Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSandbox vs Microsoft Defender for Endpoint comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 1, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortinet FortiSandbox
Ranking in Advanced Threat Protection (ATP)
7th
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
38
Ranking in other categories
Threat Deception Platforms (6th)
Microsoft Defender for Endp...
Ranking in Advanced Threat Protection (ATP)
3rd
Average Rating
8.2
Reviews Sentiment
7.0
Number of Reviews
210
Ranking in other categories
Endpoint Protection Platform (EPP) (2nd), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (3rd)
 

Mindshare comparison

As of January 2026, in the Advanced Threat Protection (ATP) category, the mindshare of Fortinet FortiSandbox is 5.4%, down from 7.9% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 6.4%, down from 7.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Endpoint6.4%
Fortinet FortiSandbox5.4%
Other88.2%
Advanced Threat Protection (ATP)
 

Featured Reviews

Abdelhamid Saber - PeerSpot reviewer
Senior Security & Infra Technology Systems Engineer at BARQ Systems
Enhanced network security with adaptable integration and really good support
We use FortiSandbox for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues. The adapter is beneficial as it…
Robert Arbuckle - PeerSpot reviewer
Security Analyst III at a healthcare company with 10,001+ employees
Automatically isolates threats and integrates with logging to reduce response time
Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution has the highest stability...The solution's setup is not complex as they are already included in Fortinet."
"You have access to a report as to what behaviors the example file entered in the registry."
"The most valuable feature was the EDR, endpoint detection and response."
"Fortinet FortiSandbox's most valuable feature is the security it provides against threats, such as ransomware. Additionally, it integrates well with APIs."
"The most valuable features for me when it comes to Fortinet FortiSandbox are the integrity of the Sandbox and the power of the analyzing tool of the solution."
"The most valuable feature is the protection and the way it works, the technology is what I like the most."
"The real-time analysis capability of FortiSandbox is beneficial for email analysis."
"The main benefit of Fortinet FortiSandbox is that it allows organizations to detect and prevent unknown threats from entering an infrastructure."
"Endpoint's most valuable feature is deep analysis."
"It's a Microsoft product; it's easier to deploy this product than other options."
"The main thing I like about Microsoft Defender for Endpoint is that you can integrate it with or deploy it with Intune, so it's really easy to deploy without needing to bring in any third-party solution."
"The biggest benefit to Windows Defender is that it is built-in to the operating system by Microsoft."
"We can run the virus scan across our entire environment."
"The antivirus features are very useful."
"It's not really visible for the user - which is a benefit."
"The most valuable features are the Windows Firewall and the regular virus definition updates. These features are very helpful and have helped to improve our security."
 

Cons

"Something that needs to improve, is the end-point protection."
"In general, maybe they are not updated to cover risks."
"Most people are confused about how to use the right integration of the right Fortinet product."
"When you reach the maximum capacity, you cannot upgrade the solution because its hardware is very expensive."
"If updated, Fortinet FortiSandbox could cover other risks."
"I don't know if it is viable to do an improvement like this. When there are passwords in the password-protected files, it can't scan them or do things like this. I don't know if an algorithm or something else could make it better. Nowadays, many legitimate office documents have passwords."
"It would be better if it had support for Mac and Linux."
"The product is good but it could be speedier. In addition, it's quite complex."
"It can be more secure."
"Microsoft Defender for Endpoint could improve by adding more security features."
"We'd like to see integrations with more vulnerability scanning solutions like Tenable."
"Microsoft Defender for Endpoint could improve by providing more user-friendly dashboards. They may be complicated for some."
"One thing that was lacking in Defender was web filtering. Its web filtering wasn't as comprehensive. Sophos was a little bit better than Defender for blocking URLs or installing programs."
"There is a need for improvement in reducing false positives."
"Microsoft Defender for Endpoint does not provide much flexibility in terms of threats."
"I wish they would extend the use of the Security Central portal, even for the free option of Defender. Because, as companies grow, it is labor intensive to manage the AV and detection part of it. For companies already subscribed to Office 365, I think this would be a good enhancement."
 

Pricing and Cost Advice

"The solution is not expensive at all."
"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."
"The solution is unavailable at a lower cost and can be difficult to deploy."
"We are on an annual license to use the solution. We have an additional feature that is integrated with S5, which is working well."
"Fortinet is more reasonable than Palo Alto."
"The price is competitive."
"There is a license to use this solution."
"The solution is affordable."
"You do not need to pay any additional costs for antivirus and anti-malware solutions for endpoint protection."
"We are using the free version."
"Given our extensive Microsoft licensing, transitioning to Defender for Endpoint did not affect licensing costs."
"Compared to ESET, the pricing for Microsoft Defender for Endpoint is on the higher side."
"We have the E5 security license, and the solution comes with that."
"It isn't cheap, but it's reasonable and fair."
"The licensing costs for Microsoft Defender for Endpoint are reasonable."
"The cost is competitive and reasonable because most of the expense is log analytics, storage, and data consumption and ingestion. These things can be throttled and controlled, so they are highly flexible. Defender has a lot of advantages over competing products."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Government
10%
Computer Software Company
9%
Comms Service Provider
9%
Financial Services Firm
8%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise13
Large Enterprise9
By reviewers
Company SizeCount
Small Business80
Midsize Enterprise40
Large Enterprise92
 

Questions from the Community

What do you like most about Fortinet FortiSandbox?
The real-time analysis capability of FortiSandbox is beneficial for email analysis.
What is your experience regarding pricing and costs for Fortinet FortiSandbox?
I think it's affordable. For the six to seven months of usage, the cost has been reasonable.
What needs improvement with Fortinet FortiSandbox?
We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, ...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface, applies behavioral-based endpoint protection and response, and includes risk-ba...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior solution. Microsoft Defender for Endpoint is a cloud-delivered endpoint security s...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
 

Also Known As

FortiSandbox
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG
Petrofrac, Metro CSG, Christus Health
Find out what your peers are saying about Fortinet FortiSandbox vs. Microsoft Defender for Endpoint and other solutions. Updated: December 2025.
881,082 professionals have used our research since 2012.