Sangfor Endpoint Secure vs Trellix Endpoint Security Platform comparison

Why PeerSpot?

Sangfor and Trellix are both solutions in the Endpoint Detection and Response (EDR) category. Sangfor is ranked #30 with an average rating of 9.0, while Trellix is ranked #8 with an average rating of 7.9. Sangfor holds a 0.8% mindshare in EDR, compared to Trellix’s 2.9% mindshare. Additionally, 100% of Sangfor users are willing to recommend the solution, compared to 88% of Trellix users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 22, 2026

Trellix Endpoint Security Platform and Sangfor Endpoint Secure compete in the endpoint security category. Trellix has the upper hand due to its advanced integration capabilities and threat prevention features, making it better suited for organizations prioritizing robust security.

Features: Trellix Endpoint Security Platform offers advanced threat prevention, machine learning algorithms for predictive analysis, and a comprehensive integration suite with SIEM and SOAR solutions, enhancing threat detection capabilities. Additionally, it provides customizable dashboards for data-driven decision-making and comprehensive data loss prevention features, benefiting encryption and DLP. Sangfor Endpoint Secure is known for its ease of use, offering comprehensive end-to-end protection and beneficial AI-based detection features. It incorporates behavior analysis and dynamic detection to strengthen cybersecurity measures and integrates with next-generation firewalls for added protection.

Room for Improvement: Trellix Endpoint Security Platform could benefit from better scalability solutions, streamlined automation processes, and faster support response times. Users have noted that it can be resource-intensive. Sangfor Endpoint Secure can enhance its VPN security, improve cloud migration support, and simplify its user interface to make navigation easier for users with basic technical knowledge.

Ease of Deployment and Customer Service: Trellix Endpoint Security Platform supports hybrid and public cloud deployments, providing flexibility for different organizational needs, but has variable technical support with some reported delays. Sangfor Endpoint Secure focuses on on-premises deployment with straightforward support responses, although it also experiences challenges in response times. Trellix generally offers more deployment versatility.

Pricing and ROI: Trellix Endpoint Security Platform is competitively priced for enterprises, delivering cost-effectiveness in large-scale deployments and substantial ROI for organizations focusing on security. Sangfor Endpoint Secure provides a cost-effective solution, particularly appealing to small and medium-sized businesses due to its competitive pricing, reflecting organizational priorities related to budget constraints.

To learn more, read our detailed Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform Report (Updated: September 2026).

Buyer's Guide

Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

September 2026

Download the complete report

Helped 913,806 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of September 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.6%, down from 3.9% compared to the previous year. The mindshare of Sangfor Endpoint Secure is 0.8%, up from 0.7% compared to the previous year. The mindshare of Trellix Endpoint Security Platform is 2.9%, down from 4.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.6%
Trellix Endpoint Security Platform	2.9%
Sangfor Endpoint Secure	0.8%
Other	92.7%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Ovais Abbas

Coordinator Associate at National Institute of Cardiovascular Diseases

Quick threat response and behavior analysis while enhancing network security

The main use case is usually related to security. It deals with attacks that come day-to-day such as zero-day attacks and APT attacks. Our main task is to secure the network infrastructure in the hospital where I work It facilitates the departments of IT and other departments to procure and…

Read full review

AmitKumar22

Product Manager at Frontier Business systems

Strong endpoint protection has simplified compliance and reduced effort for large user environments

One of the best features of Trellix Endpoint Security Platform is its endpoint security, and I have been using it for the last four and a half to five years, so I can say this is one of the best EDR endpoint security solutions I have ever seen. The features that make Trellix Endpoint Security Platform stand out for me are ease of use and analytics, which I really appreciate the most. Trellix Endpoint Security Platform positively impacts my organization, ensuring we are compliant with SOC 2, HIPAA, and all other compliance requirements, so there are no issues with that.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The protection offered by this product is good, as is the endpoint reporting."

"This software helps us understand any issues that may arise when someone is not at work."

"We've had a significant increase in blocking with a decrease in false positives, because it's looking at how the files work, not just a list of files that it's been told to look for."

