Try our new research platform with insights from 80,000+ expert users

CrowdStrike Falcon Sandbox vs Microsoft Defender for Endpoint comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 3, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CrowdStrike Falcon Sandbox
Ranking in Anti-Malware Tools
16th
Average Rating
8.2
Reviews Sentiment
7.5
Number of Reviews
6
Ranking in other categories
No ranking in other categories
Microsoft Defender for Endp...
Ranking in Anti-Malware Tools
1st
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
190
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Advanced Threat Protection (ATP) (2nd), Endpoint Detection and Response (EDR) (2nd), Microsoft Security Suite (6th)
 

Mindshare comparison

As of February 2025, in the Anti-Malware Tools category, the mindshare of CrowdStrike Falcon Sandbox is 1.3%, up from 0.4% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 17.4%, down from 23.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Anti-Malware Tools
 

Featured Reviews

Abhimanyu Raj - PeerSpot reviewer
Alerts and notifications have enhanced malware detection capabilities
These features are probably the most essential for me. I find the notifications and alerts received from CrowdStrike server to be invaluable. They analyze Falcon and provide output regarding any kind of infected malware devices or files. We have seen returns on our investment in more than thousands of instances, which is the most important part for us.
AnuragSrivastava - PeerSpot reviewer
Provides detailed visibility into threats but the ability to add exceptions needs improvement
One major item for improvement is the ability to add exceptions. We can add some exceptions, but not at the level we need to. The second major area for improvement involves enhanced capabilities for different operating systems or platforms. That is, even though we have coverage for different operating systems or platforms such as Linux, we don't get all of the controls and enhanced capabilities that are available with Windows devices. Reporting could also be improved because, at present, we get limited results at times. For example, in an environment with more than 100,000 devices, you may just get 10,000 results when you run a report.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I find the notifications and alerts received from CrowdStrike server to be invaluable."
"We have seen returns on our investment in more than thousands of instances, which is the most important part for us."
"CrowdStrike is an excellent tool for managing all endpoint-related security tasks."
"The most valuable features include malware detection, threat rating related to files, studying the metadata of the files, and providing threat feeds to the endpoint."
"I don't have any suggestions, because the solution is company-maintained and I believe the company is adopting every feature based on their needs and requirements."
"It provides a safe way to analyze and review documents that may have sensitive information without uploading them to a public platform. Additionally, provides an easy way to spin up a VM without requiring additional resources and patching of personal or team-managed virtualization."
"The tool helps to obtain information about potential company breaches. The malware analysis capability is very effective. We check files from various sources, such as emails, USBs, and cloud drives."
"CrowdStrike is an excellent tool for managing all endpoint-related security tasks."
"Defender for Endpoint has significantly improved our security posture."
"The integration with all variations of Microsoft Defender, for Endpoint, 365, and Cloud is valuable."
"The best thing I like about it is its interaction with the other Defender products. It provides the ability to push telemetry up. It gives me endpoint visibility and allows me to take automated actions."
"Auto-remediation: When the product sees malware, it resolves the issue immediately. This protects the machine."
"The detection features are valuable, as is the fact that it is easier to port these logs into Sentinel. That is also useful for us. It is more comprehensive."
"Coming from an organization where the EDR wasn't strong, it has always been a case of basically searching through the information you already have and looking for something. It was basically trying to find the needle in a haystack. What the Defender platform does is that it reduces the size of the haystack, and it'll say that the needle is over here. Minutes matter, and it certainly zeros you in on the events that are concerning. It also simplifies the effort of trying to get some kind of correlation of behaviors or actions you see in the environment and confirming if something is benign or a threat."
"Defender for Endpoint provides good visibility into threats and has favorable threat intelligence."
"There are a couple of features, such as isolating the devices or connecting the device and connecting live response."
 

