Microsoft Defender for Endpoint vs OpenText Core Endpoint Protection​ comparison

Microsoft Defender for Endpoint vs. OpenText Core Endpoint Protection

Download the complete report

Helped 884,933 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of March 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.5%, down from 4.0% compared to the previous year. The mindshare of Microsoft Defender for Endpoint is 7.8%, down from 11.2% compared to the previous year. The mindshare of OpenText Core Endpoint Protection is 1.3%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Protection Platform (EPP) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender for Endpoint	7.8%
Cortex XDR by Palo Alto Networks	3.5%
OpenText Core Endpoint Protection	1.3%
Other	87.4%

Endpoint Protection Platform (EPP)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Robert Arbuckle

Security Analyst III at a healthcare company with 10,001+ employees

Automatically isolates threats and integrates with logging to reduce response time

Overall, I would evaluate the Microsoft support level that I receive at probably about a seven, but that depends on the day. It has been spotty. We have had issues where the urgency level of the Microsoft support is not as high as ours, especially during a data breach or potential data breach situation. We have had issues with some of the offshore support being lackluster. One specific thing that comes to mind is we were on a support call with our CISO on the call, and the Microsoft agent, who did not actually work for Microsoft, is one of the vendors that Microsoft uses for support, said, "Just to set expectations, my lunch break is in an hour and I am going to go away then." For us, it was already ten o'clock at night and we had been working on this for a couple of hours, trying to get a security engineer on with us. For him to tell us that he was going to go away and have lunch, it was, "Okay, but go find somebody else if you need to." It was just the lackluster approach, and it seemed like he did not really care. We seem to get a lot of this when we get non-Microsoft support. I can identify areas for improvement with Microsoft Defender for Endpoint, as it is kind of a convoluted mess to try to take care of false positives. Especially when they have been identified as false positives but they keep going off over and over again. It is great for my pocketbook because it generates a lot of on-call action, but I would really prefer more sleep at two o'clock in the morning than dealing with false positives. I would say that the unified portal for managing Microsoft Defender for Endpoint is suitable for both teams as they are all in there. It would be great if they would stop moving things around and renaming things, which makes sense. The new XDR portal is pretty nice. Being able to have it central again inside of the regular Security Center without having to open up two windows is helpful. Overall, I think it is pretty good. There is always going to be something that could be improved, such as alerting and the ability to modify alerts would be a little bit helpful to have. Being able to add more data into the alerts and turn off alerts that are not as useful would be beneficial. It is hard to say what the quantitative impact the security exposure management feature has had on our company's security, because a lot of it is kind of subjective. I think we are sitting at around a fifty percent score still, and a lot of it is just kind of unusual circumstances that we cannot really implement without breaking the organization.

Read full review

reviewer2584380

vCIO At Grove Networks Inc. at a computer software company with 11-50 employees

Improving threat detection is critical for enhanced protection

We use Webroot Business Endpoint Protection as a NextGen antivirus solution for our clients. It's included in the contract we have with our clients as a cost-effective option for antivirus protection Webroot Business Endpoint Protection is cost-effective for rolling it out to all of our clients,…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It's a nice product that's stable and scalable."

"Cortex is the best tool for endpoint detection, with playbooks that automate and gather endpoint logs, block malicious processes, and update incident tickets, showcasing end-to-end processes with automation in investigation and reducing the analysis workflow."

"After deploying Traps, we saw the performance of the network improve by 65 to 70 percent."

"The ability to kind of stitch everything together and see the actual complete picture is very useful. I guess you'd call it a playbook. Some people call it the forensics analysis of what was happening on particular endpoints when they detected some malicious behavior, and what transpired before that to cause that. It is also very user friendly. The way they have done everything and integrated all the solutions that they've purchased over the years to make it a very seamless, effective product is very good. One thing about Palo Alto is that they take the products or services that they purchase and make them seamless for the end user as compared to some companies that purchase other companies and then just kind of have their products off to the side or keep different interfaces. Palo Alto doesn't do that."

"What I like about Cortex XDR by Palo Alto Networks is that it is a comprehensive solution that contains everything the organization may need when using endpoints."