"From the Palo Alto side, whatever they buy, they integrate that really well into their integration suite, and that makes a massive difference."

"I can highlight that we have not faced any security incidents with Cortex XDR by Palo Alto Networks, and even though our environment is quite dynamic, we have not faced any security incident with Cortex XDR by Palo Alto Networks until now."

"The normal protection was really effective, and we detected situations that if we didn't have Cortex XDR by Palo Alto Networks, it's highly likely that we would have been affected, but it protected the infrastructure."

"The tool is designed to scale for large enterprises and handle large volumes of data."

"The interface is easy to use and it is more up to date than our previous solution."

More Cortex XDR by Palo Alto Networks pros

"It has a quick response time, threat intelligence, cybersecurity features, quick report generation, behavior analysis, dynamic detection, and quarantine features."

"The tool's AI feature is helpful in endpoint security."

"The real-time monitoring feature of Sangfor Endpoint Secure is truly real-time, with no delay compared to other solutions."

"We use the product for network protection from any malicious threat."

"The user-friendliness of Sangfor Endpoint Secure is particularly impressive. Even with basic technical knowledge, users can easily navigate the system, make changes, and implement updates."

"The product's initial setup phase was straightforward."

"The tool's most valuable features are control access, endpoint security, and load balancing of ISPs."

"The most valuable feature I have found in the system is its comprehensive end-to-end protection."

More Sangfor Endpoint Secure pros

"The initial setup of Trellix Endpoint Security was straightforward."

"MVISION Endpoint is so much easier and so much simpler for the lay security personnel to handle."

"Trellix Endpoint Security's dashboard is very flexible, and I can create my own user-specific dashboard depending on user privilege or preference."

"The endpoint protection and disk encryption features are the most valuable."

"We really like the dashboard from Trellix and we've found that it's pretty informative."

"I think that in the enterprise space, this is by far the best solution and not because the actual antivirus."

"You can integrate this endpoint protection with a specific business process that you may want to link to the process of the antivirus."

"A great console with a user-friendly GUI."

More Trellix Endpoint Security Platform pros

Cons

"I would like to see them include NDR (Network Detection Response). Then it would work well with SIEM Response."

"We would also like to have advanced tech protection and email scanning."

"In reporting they should have a customizable dashboard due to the fact that C-level people don't like reporting to the IT department. They prefer to have a real-time dashboard. That kind of dashboard needs to have various customizations."

"The solution needs better reports. I think they should let the customer go in and customize the reports."

"The dashboard could use some significant improvement, just making it more useful with more information. It has a limited amount of information right now. It is customizable, but I'd love to see a better out-of-box dashboard."

"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."

"Fine-tuning the detection policy requires experience because the policy is very complex in Cortex XDR by Palo Alto Networks, and we get high false positive alerts."

"I would like to see some additional features related to email protection included."

More Cortex XDR by Palo Alto Networks cons

"The interface has too many buttons, making it cluttered."

"Sometimes, the VPN is not secure and doesn't work properly in Sangfor Endpoint Secure."

"It is complicated to establish a tunnel due to technical issues in the VPN system."

"I believe Sangfor Endpoint Secure could improve in terms of its user interface and management capabilities."

"Sangfor Endpoint Secure performs poorly."

"I face issues while migrating from Kaspersky to Sangfor Endpoint Secure."

"When an issue occurs, the response time for first-level support and the time taken for meetings could be improved."

"Sangfor Endpoint Secure should include healing capabilities."

More Sangfor Endpoint Secure cons

"The solution currently lacks mobile device management."

"The way that signatures work when using this solution could be improved. They could be more user friendly. We would like the ability to select a client's signature from a menu or file share to save time."

"The solution could use better updates and fewer bugs."

"There are certain shortcomings in the features concerning DLP in Trellix, where certain additions must be made in the future."

"What could be better is the performance impact on some machines and the complexity of configuration."

"They could provide better integration capabilities for the product with other services."

"The solution takes up a high amount of memory and can cause the system to hang."

"They can make it free, but that's not going to happen."

More Trellix Endpoint Security Platform cons

Pricing and Cost Advice

"The price of the product is not very economical."

