Try our new research platform with insights from 80,000+ expert users

Microsoft Defender XDR vs Open EDR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender XDR
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
102
Ranking in other categories
Extended Detection and Response (XDR) (2nd), Microsoft Security Suite (4th)
Open EDR
Ranking in Endpoint Detection and Response (EDR)
37th
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of Microsoft Defender XDR is 2.9%, down from 3.7% compared to the previous year. The mindshare of Open EDR is 1.0%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender XDR2.9%
Open EDR1.0%
Other96.1%
Endpoint Detection and Response (EDR)
 

Featured Reviews

MohtesanShaikh - PeerSpot reviewer
Experience improves security management and simplifies threat protection
I have created automated investigations, and while they work, they operate rather slowly in the Microsoft portal. If I automate something, it takes considerable time; if I do it manually, I can complete it in a quarter of the time. The automation response being slow is the main concern; when an incident occurs or if I run a remediation, it takes significant time to complete the remediation. There are some limitations regarding the scalability of Microsoft Defender XDR with specific licensing. For SMB customers, there is only Microsoft Defender for Business, and if they want more features such as XDR features and automation investigation or incident response, they need to purchase Defender for Endpoint. We are currently using the EDR.
Timothy Muriithi - PeerSpot reviewer
I also like the ability to remotely manage update packages on your systems, and the fact that there is an open source version
Setting OpenEDR was challenging at first, but I got it done by following their documentation and online videos. You need to install the client and configure it to work with their online open platform. Next, you have to configure it on the device if it's a phone. You input a cloud link to the EDR, so you can monitor it from the cloud. There isn't any maintenance aside from updating the client. It's mostly on the cloud.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"There is also one dashboard that shows us the status of many controls at once and the details I can get... It gives a great overview of many areas, such as files, emails, chats, and links. Even with the apps, it gives you a great overview. In one place you can see where you should look into things more deeply..."
"For technical support, I would definitely give a rating of nine out of ten."
"The most valuable features of Microsoft 365 Defender are the combination of all the capabilities and centralized management."
"All of the security components are valuable including, antiphishing, antispam, and stage three antivirus."
"It has great stability."
"Microsoft Defender XDR has significantly improved our operational security."
"Another noteworthy feature that I find appealing in Microsoft Defender is the credit-backed simulation. This feature enables organizations to train their users on effectively responding to phishing emails through a simulated training environment."
"The stability has been great."
"Comodo includes a firewall and antivirus in one solution. I also like the ability to remotely manage update packages on your systems. Comodo can even find a lost device and secure it remotely."
 

Cons

"Microsoft tends to provide too many features, which makes the solution prone to bugs."
"Because of the training model, Defender XDR's automatic response sometimes blocks legitimate users and activities. Also, the UI sometimes responds slowly."
"I personally have not seen much evidence of how Defender can enhance the story of zero trust for enterprises."
"There are still some components, such as vulnerability management within the vendor product, where improved integration would be beneficial."
"Microsoft could improve on threat hunting and build more on threat detection and handling. The cybersecurity and cloud security posture features are a bit lesser than standard security products."
"There should be better information for experts on features in the solution. What I see when reading about features in Microsoft 365 Defender is that it is always general information. If Microsoft could go deeper into details for the experts about how to use the tools, usage of it would be more familiar and it would be easier to use."
"The price could be better. It'll also help if they can continuously update and upgrade the solution. Every day there's a new virus uploaded into the network, and we have to keep updating it to identify all these things."
"I do think that maybe having a feature within my organization where there are three different domains within which we have to operate would be helpful, as there is currently no unified view within the domains."
"Comodo includes a firewall and antivirus in one solution. I also like the ability to remotely manage update packages on your systems. Comodo can even find a lost device and secure it remotely."
 

Pricing and Cost Advice

"While the standalone price of Defender XDR might seem high, its value becomes clear when considering the ease of implementation and smooth integration with our existing Microsoft infrastructure, especially when bundled with other Microsoft products."
"Defender XDR is included in the E5 license, but it's a bit too expensive."
"Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
"The price of the solution is high compared to others and we have lost some customers because of it."
"On average, we pay around 55 euros per user for the services and features we receive."
"Microsoft Defender XDR is priced high."
"There are no issues with pricing, but sometimes, the clarity in licensing is a concern."
"We've managed to navigate it effectively through our enterprise agreement, and Microsoft's academic discounts have proven to be quite generous."
Information not available
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
868,787 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
8%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
18%
Retailer
9%
Comms Service Provider
9%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise23
Large Enterprise37
No data available
 

Questions from the Community

What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise.
What is your experience regarding pricing and costs for Microsoft 365 Defender?
The pricing for Microsoft Sentinel operates on a pay-as-you-go model based on data ingestion. I recall that Defender XDR pricing is based on the number of endpoints.
What needs improvement with Microsoft 365 Defender?
I have created automated investigations, and while they work, they operate rather slowly in the Microsoft portal. If I automate something, it takes considerable time; if I do it manually, I can com...
Ask a question
Earn 20 points
 

Also Known As

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
No data available
 

Overview

 

Sample Customers

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Information Not Available
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
868,787 professionals have used our research since 2012.