Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Endpoint vs ThreatLocker Protect comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024
 

Categories and Ranking

Microsoft Defender for Endp...
Ranking in Endpoint Protection Platform (EPP)
1st
Ranking in Advanced Threat Protection (ATP)
2nd
Average Rating
8.0
Reviews Sentiment
7.3
Number of Reviews
186
Ranking in other categories
Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (2nd), Microsoft Security Suite (6th)
ThreatLocker Protect
Ranking in Endpoint Protection Platform (EPP)
13th
Ranking in Advanced Threat Protection (ATP)
8th
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
17
Ranking in other categories
Network Access Control (NAC) (5th), Application Control (4th), ZTNA (8th), Ransomware Protection (6th)
 

Mindshare comparison

As of November 2024, in the Endpoint Protection Platform (EPP) category, the mindshare of Microsoft Defender for Endpoint is 11.7%, down from 16.1% compared to the previous year. The mindshare of ThreatLocker Protect is 0.7%, down from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP)
 

Featured Reviews

Sudhen Swami - PeerSpot reviewer
Jun 26, 2024
Easy to update with good protection and a useful cloud portal
We've mainly used it for endpoints. However, we've also used it for DLP as well. We're also in the process of implementing it for cloud and identity as well. However, it's very good for endpoints, and that's our main focus. The malware protection is good. The visibility it provides is very useful. We can combine visibility with wider security features and alerts around malware, misconfiguration, or any other kinds of threats. The cloud portal is quite good. From there, we are able to see alerts and have colleagues review issues and monitor to see if any patterns arise. It's serving us quite well overall. It allows us to look at other items, like application and browser control. It helps us prioritize threats. We have a process in place now where we can review issues and remediate them effectively. We have been able to integrate a variety of Microsoft security products together. We use Azure AD, for example, and we've begun to implement DLP, among other items. We're looking at labeling and tagging and will expand into that soon. Defender has more stringent system requirements than, for example, Check Point. So when we implemented the Check Point Endpoint agent, that solution didn't mind what version of Windows you were using. When we moved to Defender, Defender had certain system prerequisites that had to be met. So we had to make sure that we're on a minimum version of Windows when we're utilizing Office, and Office has to be a particular version as well. It has more stringent system requirements that have to be met before you can implement it. It works natively together with other Microsoft solutions. Once you get more and more of those different components across the environment, then you start to get better visibility. So, rather than having lots of different solutions, you have fewer solutions and a single vendor solution. That way, you start getting into a position where you get better visibility and integration as well. The standardization is good. It's important. It's helping me with monitoring and learning. Updates and upgrades are quite smooth and seamless. Defender helps us automate routine tasks. Quite a lot of Microsoft is straightforward for us now. Previously, we didn't have enough resources and were unable to look at the alerts. Having this in place makes things a lot more straightforward for us. We have both the technology and the people in place now, alongside the process. We do see the benefits in that, and that's why we're continuing our adoption across the estate in terms of client and server as well. It's helping us avoid looking at multiple dashboards and centralized monitoring. We're not fully there yet. We're getting there. While we haven't witnessed time saving yet, once it's fully deployed, it will. By then, we'll have standardized processes across a single solution. We have saved money, however, as we continue to reduce non-Mircosft systems. Since we won't be using various competing technologies, we can save on licensing costs. We've likely so far saved 15%. While it's hard to estimate exactly how much, the solution has helped us decrease time to detection and time to respond.
Roy Richardson - PeerSpot reviewer
Nov 28, 2023
Integration is simple, deployment is straightforward, and extensive well-written documentation is available online
We use ThreatLocker's Allowlisting to whitelist specific applications and prevent unauthorized software from running. We utilize Ringfencing to establish guardrails around implementations, ensuring that applications operate within defined boundaries. We leverage network access control to granularly control interactions between computer systems and servers. This enables us to restrict communication between specific applications, even within a locked-down environment. We employ storage control to impose additional security measures on data storage. This includes controlling access to network shares, network files, and folders, as well as USB storage devices. We can whitelist specific devices based on their serial numbers or allow access based on predefined conditions. We rely on ThreatLocker's Cyber Hero support, which provides exceptional assistance and responsiveness. At any time, we can initiate a chat session and receive immediate support. If the issue requires escalation, it is promptly handled. Cyber Hero support also plays a crucial role in vetting application updates. When a user attempts to install or update an application, and the update has not been approved from a security standpoint, it is blocked by ThreatLocker. A notification is presented to the user, informing them of the block and providing an option to justify the application's need. These requests are then reviewed by ThreatLocker's Cyber Hero support team, who evaluate them against our security criteria and make an informed decision to allow or deny the application. We utilize ThreatLocker's elevated control feature for applications that require administrator-level access. We avoid granting full administrative privileges to end users, as this elevates the risk of compromise if the device is infiltrated. Instead, elevated control allows us to precisely define the execution conditions for specific applications, such as QuickBooks updates. By verifying the application's signature and certificate, we can enable the update to run with administrative privileges while restricting the user's overall administrative access. Integrating ThreatLocker with other products is simple and only requires a few clicks. ThreatLocker's deployment is also very straightforward. The company provides extensive and well-written online documentation, which is continuously being improved. They also offer a variety of training resources, including university courses, training videos, webinars, and conferences. I have no complaints about the level of support and knowledge transfer provided by the company. ThreatLocker is also developing a new reporting tool, which I had the opportunity to beta test. The company has also been showcasing the new reporting tool at conferences. The new reporting tool provides a level of detail that is unmatched by any other product on the market.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Microsoft Defender for Endpoint's most valuable feature is its ease of use."
"Technical support has been great."
"The most valuable features are that it is flexible, and it is integrated with Microsoft products."
"It's one of the best antiviruses on the market."
"The main features of this solution are that it handles everything by itself and is well integrated."
"The most valuable features are that it's easy to use and the updates are very simple."
"Microsoft Defender for Endpoint is extremely stable."
"I enjoy using the live response feature, which allows me to remotely access different endpoints and investigate malicious files, such as malware that people may have downloaded, and other related issues."
"Application control, ring-fencing, and storage control are the most important features, followed closely by elevation."
"We use ThreatLocker's Allowlisting to whitelist specific applications and prevent unauthorized software from running."
"Every single feature has been invaluable."
"The great thing is that if you get a malicious email and you try to run something, ThreatLocker is not going to let it do anything. It is not going to let anything infect your network."
"Using ThreatLocker is effortless because I can access it from an app on my phone, so I can help clients after hours. My client had an issue while I was at dinner, and I didn't have a tech on the problem, but I could deal with it from my phone. I can see what the client is doing and approve or deny it. It helps me deliver better service to my clients when they need it."
"The most valuable feature is probably the ability to block programs from running. ThreatLocker has some built-in features that make it super easy. You can also contact their support within the program. If you're having issues, you can click on that button and connect with someone in five to 10 seconds."
"The sandbox functionality is fantastic."
"While it can be frustrating at times, we appreciate the low-level security provided by the application whitelist."
 

