Try our new research platform with insights from 80,000+ expert users

Microsoft Defender XDR vs Trellix Endpoint Security comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 12, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender XDR
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
96
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Microsoft Security Suite (2nd)
Trellix Endpoint Security
Ranking in Extended Detection and Response (XDR)
13th
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
98
Ranking in other categories
Endpoint Protection Platform (EPP) (9th)
 

Mindshare comparison

As of February 2025, in the Extended Detection and Response (XDR) category, the mindshare of Microsoft Defender XDR is 7.4%, up from 6.1% compared to the previous year. The mindshare of Trellix Endpoint Security is 1.9%, down from 2.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR)
 

Featured Reviews

Gabor Nyerd - PeerSpot reviewer
Includes four services and four products, which can help organizations a lot
We found that sometimes integrations work, but testing them can take some time. Sometimes, configurations take much longer than expected. We have a configuration in place that needs to be synchronized with another server. However, the servers are four hours apart, so this can cause delays. In general, I believe that the time it takes to configure and test a service should be shorter. Sometimes, it can take a couple of hours to test a single configuration setting. Other times, it is only ten or fifteen minutes, which is normal. However, sometimes, even immediate actions can be triggered by configuration changes, and some settings can take up to eight hours to complete. I believe that this time can be improved. Microsoft is making a lot of improvements to its services in a short period of time. This is a good thing, as it means that the services are constantly being updated and improved. However, it can be challenging for customers to keep up with the changes. For example, a customer may read about an update, understand it, and share it with their colleagues and boss. However, it may take days or weeks to test the update and get the necessary approvals. This can be especially challenging for large customers with many users or machines. In some cases, Microsoft may change a service before the customer has had a chance to implement the previous update. This can be frustrating for customers, as it means that they have to constantly learn new things and adjust their workflows. On the one hand, it is important for Microsoft to keep updating and improving its services. This helps to ensure that the services are meeting the customers' needs and that they are staying ahead of the competition. Microsoft should also be mindful of the challenges that these changes can create for customers. One way to address this challenge is to provide customers with more time to implement changes. Microsoft could also provide more information about upcoming changes so that customers can plan ahead. Ultimately, Microsoft needs to strike a balance between keeping its services up-to-date and providing customers with a smooth transition to new features.
AhmedEl-Tayeb - PeerSpot reviewer
Good user behavioral analysis and helpful patching but needs better support services
Some of our products have a first and second line owned by us. We are giving support services to the customers instead of the vendor. Some other products are supported directly by the technology vendor, however. Technical support from the vendor is very bad. Usually, when the customer submits a ticket, they put a severity level on the case. Whenever the case is very important, and there is a real malfunction in the product on the customer side, and there is something down that needs someone to have a look immediately, it takes more time than it should to even engage with the customer. When someone has to contact the customer and have a remote session within the customer environment, they sometimes lack in terms of communication with the customer. The support centers are located in the East and not all have an acceptable level of English in order to communicate directly with the customer.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I like Defender XDR's reports and alerts. They give you updates about the latest hotfixes and zero-day vulnerabilities, which gives me all the information I need to maintain my servers."
"Advanced hunting is good. I like that. We can drill down to lots of details."
"I like 365 Defender's advanced threat hunting. The dashboard is user-friendly with templates for site policies, etc. The most important use case is evaluating the risk links and applications."
"The timeline feature is excellent. I also like the phishing simulation. We have phishing campaigns to educate employees and warn them about these threats."
"The 'Incidents and Alerts' tab is a valuable feature where we can find triggered alerts."
"The most valuable feature is the network security."
"The feature I find most valuable is Defender for Endpoint."
"The most valuable aspect is undoubtedly the exploration capability"
"The loss prevention feature would be the most valuable."
"Anyone can use it, the protection is good, and they have all of the features."
"The initial setup is straightforward, not complex."
"The solution provides a data view of the Alpha systems with Trellix installs and makes small changes to the central management console. Nothing on the endpoints themselves works, but it focuses more on the management side."
"The most valuable feature is ease of use."
"The endpoint protection and disk encryption features are the most valuable."
"The solution is reliable."
"The manageability of the product itself is its most valuable aspect. You have the underlying EPO, and on top of it, you can deploy the various components as you require. This is unlike other solutions like Symantec where you have to deploy everything or nothing. With this solution, you can choose to only deploy antivirus or only deploy a firewall, or only something else. I choose the components and that deployment is done through EPO. It makes manageability very flexible."
 

