What advice do you have for others considering Microsoft 365 Defender?

I rate the overall product an eight out of ten. If a new customer is going to buy Microsoft Defender XDR, they should clearly state their needs in front of the Microsoft team. They need to specify what they want and what features they require. It's good for the Microsoft team and the customer to understand all the requirements before deployment clearly. This way, any potential issues can be addressed beforehand, making the deployment smoother.

I'm a Microsoft customer. I'd rate the solution eight out of ten. I would recommend the solution to others.

I would rate Microsoft Defender XDR ten out of ten. No maintenance is required. I recommend Microsoft Defender XDR for small businesses like ours.

I rate Microsoft Defender XDR eight out of 10. If you want to implement this product, you should have a team who understands the product well. It's SaaS-based, so the Microsoft team is delivering everything to you. However, you still need to know the product.

Clients implement this tool to address various security issues efficiently. Microsoft Defender XDR offers a unified solution for a wide range of security needs, including extended detection and response across multiple platforms like Office, endpoints, mobile, and identity. Microsoft Defender XDR includes some identity and access management features, especially when used alongside Azure Active Directory's privileged access management capabilities. While primarily focused on Microsoft technologies, Microsoft Defender XDR can integrate with third-party SIEM vendors and covers multiple operating systems, including macOS, iOS, Android, and Windows, through its Defender for Endpoint and Intune capabilities. Microsoft Defender XDR is designed as an XDR solution, utilizing the Mitre ATT&CK framework to detect and correlate events across various areas of compromise. It can identify and correlate events related to advanced attacks, such as business email compromise and ransomware, affecting security operations by providing insights into the events leading up to such attacks. When security products like antivirus and vulnerability management software are discontinued in favor of Microsoft Defender XDR and other Microsoft 365 tools, it streamlines operations but may require less manual correlation of security events. Some organizations might experience a 10-20% cost reduction with Microsoft Defender XDR, but for me, the main goal is to improve detection and response capabilities, not just save money. It is about adapting to the evolving threat landscape rather than focusing solely on cost savings. Microsoft Defender XDR has saved time for our security team, making our operations more efficient. For those evaluating Microsoft Defender XDR, my advice is to understand your requirements and map them to the appropriate licensing capabilities. It is not a one-time project but an ongoing process, so plan for continuous improvement of your security posture. Overall, I would rate Microsoft Defender XDR as an 8 out of 10.

I would rate Microsoft Defender XDR 8 out of 10. No maintenance is required from our end because it updates with the OS.

Every organization has different requirements. In my previous organization, we opted for Palo Alto even though we had Defender and CrowdStrike. CrowdStrike is also a best-in-class solution, but we opted for Palo Alto because it was giving something that was a requirement. In that organization, we also wanted to do some management. We wanted to run some scripts through our XDR solution. CrowdStrike had some limitations. We also wanted to do a console login for a particular machine. CrowdStrike gave that functionality, but it was pretty limited, whereas, in Palo Alto, it was limitless. We could straightaway see the files present on a machine by using the console view. We could run a different set of queries. It did not matter whether we were running a PowerShell script, a Python script, or any other language script because the compiler was embedded in the sensor. Palo Alto met the needs of that company. For the use cases, it was the best fit. In my current organization, the use cases are different. We only wanted an EDR solution. Also, because most of the products in our environment are from Microsoft, the integration with them was pretty easy. That is why we opted for Microsoft Defender. An organization should look at its use cases and then decide on an EDR/XDR solution. Comparing Microsoft Defender's EDR capabilities with other solutions, I would recommend going for another solution available in the market. I would rate it a 6 out of 10 because there are a lot of things that are available in other solutions, such as doing a remote of a particular machine and running other language scripts. Other solutions are also better in terms of the isolation of a particular device, removal from the isolation, and granularity of security control. I am not comparing it with others for vulnerability management because Palo Alto or CrowdStrike do not do that. If there are any vulnerabilities and you want to fix them, you have to do all the work.