Cons

"We would like to see more tools for managing on-premises security... Sometimes, we have the tools, like Defender, to manage security in the cloud, but because we are so focused on the cloud, we forget the fact that we need to be sure about the security of the on-premises environment, specifically Active Directory."
"The system can always be simplified and have a better integration check. More detailed reports would be good. When it does the integrated check, it just shows if the system is okay but I want to know what happened."
"Threat intelligence has the potential for improvement, particularly by integrating more sources."
"Sometimes, there are different skews. In a basic skew, they should have basic log analysis without the need to integrate with any third-party or SIEM solutions, like Sentinel. This would make it so much easier for users who don't have log collection or log analysis."
"Microsoft Defender for Endpoint does not offer default templates for alerts, requiring us to configure everything ourselves to avoid numerous false positives."
"I'm not too sure of its current capabilities, but I'm pretty sure they are doing a good job on Windows and Mac. However, I'm not sure whether they covered Linux. If I remember correctly, Microsoft Defender didn't have anything proper on Linux back then, but if they have improved it from that aspect, it would already be ticking all the boxes."
"Microsoft Defender for Endpoint is not as robust, and you cannot customize it much, so that's a challenge."
"In terms of improvements for their technical support, a focus on enhancing response times could be beneficial."
"The support could be quicker. There are times when there is a delay in getting a response. This is problematic when immediate attention is needed."
"The snapshots used in the ThreatLocker University portal are outdated snippets and have not been updated in conjunction with the portal itself."
"I'm not sure if I'm using it wrong; however, I find that I have to babysit it too much."
"Something we have come up against a couple of times is that we have two clients that are software developers. They create software that doesn't have digital signatures and that's not easy to categorize or whitelist with ThreatLocker. We have to go in and make custom rules to allow them to do their work and to be protected from malicious threats."
"More visibility in the built-ins would be nice."
"A valuable addition to ThreatLocker would be a column in the audit page displaying a VirusTotal score for each file."
"ThreatLocker Allowlisting needs to improve its user interface and overall workflow."
"Adding applications to the allowlist can sometimes feel overwhelming."
 