"Traps has drastically reduced our endpoint attack surface via advanced detection capabilities, sandboxing of never before seen programs, and by drastically limiting where executables can launch in the first place."

"Cortex XDR is a very capable solution for protecting large networks and a lot of endpoints. It's very useful because the automation is very high, and if you combine it with the features on Palo Alto firewalls, it provides very strong protection."

"The solution doesn't need a high level of technical training."

More Cortex XDR by Palo Alto Networks pros

"You can query and access useful information from logs and events, which is powerful and efficient."

"It comes included with the Windows license."

"Microsoft Defender for Endpoint is free and part of the licensing stack of other Microsoft products."

"I find the vulnerability management section of Microsoft Defender for Endpoint to be very useful for organizations."

"It doesn't cause the slowness of the system, which is one of the reasons why I like it."

"Defender for Endpoint has significantly improved our security posture."

"One of the main features is the solution is very light on resources and we do not have any problems with it."

"The endpoint detection of threats is valuable. The initial detection of things like ransomware and viruses and being able to shut down machines immediately and stop a threat is valuable. We can stop a threat at a source versus allow it to propagate it across the network."

More Microsoft Defender for Endpoint pros

"Customer Service: Top-of-the-line; the busy community as well. Technical Support: Top-of-the-line; the busy community as well."

"The initial setup is not complex at all. It's very straightforward."

"It is an easy-to-use and easy-to-configure product."

"It is very light. It is the only solution that can be installed on a machine that already has an antivirus. It is a pretty complete solution."

"It is pretty unintrusive. It doesn't take over the system like McAfee or Norton. It doesn't use a whole lot of resources. McAfee and Norton use a lot of resources."

"The main reason we had Webroot is that it was cost-effective for our clients."

"Their policy management, their cloud-based dashboard and user interface are very easy to navigate."

"Low performance requirements."

More OpenText Core Endpoint Protection pros

Cons

"It's very time-consuming to log support issues and the people that answer the tickets aren't very knowledgeable."

"Basically, they don't provide customer support tools just to investigate the logs."

"Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."

"Whenever the tool releases a new version when deploying the product across the organization, I feel like there are some disturbances in the CPU usage after upgrading the tool to the latest version."

"Cortex XDR could be improved with more GUI features."

"Cortex XDR could improve its sales support team, including better commission structures and referral programs."

"The complexity and confusion regarding product variants, such as XDR, Forexiant, and Forexon, must be addressed."

"There's room for improvement with Mac device installations, which can be challenging."

More Cortex XDR by Palo Alto Networks cons

"Something that is unique to Microsoft is its licensing model. When you go out and you buy McAfee or Symantec, you know what you're getting out of the box, but with Microsoft, often, when you're looking to achieve a certain set of capabilities, those capabilities are spread across different products. You might try to do something you could do with CrowdStrike, but then find out that you also need to purchase Microsoft Defender for Identity or Microsoft Defender for Azure. You realize that when they talk about what they can offer within the Microsoft platform, it's really the suite of investments. So, sometimes, you may find yourself buying Defender for Endpoint thinking that it matches CrowdStrike, but then you find that Microsoft really needs to sell you something else. One plus one will equal three, but when you have a very concise platform, such as CrowdStrike, you know what you're going to get."

"The scanning is slow when it is working with incoming emails."

"I think the overall portal of Microsoft Defender for Endpoint could be improved; sometimes there's moving around to different spots and it's a little hard to navigate, so getting used to that was perhaps the biggest hurdle."

"Right now, there's a portal for Azure, portals for Microsoft Office, and portals for endpoints. It would be good to have only one portal and integrate everything."

"Defender could be more secure and stable."

"I have accounts for administrators and corporate employees, but I also have accounts for students. I can't split these types of accounts. I need a separate configuration for both... I need to research how I can get alerts for only the administrative machines."

"I wish they would extend the use of the Security Central portal, even for the free option of Defender. Because, as companies grow, it is labor intensive to manage the AV and detection part of it. For companies already subscribed to Office 365, I think this would be a good enhancement."

"It can be more secure."

More Microsoft Defender for Endpoint cons

"There should be a Webroot Business Endpoint Protection mobile app."

"Unified threat management (UTM) integration."