I rate Microsoft Defender XDR 7 out of 10. It's a useful product for a professional security analyst who knows how to increase the visibility. You only need to make some front-end changes and put the data on host names into XDR. If someone asked me whether a best-of-breed or single-vendor approach is better, I would support mixing different products. Each security vendor has its own intelligence base. By including other vendors, I am gaining visibility into more indicators of compromise. Nevertheless, I would still pick Microsoft Defender XDR and Sentinel together because they are well integrated. All the big companies and banks use Microsoft. Windows is a popular operating system across the world. Defender and Sentinel are better integrated with Microsoft systems.

I would recommend Microsoft Defender XDR. It is the best solution in the market. For me, Microsoft Defender brought a career change. It made me go deeper into the security products. Previously, I was more of an infrastructure guy. I was more focused on on-prem and Windows servers, but then I moved away from infrastructure. I work for a data center company, and I am a presales solutions architect designing solutions for financial companies, banks, and gaming companies or companies with online casinos. A lot of people did not like Microsoft Defender because Microsoft was not known as a security company, but Microsoft has been investing billions of dollars every year in security, and now, they provide cutting-edge technology, especially with AI. I have been following Microsoft, and I go to Microsoft events. There is a new product called Security Copilot that is going to be completely connected to Defender XDR. It will give much faster feedback and response to threats by issuing reports. Today, a security analyst takes four to five hours to prepare a report. With Microsoft Security Copilot and Defender, it is going to change massively. Within five to ten minutes, you can prepare a report with the Security Copilot solution. It is going to be released very soon, and I am looking forward to it. Overall, I would rate Microsoft Defender XDR a ten out of ten.

I rate Defender XDR 3 out of 10. I don't think Defender XDR is ready to deploy in its current state. It has too many solutions inside, and they're not fully integrated.

Although I would rate Microsoft Defender XDR eight out of ten, its visibility suffers when used with third-party applications and non-Azure cloud platforms. While the implementation itself is straightforward, troubleshooting, log creation, and monitoring can be challenging. This solution may be suitable for Microsoft-centric environments, but its visibility suffers in scenarios with multiple third-party solutions or hybrid deployments.

I rate Microsoft Defender XDR eight out of ten. I think there is room for improvement in terms of its coverage of non-Microsoft technologies.

I rate Microsoft XDR Defender 8 out of 10. I recommend giving the product a try. If it doesn't work for you, try something else until you find a suitable product. There might be other solutions that are a better fit. It's good for my case, but it might not be right for everyone.

I rate Defender XDR eight out of 10. I would recommend Defender XDR. It's a fast solution, and it's easy to train people to use Defender.

I would rate Microsoft Defender XDR a nine out of ten.

I would rate Microsoft Defender XDR an eight out of ten. Microsoft Defender XDR is deployed across our organization, encompassing multiple locations, departments, and continents. With approximately 200 international users, we rely on a team of four in-house administrators for security management. Additionally, we utilize the services of external companies for first-line support, who also handle specific tasks within our Microsoft 365 environment.

I would rate Microsoft Defender XDR an eight out of ten. We require three people for maintenance. We have Microsoft Defender XDR deployed across multiple locations, roles, and teams. Before implementing Microsoft Defender XDR, ensure that all the features will be utilized otherwise it is more cost-effective to go with a smaller package that includes only the features needed by the organization.

Microsoft Defender XDR has helped us reduce two full-time employees. The solution is our identity source, which protects our identities through Microsoft Intra ID. The solution helped us save time by not flipping between the systems. I rate it an eight out of ten.

The tool provides a little bit of unified identity and access management. It's not the most important thing for us. Security is a multi-layered strategy, and Defender is one aspect. The product is one of the many tools we deploy to ensure that the lateral movement of advanced attacks does not occur. If it were the only tool we had, I wouldn't be as confident in saying that we have the proper levels of security, but it is one of the multiple tools we have. So, lateral movement is almost impossible. The solution might be able to adapt to evolving threats in a smaller shop. However, it is not so in our organization. We run a bank. We are testing out Copilot. We're about to roll it out to several thousand users. The tool hasn't yet helped improve things in our organization, but it has the potential. Copilot is new. It's difficult to determine the ROI and its value. It's hard to tell. We do get some value out of the product. Overall, I rate the product a seven out of ten.