Pricing and Cost Advice

"This product is included in the pricing for Windows."
"There is no licensing fee."
"The solution comes free with Microsoft Windows 10."
"You just pay Windows 10 prices, then you have antivirus software. As a price comparison, Defender's costs are very low."
"Licenses depend upon what you are looking for and what kind of security do you want to implement. There are costs in addition to the standard licensing fees. When we used to buy Symantec, we used to spend on 100 licenses. We used to spend approximately $2,700 for those many licenses, and they came in packs. To add one more license, I had to buy a pack with a minimum of 10 licenses. I had to spend on nine extra licenses because I can't get a single license, whereas when we go for Microsoft, we can get as many licenses as we want. If I have 100 users today, and tomorrow, I have 90 users, I can release my 10 licenses next month. With any other software vendor, you buy licenses for one year, and you have to stick with that. If today you have 100 licenses, and tomorrow, you have 50, you have already paid for one year's license. You can't go back and tell them that I don't require these 50 licenses because I have lost my 50 users, but with Microsoft Defender, licensing is on a monthly basis. It gives you both options. You can go yearly and save on it, or you can go monthly. You will, again, save on it. It is very fair everywhere."
"There is not a license required for this particular solution."
"Currently, for us, Windows Defender is free with the purchase of Windows Server. Pricing is an important point for us when we are looking at the competitors of this solution. If we choose to go with another vendor, we will have to pay some license fees."
"Microsoft Defender for Endpoint is cost-effective because there's one unified license, and with this unified license, you get the capabilities for your cloud applications, servers, and endpoints as well. Therefore, it saves us a lot of money because the cost with other solutions is for just one piece of OS or maybe an urban environment. The licensing process is not complex as well."
"Its price is fair. They have added some additional things to it beyond allowlisting. They are up-charging for them, but in terms of the value we get and the way it impacts us, we get a bang for our buck with ThreatLocker than a lot of our other security tools."
"The price is very reasonable, and we have been able to integrate ThreatLocker with all of our clients."
"The pricing is fair and there is no hard sell."
"Although the pricing seems good, there have been inconsistencies in contract negotiations."
"The pricing is reasonable and normal. I do not have any problems with the cost."
"I can't complain. Cheaper would always be nice, but I think it's reasonable compared to other software in the cybersecurity market."
"ThreatLocker's pricing seems justifiable."
"Considering what this product does, ThreatLocker is very well-priced, if not too nicely priced for the customer."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
815,854 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
26%
Computer Software Company
12%
Government
7%
Financial Services Firm
7%
Computer Software Company
37%
Retailer
7%
Government
6%
Financial Services Firm
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What do you like most about ThreatLocker Allowlisting?
The interface is clean and well-organized, making it simple to navigate and find what we need.
What needs improvement with ThreatLocker Allowlisting?
I'm not sure if I'm using it wrong; however, I find that I have to babysit it too much. I've found that if a user opens a file from another location, it might trigger an approval process. The same ...
 

Also Known As

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
ThreatLocker Allowlisting, ThreatLocker Network Control, ThreatLocker Ringfencing
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Petrofrac, Metro CSG, Christus Health
Information Not Available
Find out what your peers are saying about Microsoft Defender for Endpoint vs. ThreatLocker Protect and other solutions. Updated: November 2024.
815,854 professionals have used our research since 2012.