"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."

"The cost depends on your chosen license type, like Pro or other licenses."

"Very costly product."

"The pricing is a little high. It is per user per year."

"Our customers have expressed that the price is high."

"The solution is expensive. It's pricing is on a yearly-basis."

"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"Sangfor Endpoint Secure's pricing is cheap. I rate it seven out of ten."

"The product is expensive compared to other vendors."

"Its "pay as you grow" model offers cost-effectiveness compared to major cloud providers."

"The solution is cheap. It is cheaper than other products by 15-20 percent."

"Price-wise, Sangfor Endpoint Secure can be considered a competitively priced product in the market as it offers quite low prices compared to other solutions."

"Sangfor Endpoint Secure is not a cheap solution."

"We were using Hyper-V. So, we switched to Sangfor because of the pricing."

"They should reduce the cost or make it free, open-source software."

"It provides good value by striking a balance between cost-effectiveness and feature richness."

"Licensing fees are paid yearly."

"The price of the product is similar to the ones in the market that offer the same features."

"Pricing is reasonable and runs at a cost per user per year."

"Trellix Endpoint Security is neither a cheap nor an expensive solution."

"When comparing the solution to others it is a bit expensive. We are on a monthly license."

"The price of the solution is fair, we have a complete security package."

More Trellix Endpoint Security Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

913,806 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Outsourcing Company

12%

Comms Service Provider

12%

Construction Company

11%

Financial Services Firm

17%

Comms Service Provider

11%

Media Company

Outsourcing Company

14%

Financial Services Firm

Manufacturing Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	47
Midsize Enterprise	21
Large Enterprise	55

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	3
Large Enterprise	3

By reviewers
Company Size	Count
Small Business	68
Midsize Enterprise	39
Large Enterprise	67

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

What needs improvement with Sangfor Endpoint Secure?

The interface has too many buttons, making it cluttered. It would be better if it were a simplified version with fewe...

See all answers

What is your primary use case for Sangfor Endpoint Secure?

Sangfor Endpoint Secure is easy to handle with its user-friendly interface. The four engines it utilizes for endpoint...

See all answers

What advice do you have for others considering Sangfor Endpoint Secure?

At first, people might not understand the interface, which is why it should be simplified. However, once they underst...

See all answers

How does McAfee Endpoint Security compare with MVISION?

The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deplo...

See all answers

How does Crowdstrike Falcon compare with FireEye Endpoint Security?

The Crowdstrike Falcon program has a simple to use user interface, making it both an easy to use as well as an effec...

See all answers

What is your experience regarding pricing and costs for McAfee Endpoint Security?

I don't have visibility on pricing because it is negotiated by a different team, as I look after the technical side.

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 14% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

TrendAI Vision One vs Cortex XDR by Palo Alto Networks

Compared 2% of the time

More Cortex XDR by Palo Alto Networks Competitors

CrowdStrike Falcon vs Sangfor Endpoint Secure

Compared 10% of the time

Kaspersky Next XDR Expert vs Sangfor Endpoint Secure

Compared 8% of the time

TrendAI Vision One vs Sangfor Endpoint Secure

Compared 4% of the time

SentinelOne Singularity Endpoint vs Sangfor Endpoint Secure

Compared 3% of the time

Bitdefender GravityZone EDR vs Sangfor Endpoint Secure

Compared 3% of the time

More Sangfor Endpoint Secure Competitors

SentinelOne Singularity Endpoint vs Trellix Endpoint Security Platform

Compared 6% of the time

CrowdStrike Falcon vs Trellix Endpoint Security Platform

Compared 5% of the time

Symantec Endpoint Security vs Trellix Endpoint Security Platform

Compared 4% of the time

Microsoft Defender for Endpoint vs Trellix Endpoint Security Platform

Compared 3% of the time

HP Wolf Security vs Trellix Endpoint Security Platform

Compared 3% of the time

More Trellix Endpoint Security Platform Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

September 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Sangfor Endpoint Secure

August 2026

Download Sangfor Endpoint Secure product report

Buyer's Guide

Trellix Endpoint Security Platform

August 2026

Trellix Endpoint Security Platform report

Download Trellix Endpoint Security Platform product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

No data available

McAfee Endpoint Security, McAfee Endpoint Protection, Intel Security Total Protection for Endpoint, McAfee Complete Endpoint Protection, Trellix Endpoint Security (ENS)

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Organizations use Sangfor Endpoint Secure for endpoint protection and security management, managing devices, servers, and networks against malicious threats. It also assists in blocking websites, managing infrastructure, applications, antivirus needs, and aids in migrating to cloud environments.

