EDR seamlessly integrates with other Symantec security solutions, enhancing its detection capabilities and enabling a unified approach to threat management. Its scalable architecture ensures that businesses of all sizes can benefit from its advanced security features without compromising performance.

Quickly discover and resolve threats with deep endpoint visibility and superior detection analytics, reducing mean time to remediation. Overcome cyber security skills shortages and streamline SOC operations with extensive automation and built-in integrations for sandboxing, SIEM, and orchestration.

Fortify security teams with the unmatched expertise and global scale of Symantec Managed Endpoint Detection and Response services.
Roll out Endpoint Detection and Response (EDR) across Windows, macOS, and Linux devices using Symantec Endpoint Protection (SEP)-integrated EDR or a dissolvable agent.

Broadcom

Sample Customers

Heritage Bank, Mobile County Schools, NHL University, Thunder Bay Regional, Yokogawa Electric, Sam Houston State University, First Financial Bank

Information Not Available

Cisco Secure Endpoint vs. Symantec Endpoint Detection and Response