Microsoft Defender External Attack Surface Management Reviews

I am currently in the pilot stage of implementing Microsoft External Attack Surface Management (EASM). My organization is transitioning to a comprehensive track of Microsoft solutions, and we will move to full-scale production in another year, maybe.

Microsoft External Attack Surface Management helps improve the visibility of my exposed vulnerabilities and provides an overview of my security posture across the globe. While asset discovery features are somewhat helpful, complete auto-discovery isn't possible, and manual input of certain assets is necessary.

Further integration across different Microsoft products would be an improvement. Introduction of more AI automation into the products would also be beneficial. The integration is not as seamless compared to competitors like Palo Alto.

I have been using Defender External Attack Surface Management for less than a year.

If ten is the best, then I rate the stability of Defender EASM as seven out of ten.

I rate the scalability of Defender EASM as seven out of ten, as there are complexities with integration.

Microsoft support is pretty good. I would rate it eight out of ten. Although problems are not typically resolved during the first call, they usually get fixed after engaging with their product group.

Positive

I was using some other product for a few years, however, my organization is now moving to implement Microsoft EASM fully.

The process is not only about the setup - it also involves ongoing operational perspectives.

I rate the pricing of the solution as eight out of ten.

The main competitor for Microsoft Defender External Attack Surface Management would still be Palo Alto.

I rate the overall solution as seven out of ten. 

Despite the limitations, I can recommend this product to other users.

The kind of companies using it typically have one hundred or more users and are in various sectors, like manufacturing and insurance. We use it to protect against cyberattacks.

The tests we've done show it might be better for desktops, but it's only been a year, so it's too soon to say it's definitively better than SentinelOne. Last year, I sold my company to a company that only sells Microsoft products. That's why I'm converting my customers to their solutions, most of which are based on Microsoft.

It seems to be better at protecting from cyberattacks. Based on the reviews I've seen and day-to-day experience, we sometimes say, "Wow, it's really impressive that it could stop that kind of attack. 

With Microsoft, support is always crazy, it's not easy to get support. That's their weakness. They need to improve their support. Microsoft will always give good support to their big customers or partners, but we're not a big company. If you had a thousand employees and were a big customer, maybe they'd offer better support. 

But in my 35 years of IT experience, it's always been the same with Microsoft. They transfer us to Europe because we speak French, but when we want to speak in English, they transfer us to people who don't know the product. Most of the time, we find a solution before they call us back.

We started with the product last year, so we just have one year of experience with it.

I would rate the stability an eight out of ten. 

We haven't had any problems with the scalability of this solution. We work with companies with around 100 to 500 users.

But with Microsoft, support is always crazy, it's not easy to get support. That's their weakness.

Neutral

We have more experience with SentinelOne. To me, they both seem to be the same. We'll see in the next two or three years. Every year, companies release new options, and sometimes one is better than the other. It's hard to predict.

We switched because I sold my company, and the acquiring company only uses Microsoft solutions. Personally, SentinelOne was a very good product. I'm not someone who likes to change every year. When I have a good solution, I prefer to stick with it. The most important thing for me is support. When you're in a real problem and need support, the company needs to be there. If they're not, they're not a partner.

We also use SIEM and MDR to monitor the network. They're not really integrated, but they work together. MDR is Covalence, made in Canada. The other one we use is RSA.

The engineers told me it's a little bit more difficult to set up. For example, with certain applications used in manufacturing, like AutoCAD, Defender is faster than SentinelOne. We experienced that.

For example, with Tekla, an engineering design application used to design things like bridges, the program is faster with Defender than SentinelOne. Maybe 20% faster.

We just need a couple of deployment resources. An engineer and a technician. The lab is done and the recipe/layout is fine, so we just have to deploy with the example Management engine. When we use this kind of tool, it's easy to deploy. 

Just a good engineer doing some laboratory tests on the application, and when everything is fast and stable, it's easy to deploy.

It's not really hard to maintain. You do your maintenance, and it seems to be good. We haven't had any callbacks regarding this.

We use it in meetings with clients or customers to explain how many incidents we've detected, the nature of the attacks, and the potential impact on the company. We try to put a dollar amount on that. That's the ROI we use to convince our clients.

So, it's cost-saving and potentially downtime if you're hit by a cyberattack. You could be down for a week or more, even with a good backup.  

I don't see a big difference in pricing compared to its competitors. With "intelligent" or "smart" antivirus, people are willing to pay a little more for something that could make a difference for them.

My recommendation always depends on the customer's needs and how they perceive security. Sometimes people don't think it's important and don't want to pay for intelligent antivirus. They aren't our kind of customer. 

But for those who take security seriously, you need to engage with the C-level executives.

Overall, I would rate it an eight out of ten.