Sangfor Endpoint Secure offers end-to-end protection, incorporating file protection, AI detection, behavior analysis, access control, and ISP load balancing. It facilitates VM migration with minimal downtime and includes a dual-end user interface for creating firewall rules, uploading images, and configuring VM settings. Enhancements such as Hyper-V capabilities, policy certificates, honeypot features, and next-generation firewall integrations are available. However, Sangfor Endpoint Secure could improve on console management, reporting functionalities, public cloud migration support, navigation, VPN system issues, licensing, update management, transitioning processes, and incorporating healing capabilities.

What are its most important features?

Comprehensive end-to-end protection including file protection
AI detection and behavior analysis
Access control and ISP load balancing
Ease of VM migration with minimal downtime
Streamlined dual-end user interface for firewall rules and VM settings
Hyper-V capabilities and policy certificates
Honeypot feature for attack detection and RDP protection
Integration with next-generation firewalls

What benefits or ROI should users look for?

Enhanced device, server, and network security from malicious threats
Simplified migration from on-premises to cloud environments
User-friendly navigation and management capabilities
Advanced detection and behavior analysis reducing potential threats
Streamlined enforcement of robust security policies

Sangfor Endpoint Secure is implemented across various industries to ensure comprehensive security management and protection. IT departments leverage its VM migration capabilities for seamless transitions to cloud environments. Healthcare organizations use it to secure sensitive patient data, while educational institutions utilize it for safeguarding academic records and personal information. Financial services employ it to protect critical transactional data and adhere to stringent compliance requirements.

Sangfor

Trellix Endpoint Security Platform offers essential features like centralized management, threat prevention, and encryption, facilitating seamless scaling and integration with other systems while prioritizing user security.

This comprehensive platform focuses on endpoint protection, antivirus capabilities, and malware defense. It enhances cybersecurity with data loss prevention, advanced threat detection, and AI-driven features for reliable protection without impacting performance. Central management and advanced reporting streamline integration and ease of use. Flexible policy deployment through the management console and its robust security measures, such as DLP and device control, further increase protection. Challenges include high CPU and memory usage affecting performance, a complex interface, and lengthy deployment. Third-party integration and Windows Hello support need improvement. Additional concerns involve improved threat detection and faster technical support responses.

What are the key features of Trellix Endpoint Security Platform?

Centralized Management: Allows seamless integration and scaling with consistent control across environments.
Threat Prevention: Provides comprehensive antivirus and malware protection to secure systems.
Encryption: Ensures data security with robust encryption techniques.
Advanced Reporting: Facilitates detailed insights and analysis for better decision-making.
AI-Driven Detection: Offers reliable threat detection without impacting system performance.

What benefits should users look for in reviews?

Comprehensive Protection: Offers extensive security measures for protecting digital environments.
Ease of Integration: Simplifies the process of incorporating into current systems and processes.
Flexible Policy Deployment: Supports adaptable policy management to meet diverse requirements.
Scalability: Enables growth while maintaining efficiency and security.
Robust Security Features: Provides advanced security measures like DLP and device control.

Trellix Endpoint Security Platform is widely implemented in industries such as banking and government for securing mobile and desktop devices. Its capabilities cover network security, device control, and remote access protection, catering to diverse environments by offering robust cybersecurity management against advanced threats.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Information Not Available

inHouseIT, Seagate Technology

Buyer's Guide

Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

September 2026

Free Report: Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

Find out what your peers are saying about Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform and other solutions. Updated: September 2026.

DOWNLOAD NOW

913,806 professionals have used our research since 2012.

See our Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform report.

See our list of best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.