I rate Microsoft Defender XDR 10 out of 10. I don't know of anybody else that's even remotely close to doing what they're doing. It's reduced my work in terms of identifying things. I might be in a position where I'm engineering, but I'm still technically on the response team. I'm using the tool the same way, and it has gotten better and better every time they add something new.

I would rate Microsoft Defender XDR an eight out of ten. It excels in its core functionalities, although there are some areas for improvement. Overall, it's a robust security stack that stands out among its competitors. Microsoft 365 Defender is more than just a name, it's a comprehensive suite of security solutions. However, the specific services included depend on the licensed SKU purchased by an organization. From a security perspective, having identity and email security is crucial, but ultimately the decision depends on the organization's risk tolerance and budget. Microsoft 365 XDR, a newer name introduced by Microsoft, isn't a separate product, but rather a high-level dashboard that provides an overview of our organization's deployed Microsoft security solutions. It's difficult to directly compare 365 Defender, a software suite, to XDR, a unified platform for extended detection and response. While organizations could build their central unified view or even find other vendors offering similar solutions, integrating seamlessly with existing infrastructures would be a significant effort. This puts Microsoft in a strong position to provide a unified view, making XDR stand out in this regard. While platforms like SOAR share some similarities in terms of user integration, they don't quite match the comprehensiveness of Microsoft's XDR platform. Microsoft Defender primarily consists of Software as a Service offering, meaning cloud-based services with minimal hardware maintenance required. Think of it like an online application we access and use, instead of something we install and maintain on our own. Updates to the Defender engine, specifically the Defender for Endpoint Engine, are seamlessly delivered through Windows updates. The other solutions within Defender also require minimal maintenance. Defender for Identity might occasionally suggest health checks to perform, sometimes generating alerts about outdated sensors or new security recommendations from Microsoft, e.g., disabling TLS 1.1. These alerts might arrive via email and often simply require updating sensors to the latest version. However, the specific maintenance needs depend on the individual solution we're using within the Microsoft 365 Defender suite. Overall, we can expect maintenance to be very minimal. Before diving into new security solutions, take some time to understand your specific needs. Research what areas require the most protection and prioritize accordingly. If you have existing solutions that need replacing, Microsoft offers several options that can seamlessly integrate. However, if you're simply looking to bolster your security posture, there's no need to go all-in at once. Microsoft makes it easy to gradually expand your service offerings and incorporate new security packages. It's worth checking your current license queue, as you may already have access to some of these solutions under your existing Microsoft cloud subscription. Most organizations have some level of Microsoft presence, so depending on your specific SKU, you might already be eligible for these solutions. So, do your research and focus on the areas that require the most immediate attention. Remember, you don't need to jump into everything at once, as Microsoft offers a comprehensive suite of security solutions accessible through the 365 dashboard.

I would rate Microsoft Defender XDR an eight out of ten. Microsoft Defender XDR is deployed across multiple locations and departments. Minimal maintenance is required for patching.

Microsoft Defender XDR provides unified identity and access management. It is installed on every computer and checked from the Microsoft security admin center. The tool is easy to use. You can use one account to log in to any Microsoft service. We are aware of our compliance. We can now check the devices and get reports about it. The product can adapt to evolving threats. We use it to manage only one tenant. We have Mac devices where Microsoft Defender XDR cannot help us. We have the tool deployed across different locations like Germany and Denmark. I rate the product an eight out of ten. You need to follow its guidelines.

We do use more than one Microsoft security product. We've integrated with other products. I do not make use of the directional sync capabilities at this time. I'm also not using Microsoft Sentinel. I'd rate the solution eight out of ten. If the deployment of the agent was better, I'd move my grade closer to ten. It should be more automatic. You also shouldn't have to install the logs.

