No more typing reviews! Try our Samantha, our new voice AI agent.

Microsoft Defender for Endpoint vs OpenText Core Endpoint Protection​ comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Microsoft Defender for Endp...
Ranking in Endpoint Protection Platform (EPP)
2nd
Average Rating
8.2
Reviews Sentiment
7.0
Number of Reviews
212
Ranking in other categories
Advanced Threat Protection (ATP) (6th), Anti-Malware Tools (1st), Endpoint Detection and Response (EDR) (3rd), Microsoft Security Suite (3rd), Agentic Endpoint Security (3rd)
OpenText Core Endpoint Prot...
Ranking in Endpoint Protection Platform (EPP)
32nd
Average Rating
7.8
Reviews Sentiment
5.8
Number of Reviews
31
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, up from 3.6% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 6.4%, down from 9.5% compared to the previous year. The mindshare of OpenText Core Endpoint Protection​ is 1.9%, up from 0.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Microsoft Defender for Endpoint6.4%
Cortex XDR by Palo Alto Networks3.8%
OpenText Core Endpoint Protection​1.9%
Other87.9%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Robert Arbuckle - PeerSpot reviewer
Security Analyst III at a healthcare company with 10,001+ employees
Automatically isolates threats and integrates with logging to reduce response time
Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.
reviewer2584380 - PeerSpot reviewer
vCIO At Grove Networks Inc. at a computer software company with 11-50 employees
Improving threat detection is critical for enhanced protection
We use Webroot Business Endpoint Protection as a NextGen antivirus solution for our clients. It's included in the contract we have with our clients as a cost-effective option for antivirus protection Webroot Business Endpoint Protection is cost-effective for rolling it out to all of our clients,…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Everything is organized straightforwardly; all the incidents are clearly described and everything you need is essentially in one menu and one UI interface, which is quite beneficial for me and also for the customer."
"Cortex XDR is a simple platform that's easy for administrators and users. You have a lot of flexibility to change or customize the features."
"The scalability of Cortex XDR by Palo Alto Networks is very good."
"The behavior-based detection feature is valuable."
"The solution allows control over the user and his machine through Cortex XDR security policies."
"Cortex XDR is stable, offering high quality and reliable performance."
"It is easy to use."
"One of the things that I enjoy the most is using policy extensions. It's like having host firewalls to control USB connections. I think it's a wonderful tool to restrict use when connecting to our computers. Another important tool is Home Insights. That is an add-on to the Cortex solution. I like that because we can see all the vulnerabilities in the environment and control what assets are connected to our network."
"Real-time detection and cloud-based delivery of detections are highly efficient."
"It's really stable. I've used a lot of stuff, a lot of products, like ESET and Kaspersky. None of them are comparable with this one. This one is much better."
"Technical support is good."
"There are some competitive products on the market, but the best is Microsoft Defender because it's very easy to integrate. That's one reason a lot of clients want Microsoft Defender. It's also very easy to implement compared to other solutions."
"The integration of Defender, Security Center, and the Microsoft compliance score, is the feature we use most to share the results with our clients and to create a roadmap together."
"Microsoft Defender for Endpoint is extremely stable."
"It's very reliable and very dependable."
"I have used it enough to be sure that I could recommend it for home use on a PC."
"The initial setup was straightforward. It took five minutes. I installed the solution myself."
"The ability to generate profiles specific to both business groups and organizations has made managing nearly 1000 endpoints very simple."
"The most valuable aspect of Webroot Business Endpoint Protection is that I have never gotten malware with it."
"The solution is very simple and straightforward to use."
"Doesn't consume resources or affect the computer performance at all."
"The solution has many features. It is very easy to define and set the policies based on the user groups, it does not take up a lot of resources in operation, and has provided us with a good track record of protection."
"Customer Service: Top-of-the-line; the busy community as well. Technical Support: Top-of-the-line; the busy community as well."
"My advice about this product is that it is a very good solution and offers a stable and trusted software that runs smoothly and is easy to deploy."
 