Cons

"Customers say they want absolutely seamless integration between other Microsoft solutions and Defender XDR, including the ability to change device settings within the Defender portal. They need to contact the IT team responsible for the device management tools to change some settings. They would prefer that those changes be initiated directly from the Defender portal or applied from Intune without involving the IT operations team."
"There are still some components, such as vulnerability management within the vendor product, where improved integration would be beneficial."
"The web filtering solution needs to be improved because currently, it is very simple."
"Microsoft could improve on threat hunting and build more on threat detection and handling. The cybersecurity and cloud security posture features are a bit lesser than standard security products."
"The capability to not only thwart attacks but also to adapt to evolving threats is crucial."
"Offboarding latency should be reduced. Even after a device has been successfully offboarded using a particular offboarding script, it still shows up as onboarded."
"The advanced threat-hunting capabilities are phenomenal, and the security copilot enhances that, but some data elements could be better or have more context inside of the advanced tables themselves. The schemas feel a little limited to what they're building into the product. It's probably just a maturity thing. I imagine we'll see the features I want in the next year."
"Automated playbooks and automated dashboards would be preferable to the way the data is currently being presented."
"There are certain shortcomings in the features concerning DLP in Trellix, where certain additions must be made in the future."
"Trying to move away from the signature model for antivirus and malware blocking is something that would be nice. Instead of having to update every day, which is signature-based, moving to more of a kernel or architecture-based model would probably be beneficial."
"Trellix lacked email protection when it was a McAfee product. They added this feature during the merger with FireEye, but it hasn't been fully integrated. The core features will be integrated into the next release. FireEye has several solutions for EDR and sandboxing."
"The VirusScan needs to improve in order to detect ransomware and other advanced threats."
"There are more secure featured solutions from McAfee on the market but for smaller companies like ours, they are too expensive."
"Technical support is an area that can be improved because sometimes, the response time is a bit slow and the explanation is short."
"On the next release, they should build an easier way to see a repair option within the McAfee icon on your system tray. If there was an issue, you should be able to contact the user or just right-click on "repair". That would be a very good feature to add. That could be a place of improvement, just adding that button, or customizing it."
"Signatures to protect against new attacks."
 

Pricing and Cost Advice

"Licensing is somewhat confusing, particularly when presenting our pitch decks to stakeholders and leveraging key features in premium SKUs, but we managed with some assistance from Microsoft."
"I believe that the pricing of the licensing is fair."
"For Defender, they have Endpoint Plan 1 and Endpoint Plan 2, but I don't know on what basis they have classified Endpoint Plan 1 and Plan 2, but it has given me enough pain to pick and design Endpoint Plan 1 or Endpoint Plan 2 for my organization. In fact, we are still struggling with it. Too many SKUs are confusing. There should not be too many SKUs, and they shouldn't charge for every new feature."
"The functionality is fantastic, but for medium and small-sized companies it's overpriced. It would be better if it were a little bit cheaper."
"Microsoft Defender falls within a mid-tier price range compared to other security solutions."
"The license cost for a year is approximately forty-four thousand, and this annual saving is a significant factor in our decision to switch."
"Defender plan 1 is tenant-wise, and Defender plan 2 is per-user, which makes it more expensive. To have certain features, you would need to purchase the E5 license. For all of the capabilities that the tool provides, the price, though it can be high, is fair."
"The solutions price is fair for what they offer."
"Since the maintenance is done by our own team, the price of the subscription should really be cheaper."
"Pricing is fair."
"There is a one-year and a three-year license available for this solution, we are currently on a three-year license."
"The price of McAfee is pretty similar to Symantec, and there are no costs in addition to the standard licensing fees."
"It is not that expensive. There is no additional cost. We got the entire bundle together."
"I would rate the cost as four to five, considering it's normal compared to other products. I find it nominal and worth the money."
"The pricing is more or less the same as the other tools in the market."
"Trellix may cost around $46 to $47 for a single license without an EDR."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
832,138 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
10%
Manufacturing Company
8%
Government
8%
Educational Organization
43%
Government
9%
Computer Software Company
7%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise.
What is your experience regarding pricing and costs for Microsoft 365 Defender?
Licensing is somewhat confusing, particularly when presenting our pitch decks to stakeholders and leveraging key features in premium SKUs, but we managed with some assistance from Microsoft.
What needs improvement with Microsoft 365 Defender?
It would be beneficial to reduce the number of clicks required to navigate between blades, as the current navigation and breadcrumb system can be a bit confusing. Some inconsistencies exist between...
How does McAfee Endpoint Security compare with MVISION?
The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deploy various components as desired with McAfee Endpoint Security, whereas many othe...
What do you like most about McAfee Endpoint Security?
It provides a robust defense against cybersecurity threats while offering user-friendly features like notifications and approval prompts.
What is your experience regarding pricing and costs for McAfee Endpoint Security?
The license costs are very reasonable, around 1,000 to 1,200 rupees per year.
 

Also Known As

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
McAfee Endpoint Security, McAfee Complete Endpoint Protection, McAfee Endpoint Protection, Total Protection for Endpoint, Intel Security Total Protection for Endpoint, MCAFEE Complete Endpoint Protection
 

Overview

 

Sample Customers

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
inHouseIT, Seagate Technology
Find out what your peers are saying about Microsoft Defender XDR vs. Trellix Endpoint Security and other solutions. Updated: January 2025.
832,138 professionals have used our research since 2012.