My advice is don't be frightened when you start getting into the solution. If you are not used to the environment, it is a mouthful, and it can really scare your socks off. There's just so much to it that you won't really know where to start. The best thing I can recommend to anybody who is starting is to get somebody who knows the system to give you a walkthrough. Also, look at the tutorials to see what the functionalities are. It will be beneficial for any person to get a good overview of what's going on in 365 Defender, the capabilities and how it looks. But getting in contact with somebody who has some experience already in using it will help you to ask where to find things. "Where do I go from here? Show me how you're set up, so I can at least see some of the functionalities." My very first impression of 365 Defender was that I was looking for something, but I didn't even know where to start. It was too overwhelming. As I spoke to other people who knew about the system, they gave me an overview and that made it easier for me to understand and to know where to go. 365 Defender is our main deployment, but we've got the endpoints also connected on Intune. They work together to deliver coordinated detection and response in our environment. Our complete suite is pretty much all Microsoft. Our environment is a 50/50 hybrid. We use Intune for certain policy changes and some of the deployments. But because our environment has a lot of legacy systems, we make use of the normal, on-prem deployment services as well. Sentinel is linked to our on-premises Active Directory. It helps identify things that are happening on-prem. For example, when a user's account instance gets locked out, it will show you, on Defender, from which local machine it was locked out. Or if certain things are accessed, it will show that information on the on-prem Active Directory. It works well. For investigating and responding to threats, it definitely helps by dumping the information in a centralized location with the alerts to identify a bit more flow pattern. If something happens that's not on the cloud area, but it's on-prem, it helps track and identify movement. The information from Sentinel is an added bonus. Overall, Defender 365 has saved us time, compared to the old ways of doing things, but at the same time, I wish the site was faster. Sometimes it can be very slow. Best-of-breed solutions versus a single vendor's suite comes down to personal experience. With best-of-breed, at least you know that they have been tested in the industry and have a lot of history behind them. Also, the redundancy would be a lot better. Going with a single vendor sometimes makes it a little bit difficult, especially if they are only focusing on one area. It's a difficult question. It might come down to the way someone was "brought up" in the security industry or the way that they trust these companies. I give Microsoft 365 Defender a nine out of 10. Once you get to know the system, it's really awesome. It provides a lot of insights.

I would rate Microsoft 365 Defender an eight out of ten. There are many rapid and independent changes happening each month or every other month, making it difficult to keep track of them. I prefer adopting a best-of-breed strategy instead of relying on a single-vendor security suite. I have observed this approach being implemented in numerous organizations. Microsoft 365 Defender surpasses most platforms available in the market in terms of advancement and offers extensive integration with other Microsoft solutions. I highly recommend this solution.

Optimally managing a combination of various security solutions can be time-consuming and overwhelming. Instead, having a single dashboard where you can consolidate and run all your queries proves to be more efficient. While the intention might be to extract the maximum benefits from multiple solutions, dividing your attention among them hinders the ability to fully leverage each one. Therefore, it is advisable to identify a comprehensive solution that meets your requirements and focus on understanding how to maximize its potential and utilization. Furthermore, using multiple solutions in an environment can lead to compatibility issues and conflicts. When you have multiple applications performing similar functions, it can complicate matters and potentially cause problems in the future. To avoid such complications and maintain a streamlined setup, it is advisable to stick with a single solution and focus on understanding and optimizing its usage. By doing so, you can ensure better control and avoid potential disruptions that may arise from using multiple conflicting applications. To truly grasp the value of a service like Defender, it may be challenging for someone who hasn't experienced the need for its intervention firsthand. It is essential to engage individuals who have encountered scenarios where Defender played an important role in saving the day. When evaluating the effectiveness of the solution, it is important to involve those with hands-on experience, who have witnessed the capabilities of the product and understand how to maximize its utilization. The hands-on experience becomes paramount when screening and assessing the proficiency of individuals in dealing with this specific solution. I would give Microsoft 365 Defender a rating of nine out of ten. The only reason I'm not giving it a perfect score of ten is that it can be quite technical for someone who is just starting out. Additionally, there may be occasional false positives and negatives, which is not unique to Defender but is a common occurrence in various software and security applications. However, apart from these minor aspects, I consider Microsoft 365 Defender to be an excellent solution overall.