"There needs to be more advanced analytics. It would make it a more powerful antivirus solution within the marketplace."

"Their customer support should be better. We started having some issues with it, and we didn't get the required support."

"Reporting system could be improved."

"It would be nice if it had a feature for automatically generating reports on the client end for device status, security status and backup information."

"We need to know more details about how the virus interacted with the computer."

"The solution could improve by providing better ransomware protection."

More OpenText Core Endpoint Protection cons

Pricing and Cost Advice

"This is an expensive solution."

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."

"The price was fine."

"It's about $55 per license on a yearly basis."

"It has reasonable pricing for the use cases it provides to the company."

"The pricing is a little high. It is per user per year."

"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."

"I am using the Community edition."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"The cost is high, compared to other products in the market, if you look at it as a separate product. If you look at the cost where it is part of a bundle, the cost is okay."

"This is an expensive product and licensing for all Microsoft products is a big issue."

"The nice thing about Defender and Sentinel is that the cost is based on the data logs that you ingest from the Defender endpoints and data connectors. I don't have to buy a 25- or 50- or 1,000-user or enterprise license. I can buy one license at a time."

"Compared to ESET, the pricing for Microsoft Defender for Endpoint is on the higher side."

"There is no licensing fee."

"I do not have to purchase antivirus solutions anymore because Microsoft Defender for Endpoint is integrated into Windows and comes free."

"Everybody would like to see a lower price on everything. The Slovenian market is basically an SME market with clients having up to 100 seat licenses, comprising 90% of the company. They're very price sensitive. So, the price could be cheaper."

"Microsoft Defender for Endpoint can be costly as a standalone solution."

More Microsoft Defender for Endpoint pricing and cost advice

"I can't recall the exact pricing, but I believe there is a monthly fee of $20-30 per user."

"Get a trial, then a multi-year license."

"We evaluate other options using multiple choices, best value, management and functionality."

"It is relatively cheap."

"From a pricing standpoint, I would rate it a four out of five."

"I rate the product's pricing a three on a scale of one to ten, where one is cheap, and ten is expensive. There are no costs in addition to the product's standard licensing fees."

"Webroot Business Endpoint Protection is not too expensive. My licenses cost me between $300 and $400. It is really good price wise."

"The solution is pretty cheap, actually. At our level, which is at 2,500 endpoints, we're paying 87 cents an agent per month."

More OpenText Core Endpoint Protection pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.

See recommendations

884,933 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

Manufacturing Company

Financial Services Firm

Comms Service Provider

Computer Software Company

10%

Manufacturing Company

Financial Services Firm

Government

Computer Software Company

Performing Arts

Manufacturing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	44
Midsize Enterprise	20
Large Enterprise	47

By reviewers
Company Size	Count
Small Business	81
Midsize Enterprise	40
Large Enterprise	95

By reviewers
Company Size	Count
Small Business	35
Midsize Enterprise	2
Large Enterprise	2

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

Which offers better endpoint security - Symantec or Microsoft Defender?

We use Symantec because we do not use MS Enterprise products, but in my opinion, Microsoft Defender is a superior sol...

How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?

The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...

What is your experience regarding pricing and costs for Microsoft Defender for Endpoint?

I'm not too familiar with the pricing, setup costs, and licensing for Microsoft Defender for Endpoint; it wasn't some...

What is your experience regarding pricing and costs for Webroot Business Endpoint Protection?

Webroot Business Endpoint Protection is probably on the cheaper side, so I would rate their pricing a one or a two ou...

What needs improvement with Webroot Business Endpoint Protection?

Webroot Business Endpoint Protection needs to improve its ability to detect threats. It does not do what it's adverti...

What is your primary use case for Webroot Business Endpoint Protection?

We use Webroot Business Endpoint Protection as a NextGen antivirus solution for our clients. It's included in the con...