Cons

"One of the valuable features of the solution is to impressively detect threats without any impact on the end point performance. The solution ensures that the end users have a seamless experience."
"The technical support is medium - they could improve, as communication is sometimes slow or late. There are missing detections that other tools catch. For improvements, we need easier ways to view full incident information and better presentation of data. Adding risk indicators for incidents would help decide on immediate actions. The platform should provide more information about incident risks to help less knowledgeable staff make decisions."
"While CrowdStrike is a powerful tool, the user interface is cluttered with many features, making it challenging to navigate."
"The product needs integration with SOAR products to add more integration points, which is important for various clients."
"While CrowdStrike is a powerful tool, the user interface is cluttered with many features, making it challenging to navigate."
"As of now, there is nothing specific in need of improvement."
"The detailed report is very valuable, but not always accurate. This is a great resource to share amongst team members and stakeholders after analysis."
"They're in the process of pulling more things together. They can continue with the integrations and provide a better way of seeing the impact of security changes, especially on the endpoint side. Before we actually flip the switch, we should be able to see the impact of security changes on the business or business applications. It would prevent breaking any business applications."
"Microsoft Defender for Endpoint is effective for validating work, but not ideal for investigations."
"The product should reduce updates since it is hard to keep up."
"Microsoft Defender for Endpoint can use more advertising to promote their features."
"The time to generate certain alerts on our dashboard can take between 45 minutes to an hour, and I am unsure of the factors that influence this duration."
"It's not easy to create special allowances for certain groups of users. It can be a little heavy-handed in some areas where Microsoft has decided to lock a feature out, meaning they make it hard to make an exception... One company we work with needed to use about 20 different thumb drives for about 20 users. To make that exception for them was very difficult. In fact, you can't really make an exception. But what you can do is allow them to use it and, while it will still alert, you can actually suppress those alerts."
"The reporting in Microsoft Defender for Endpoint should improve. The solution has limited features."
"We need better support to learn about the product. Documentation is available, but we need some kind of training program so that we can get a better understanding of the product."
 

Pricing and Cost Advice

"CrowdStrike Falcon Sandbox is not cheap; however, whether it should be more affordable is a decision best left to the company."
"Price-wise, the tool is a bit above mid-range, maybe 7 out of 10, where 10 is the most expensive."
"The solutions price could be cheaper."
"The price was a problem for me three years ago, but they improved their E3, E5, and a la carte licensing. In other words, you have to get all of E5. That used to be a problem because you had E3, Defender, and guardrails, but you needed an E5 license to get the management suite and the analytics. It's more flexible now. You can switch from a la carte to the entire suite when it starts to make sense. It's becoming more economically competitive to go that route."
"We have an enterprise agreement so from my perspective, this is a product that ships with Windows and it is not priced standalone."
"The subscription is part of Windows, so we don't have to pay anything extra for this product."
"This is an expensive product and licensing for all Microsoft products is a big issue."
"Buying individual point products would've cost us a lot more money than one integrated solution that also capitalizes on Teams Voice and things of that nature. Given our size, buying individual products would have easily cost us a million dollars."
"You do not need to pay any additional costs for antivirus and anti-malware solutions for endpoint protection."
"The cost is high, compared to other products in the market, if you look at it as a separate product. If you look at the cost where it is part of a bundle, the cost is okay."
report
Use our free recommendation engine to learn which Anti-Malware Tools solutions are best for your needs.
838,713 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
13%
Financial Services Firm
12%
Educational Organization
12%
Government
10%
Educational Organization
28%
Computer Software Company
11%
Government
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about CrowdStrike Falcon Sandbox?
I don't have any suggestions, because the solution is company-maintained and I believe the company is adopting every feature based on their needs and requirements.
What is your experience regarding pricing and costs for CrowdStrike Falcon Sandbox?
CrowdStrike is generally considered a bit expensive compared to other vendors. Falcon Sandbox is one of the modules of CrowdStrike, and the overall product's pricing is rated seven out of ten.
What needs improvement with CrowdStrike Falcon Sandbox?
As of now, there is nothing specific in need of improvement.
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
 

Also Known As

No data available
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Information Not Available
Petrofrac, Metro CSG, Christus Health
Find out what your peers are saying about CrowdStrike Falcon Sandbox vs. Microsoft Defender for Endpoint and other solutions. Updated: January 2025.
838,713 professionals have used our research since 2012.