To a security colleague who says it’s better to go with a best-of-breed strategy rather than a single vendor’s security suite, I would say that I'm slightly biased because I'm such a fan of the Microsoft suite. Some people do say that you shouldn't put eggs into one basket, and you're giving a lot of control to Microsoft and things like that. I would advise evaluating based on your needs. For example, for your endpoints, you might see much better value in CrowdStrike, Tanium, or something like that as compared to Defender for Endpoint. You can do PoCs. Microsoft makes it quite easy. You can have the trials and things like that. You can play around and see which one supports your environment. I wouldn't say Microsoft is necessarily the option for all organizations, but I do think it's a very compelling offer. They're constantly evolving the product. They pay a lot of attention to consumer feedback. They've enterprise feedback as well to improve the product. I wouldn't completely rule out either option. If you've got one that's tried and tested for your enterprise, and that's a third party, you can see what Microsoft can offer. If it just doesn't match up, then stick to what you have even if it costs more because all in all, you may have tried and tested processes. You may have an investment in that product, and it may just have capabilities that the Microsoft one doesn't have. I would also encourage you to add a feature request for the Microsoft one, and then they'll be more on the equal side. I would advise doing a PoC. If you are using Carbon Black, CrowdStrike, or Titanium, evaluate it. Have a sample host or spin up some VMs or onboard them to Defender. Do some simulations and do some attacks that you think are likely going to be. See how the logs look, see the investigation processes, and do a gap analysis with your current solution. If it brings you any value, then potentially look to deploy it further. Don't just go all in without understanding what it does. If you don't have any security solution right now, and you are a small business or a local business, it's worth doing the trial and seeing what value you get from the trial because, in that situation, you don't have anything to compare to. You are an easy customer to onboard from Microsoft's perspective because you wouldn't be that complex. So, do a trial and then go from there. I would rate it an eight out of ten overall. I do really like the product. I do like the fact that it combines all the alerts into one. I remember when I was a security analyst back in 2019, I had to open multiple tabs and close alerts in one portal and then the other portal. They've done a good job of bi-directional syncing of alerts. If you're closing in 365 Defender, it'll close in the MCAS portal or cloud apps. Overall, the biggest thing for me was just advanced hunting capability because previously, it wasn't possible to get those cloud app events or Defender for Office events to do hunting. Endpoint was the first one to have that hunting capability, and I'm glad that they've extended that to the other stacks. So, overall, I would give it an eight, and I'm really impressed.

I rate Microsoft 365 Defender a nine out of ten. I personally wouldn't recommend only using a single solution or vendor. If you don't try other products, then you won't be aware of what is happening in the market. There should be multiple products involved, so you can compare the solutions and go with the best one.

The solution doesn't require any maintenance, as far as I have seen. Between a single- and a multi-vendor security solution, it depends on whether you are using multiple technologies. Microsoft solutions are pretty much integrated, and help you with the pre- and post-breach. If you are using Microsoft, I would absolutely recommend Microsoft 365 Defender. But if not, I would recommend something else because, with just Microsoft, you probably would not be getting the best solution. There would probably be latency.

I rate Microsoft 365 Defender a ten out of ten. Microsoft is a one-stop solution, and it has an answer for any problem you're facing. Before implementing 365 Defender, you should be clear about the problem you want to solve. Hiring a consultant can help, but typically, my clients know maybe three out of the five things they should know.

I did not use Microsoft Defender for Cloud, but I saw the cloud part for monitoring cloud applications. It was nice, and it had some added functionalities. For example, application risk scoring was very good. It shows what data has been considered to give a particular risk score, which is useful for a new learner like me. It was helpful to know the criteria for scoring. They also included so many applications. There were more than 24,000 cloud applications inside their catalog. That's a really good catalog. To a security colleague who says it’s better to go with a best-of-breed strategy rather than a single vendor’s security suite, I would agree that multiple vendors are better than a single vendor because every vendor has different capabilities. It's always better to use the best products from different vendors than to use all the products from the same vendor. I would rate Microsoft 365 Defender a nine out of ten.