SentinelOne Singularity Complete vs Cortex XDR by Palo Alto Networks

Comparisons

Compared 6% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Trellix Endpoint Security Platform vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

CrowdStrike Falcon vs Microsoft Defender for Endpoint

Compared 4% of the time

HP Wolf Security vs Microsoft Defender for Endpoint

Compared 4% of the time

Symantec Endpoint Security vs Microsoft Defender for Endpoint

Compared 4% of the time

F-Secure Total vs Microsoft Defender for Endpoint

Compared 3% of the time

Trellix Endpoint Security Platform vs Microsoft Defender for Endpoint

Compared 2% of the time

More Microsoft Defender for Endpoint Competitors

Huntress Managed EDR vs OpenText Core Endpoint Protection

Compared 6% of the time

SentinelOne Singularity Complete vs OpenText Core Endpoint Protection

Compared 5% of the time

Malwarebytes Teams vs OpenText Core Endpoint Protection

Compared 4% of the time

CrowdStrike Falcon vs OpenText Core Endpoint Protection

Compared 4% of the time

HP Wolf Security vs OpenText Core Endpoint Protection

Compared 4% of the time

More OpenText Core Endpoint Protection Competitors

Product Reports

Cortex XDR by Palo Alto Networks

Download Cortex XDR by Palo Alto Networks product report

Microsoft Defender for Endpoint

Download Microsoft Defender for Endpoint product report

OpenText Core Endpoint Protection

Download OpenText Core Endpoint Protection product report

OpenText Core Endpoint Protection report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, MS Defender for Endpoint, Microsoft Defender Antivirus

Webroot SecureAnywhere Business Endpoint Protection

Interactive Demo

Demo not available

Palo Alto Networks

Microsoft

Demo not available

OpenText

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Microsoft Defender for Endpoint is a comprehensive security solution that provides advanced threat protection for organizations. It offers real-time protection against various types of cyber threats, including malware, viruses, ransomware, and phishing attacks.

With its powerful machine-learning capabilities, it can detect and block sophisticated attacks before they can cause any harm. The solution also includes endpoint detection and response (EDR) capabilities, allowing organizations to quickly investigate and respond to security incidents. It provides detailed insights into the attack timeline, enabling security teams to understand the scope and impact of an incident.

Microsoft Defender for Endpoint also offers proactive threat hunting, allowing organizations to proactively search for and identify potential threats within their network. It integrates seamlessly with other Microsoft security solutions, such as Microsoft Defender XDR, to provide a unified and holistic security approach. With its centralized management console, organizations can easily deploy, configure, and monitor the security solution across their entire network.

Microsoft Defender for Endpoint is a robust and scalable security solution that helps organizations protect their endpoints and data from evolving cyber threats.

Microsoft

OpenText Core Endpoint Protection offers cloud-managed endpoint security with AI integration, providing real-time protection and lightweight performance. It ensures low system impact, seamless cloud integration, and cost-effective security solutions for various devices.

OpenText Core Endpoint Protection is a comprehensive endpoint security platform utilized by managed-service providers for antivirus and firewall functionality across servers, workstations, and mobile devices. It employs AI for robust threat detection, integrating with cloud applications for real-time updates. Multi-layered security features include malware protection, network defense, and DNS protection. Although connectivity and threat reporting need improvement, this platform extensively supports remote device management and integrates efficiently with Active Directory policies.

What are the key features of OpenText Core Endpoint Protection?

Cloud Management: Centralized admin console for easy oversight
AI Integration: Enhanced threat detection capabilities
Lightweight Performance: Minimal impact on system resources
Real-time Threat Database: Constant updates for effective protection
Web Control Interface: Monitors and controls web traffic

What benefits are associated with OpenText Core Endpoint Protection?

Ease of Setup and Maintenance: Facilitates quick deployment and upkeep
Seamless Cloud Integration: Simplifies scalability and operation
Cost-Effectiveness: Affordable pricing with comprehensive features
Mobile Security Capabilities: Supports remote device management

OpenText Core Endpoint Protection finds application in industries requiring stringent data protection and peace of mind over device security. Managed-service providers implement this for comprehensive antivirus and firewall features, safeguarding multi-device networks. It is particularly useful for DNS protection and integrating with Active Directory policies, enabling secure yet flexible operations across sectors.

OpenText

Sample Customers

CBI Health Group, University Honda, VakifBank

Petrofrac, Metro CSG, Christus Health

Mytech Partners

Microsoft Defender for Endpoint vs. OpenText Core Endpoint Protection