Cons

"If Palo Alto reduces the pricing slightly for their products, it would make them more scalable in markets such as India and globally for cybersecurity."
"It is not easy to sell Cortex XDR, not because it isn't a good tool. Its marketing needs to be improved."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"I feel that it should not be a licensed activity because a feature should allow us to see applications running on end devices."
"The server sometimes stops continuously to check things so it would be helpful to receive access updates or technical reasons."
"Cortex XDR by Palo Alto Networks could improve its user interface, which is more complicated compared to competitors such as SentinelOne."
"The price could be a little lower."
"There is also no recovery feature; if some endpoint is under attack there must be the possibility of recovering it or restoring it to a normal state."
"The UI for Microsoft Defender for Endpoint needs to be better."
"I would like to see integrations with other products, such as Spunk and other CM solutions. That would create possibilities for me, and for a SOC, to consolidate all events in an older console, not one provided by Microsoft but provided by a third party, and use it to create more insights."
"Localization is always a challenge, especially with new products you typically want. Solutions are designed to be deployed where the most licenses are being consumed, such as in the United States. They focus on US products, devices, and networks. Specialized deployments for other countries would allow for a smoother experience in transition."
"Where we stand right now, compared to other products that are there in the market, they still have to work on their threat intelligence and the overall maturity of detecting the malware."
"It needs to improve the cybersecurity for lateral movements. For example, when a hacker tries to enter a machine, they try to get the password by doing a lateral movement."
"The time it takes to restore the application could be improved. It has a lot of dependencies. It's not like the Microsoft security that comes with the OS. Updating through the command prompt, most of the time, it takes some time to download some of these dependencies."
"What I think can be improved on Microsoft Defender for Endpoint is that the whitelisting abilities are pitiful, and the understanding of how you go about doing that by the support techs that you speak with is really bad, so that I think is an area where Microsoft Defender for Endpoint needs improvement; the understanding and support of that and what actually works is pretty buggy."
"It takes some time to understand how this solution works. A few things are unclear at the beginning, such as whether it actually restricts the virus or spam at the initial stage, or when there is a security update, how will we come to know and how will it get synchronized."
"It doesn't do anything proactive. The virus has to hit the machine before it detects it."
"I did notice that my OS slowed down, but I don't know if that's due to Webroot."
"One of the biggest pain points is that it's not really ransomware-oriented. They will be able to catch some, but that's where Sentinel One is a better player compared to Webroot."
"The reporting is the weakest part of the Webroot console. Frequently, I export to Excel to massage something into it to pass on to others."
"It would be nice if it had a feature for automatically generating reports on the client end for device status, security status and backup information."
"It needs to improve the problems with the faster connection, and have a huge reduction in false positives."
"This product has room for improvement to display a more detailed representation of the problem when a virus is or isn't stopped."
"We need to have a stronger defense against CryptoLock and other attackers."
 

Pricing and Cost Advice

"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
"We pay about $50,000 USD per year for a bundle that includes Cortex XDR."
"Cortex XDR’s pricing is very reasonable."
"The cost depends on your chosen license type, like Pro or other licenses."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"It's way too expensive, but security is expensive. You pay for your licensing, and then you pay for someone to monitor the stuff."
"Its pricing is kind of in line with its competitors and everybody else out there."
"I feel it is fairly priced."
"Licensing models of Microsoft are renowned for being complex. We just purchased the whole E5 stack. With E5 licenses for users, we get access to a bunch of features that are not just related to security. I would rate them a three out of five in terms of pricing."
"For me, the pricing is very good, but for management it's very expensive. Other solutions are less expensive. But when I present all the information and all the reports they say, "Well, it's expensive, but the cost-benefit is very good.""
"The normal, standalone model, is not expensive, but the enterprise model that includes the bundle with email and some web protection, is a bit more expensive."
"Microsoft Defender ATP is expensive."
"The solution is free."
"The solution is an open source version and was free with a paid version of Windows 10."
"We sell this product as part of Office 365 and it is not expensive."
"You do not need to pay any additional costs for antivirus and anti-malware solutions for endpoint protection."
"The solution is very cost-effective."
"Webroot Business Endpoint Protection is not too expensive. My licenses cost me between $300 and $400. It is really good price wise."
"With Webroot Business Endpoint Protection, I can select a yearly billing cycle."
"I rate the product's pricing a three on a scale of one to ten, where one is cheap, and ten is expensive. There are no costs in addition to the product's standard licensing fees."
"Get a trial, then a multi-year license."
"From a pricing standpoint, I would rate it a four out of five."
"Webroot is less expensive than SentinelOne."
"Its cost is not much per month. Our price is a couple of bucks a user."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
10%
Financial Services Firm
9%
Comms Service Provider
8%
Outsourcing Company
8%
Construction Company
11%
Outsourcing Company
10%
Comms Service Provider
10%
Financial Services Firm
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business82
Midsize Enterprise44
Large Enterprise97
By reviewers
Company SizeCount
Small Business35
Midsize Enterprise2
Large Enterprise2
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Which offers better endpoint security - Symantec or Microsoft Defender?
We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
What is your experience regarding pricing and costs for Microsoft Defender for Endpoint?
We have been discussing pricing, setup cost, and licensing, and we are currently on an E3. We are discussing going to...
What is your experience regarding pricing and costs for Webroot Business Endpoint Protection?
Webroot Business Endpoint Protection is probably on the cheaper side, so I would rate their pricing a one or a two ou...
What needs improvement with Webroot Business Endpoint Protection?
Webroot Business Endpoint Protection needs to improve its ability to detect threats. It does not do what it's adverti...
What is your primary use case for Webroot Business Endpoint Protection?
We use Webroot Business Endpoint Protection as a NextGen antivirus solution for our clients. It's included in the con...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus
Webroot SecureAnywhere Business Endpoint Protection
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Petrofrac, Metro CSG, Christus Health
Mytech Partners
Find out what your peers are saying about Microsoft Defender for Endpoint vs. OpenText Core Endpoint Protection​ and other solutions. Updated: September 2026.
920,929 professionals have used our research since 2012.