From time to time there is maintenance in reviewing the rules so that we can focus on how to use it better. But that's not "maintenance" in the standard meaning that you need to check if the processes are working properly. For example, our security department uses phishing attack simulations to check if users are aware of how the tool behaves when we receive a phishing attack and what actions are taken to remediate that attack. When trying to decide between a best-of-breed strategy versus a single vendor for security, it depends on the approach, resources, and of course, money. You can have a single vendor and extensively use the solution and really invest time and effort into better understanding how it works. Or you can buy a few solutions but understand each of them less, because it's not possible to have deep knowledge of how every solution works. For me, it's better to use only Microsoft 365 Defender instead of having additional security providers. I can then go deeper into the details and ask the vendor to implement a feature that is useful, and that probably will not only be useful for me. We can build it together instead of blaming each about who should do better work. My advice is to go deeper into the details to understand how remediation is utilized inside the solution. Notice that Microsoft 365 Defender is using data collected from every tenant that is using the solution, not only mine. If a company's controls have been attacked, the tool can already protect me because I'm not on the first line of fire. It's great to understand this fact and understand the idea behind it and what the benefits are.

I would rate this solution as eight out of ten. My advice to those who are looking to implement this solution is to get help from the right company so you can use the solution properly. Defender helps us prioritize threats, but I would say it's a combination of all the information that we're getting from the internet and from other resources. To a security colleague who says it's better to go with a best-of-breed strategy rather than a single vendor security suite, I would say that it depends on the customer. If someone has their own VSOCK implemented and many security guys on board, then maybe best-of-breed is what they need. If someone is a classic customer who doesn't know a lot about security, then they should stick to a one-vendor strategy.

I would definitely recommend this solution. Getting the product is easy. You simply get the license, but after getting the product, you need to go through the deployment and configuration of the product to match your environment. You can just try out the product and experiment in your own way and learn each and every feature. The documentation is completely public. I would rate it an eight out of ten because there are a few areas where it can be improved.

For the best and most seamless user experience, it's best to go with a single vendor because there could be a lot of complications going with a best-of-breed strategy. It's easier to understand things with a single vendor. When you don't understand a feature, ask questions and reach out for support. There are some features that are being used wrongly or that are underutilized. Also, test the product beforehand. They provide trials so you can test the solution and see if it meets your expectations.

We've been dealing with the latest version of Microsoft 365 Defender. For an average project, deployment of Microsoft 365 Defender can take a week, but we do need some change management models, because we still need to train the users about safe links and attachments, so we sometimes have to expand the average time, but implementation is not very hard. If we only do the implementation, one week is more than enough. We rely on just one to two persons, particularly engineers, for the deployment and maintenance of Microsoft 365 Defender. My recommendation to others looking into implementing Microsoft 365 Defender is that reading the documentation is really good. If you are a Microsoft partner, you'll also have benefits, e.g. CDS tenants and demo tenants that are free to you for one year, so you can test the products first, before you implement. If you are a partner, my advice is to use your Microsoft partner benefits. I'm giving Microsoft 365 Defender a rating of eight out of ten.

I rate Microsoft 365 Defender an eight out of ten.

I would recommend this solution to others. I rate Microsoft 365 Defender a nine out of ten.

We are partners with Microsoft. I'm in a customer-facing role where we propose different email security solutions to our customers. My role demands that I identify the required security solutions for the different needs of our customers. We are on the latest version of the product. I'd advise potential new users to define their business requirements first, however, it's likely Defender will need them and provide what they need. I'd rate the solution at a nine out of ten.

Microsoft 365 Defender is Microsofts first try at a security package as part of Windows. They are offering different services with Zero Trust security, SIAM security, SOAR security with Azure. They converge all products in the same security center. Microsoft 365 Defender is one strong point to the overall security protection. I rate Microsoft 365 Defender a five out of ten.

I rate Microsoft 365 Defender a seven out of ten.

I would recommend Microsoft Defender to new users. I would advise them to understand their exact requirements and check if it matches before taking it up. On a scale from one to ten, I would give Microsoft 365 Defender a seven.

I recommend this solution to others, it is easy to use and they will enjoy it. I rate Microsoft 365 Defender a seven out of ten.

We are using the latest version of the solution. We sell the product and we use it as well. We are resellers. We are using advanced endpoint detection in our security for email and a lot of other things, however, it is combined with Cisco solutions, for example, Cisco Umbrella. We have a file solution from IBM, and internally we are using it, however, I am not directly using all of these things. I'm using the administrative part for partnership purposes. I'm not a technical person. I am using them as a customer as part of Microsoft OS. There is a lot of other tools behind the scenes as well, however, they are working on a network level, on a data center level, to secure the company. I'd rate the solution at a seven out of ten.