SentinelOne vs Microsoft Defender for Endpoint

Microsoft Defender for Endpoint was, until recently, known as Defender ATP. How does it stack up against rising star, SentinelOne, for endpoint protection?

If you're a start-up or SME heavily invested in a Microsoft environment, you'll already be familiar with Defender Antivirus and Exploit Guard - they are included with all versions of Windows.

However, most enterprise buyers will want to move to Defender for Endpoint for better EDR functionality such as attack visibility, reporting and threat hunting, as well as vulnerability management. Ultimately, next-generation malware requires next-generation cyber security.

Spread your IT eggs across multiple baskets for security

Opting for another Microsoft product might seem like an attractive option for familiarity. But the ever-present and inevitability of outages demonstrate the dangers of putting all your tech eggs in one - albeit well-known and trusted - basket.

Spreading risk across multiple products and platforms is by far the safer option. It's worth exploring newer companies that offer a serious challenge to the established players.

SentinelOne is rapidly becoming synonymous with unbeatable endpoint protection, as its record-breaking MITRE ATT&CK APT29 2020 test showed and its 100% Total Accuracy Rating by SE Labs.

It is a Gartner Magic Quadrant Leader and also making waves in further testing, as the table below shows. It is competitively and transparently priced, whilst in contrast, Defender for Endpoint is more expensive and subject to Microsoft's complex licensing.

SentinelOne has published some seriously impressive video proof of its capabilities, not least where it defeats Maze ransomware in under two minutes. The platform also comes with a built-in ransomware warranty of up to $1 million - a warranty that has never been claimed.

If you're looking for a next generation endpoint protection solution and need help creating a shortlist, here's a direct comparison page to help.

Endpoint Protection: Key considerations

• Is it easy to deploy and manage?
• Is it dependent on cloud command and control for detection and response?
• How effective has it been against zero-day attacks?
• Do you have feature parity across Windows, Mac and Linux?
• How does it perform in real world test scenarios?
• What do other customers say about it?
  

Comparison of Business Benefits and Features

Business Benefits
Autonomous prevention, detection, and recovery from threats in real-time.	Cloud dependent	Yes
Fast Recovery	Partial (AIR on E5)	Yes - Can be automated or 1-click
OS freedom (Windows / Mac / Linux feature parity)	Yes	Yes
Fewer alerts with more context	Incident based	Yes
AI-powered prevention, detection, response, and threat hunting.	Explorer - manual storylines	Yes
API integration	Yes	Yes
Scalability	Yes	Yes - Support for containers and serverless workloads, especially Kubernetes dynamic workloads.
Higher accuracy across entire attack surface.	Yes - attack surface reduction enhancements.	Yes - Consistent identification of tactics and techniques in the MITRE Phase 2 evaluations.
Centralised Visibility	Yes	Yes - full storyline.
Automation & Control	Yes	Yes - Automated mitigation options via the Storyline Active Response Capability.
Data analytics	Yes	No - SentinelOne does not have its own network security sources to add.
Collection and reporting of; inventory, config and policy management of endpoint devices.	Yes - e.g. threat intelligence reporting.	Yes
Mobile Threat Defence	Yes	Yes
Ease of deployment	No - no on-premise console.	Yes - Excellent timeliness and quality of customer support.
Features
AI across user endpoints, containers, cloud workloads, and IoT devices.	No - dropped support for E-o-L systems.	Yes - New IoT discovery and protection capabilities in its Ranger product.
Static & Behavioural AI	Heuristics	Yes
Exploit protection	Heuristics	Yes + context
Lateral movement	Heuristics	Yes + context
Remediation	Automated	Automated
Rollback	No	Automated
Integrated threat feeds	Yes	Yes
Remote shell	No	Yes
Device control	Yes - Device Discovery	Yes - Device discovery via Ranger.
Firewall control	Yes	Yes
Bluetooth control	Yes	Yes
Threat hunting	Yes	Yes - full storyline
Deep visibility	Yes - Sandbox (deep analysis)	Yes
Event Correlation	No	Yes
Execution Restriction	Yes - EDR in block mode.	Yes
Vulnerability scanning	Yes - UEFI scanning.	Yes - Priority list of vulnerable applications.
Security patching	No	Yes
Triage	Yes - decision-making algorithms.	Yes - Investigate in seconds with automated correlations and Storyline.
Disk Encryption	No	No - Missing add-on for fully featured DLP.

Industry and Peer Reviews

Gartner Peer Insights

Gartner Magic Quadrant for Endpoint Protection Platforms May 2021

Independent Testing

	TESTING BODY
Provided coverage across the attack chain stages	APT29 2020	Scored record results: Least missed detections Most high-quality detections Most correlated detections
N/A		Top ROI score and Recommended rating 2019
NOT CURRENTLY CERTIFIED		99.8% block rate across Windows testing
Top Product for Windows Only 1 false-positive		100% protection against zero-day malware attacks on Windows
		In top 10 vendors Recognized for the commitment to pushing the boundaries of autonomous technology — delivering innovation at scale and speed, and shaping the endpoint market.
Above average UI launch time Below average memory usage Quickest file copy, move and delete time Longest file compression/ decompression time		Performs better than several legacy AV products for the following: Quickest boot time Quickest install time Smallest install size Lowest CPU usage during scan

Pricing

All prices calculated at per endpoint per month, for comparison purposes.

Pricing is 'starting from' and based on list pricing. It can be subject to change, volume discounts etc.

Correct at February 2021

Contact us for accurate pricing based on your specific requirements

Minimum purchase - 100 endpoints

Payment always billed annually

Priced according to Microsoft

$22.00 per user per month

Can't be bought separately – requires Microsoft 365 Business Premium.

This means that to buy security from Microsoft, you have to effectively buy email, the office suite, Azure AD, Windows 10, Teams, OneDrive, Sharepoint, Bitlocker, SCCM and more.