Sangfor Endpoint Secure vs Trellix Endpoint Security Platform comparison

Why PeerSpot?

Sangfor and Trellix are both solutions in the Endpoint Detection and Response (EDR) category. Sangfor is ranked #54, while Trellix is ranked #7 with an average rating of 8.0. Sangfor holds a 0.9% mindshare in EDR, compared to Trellix’s 2.9% mindshare. Additionally, 100% of Sangfor users are willing to recommend the solution, compared to 88% of Trellix users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 22, 2026

Trellix Endpoint Security Platform and Sangfor Endpoint Secure compete in the endpoint security category. Trellix has the upper hand due to its advanced integration capabilities and threat prevention features, making it better suited for organizations prioritizing robust security.

Features: Trellix Endpoint Security Platform offers advanced threat prevention, machine learning algorithms for predictive analysis, and a comprehensive integration suite with SIEM and SOAR solutions, enhancing threat detection capabilities. Additionally, it provides customizable dashboards for data-driven decision-making and comprehensive data loss prevention features, benefiting encryption and DLP. Sangfor Endpoint Secure is known for its ease of use, offering comprehensive end-to-end protection and beneficial AI-based detection features. It incorporates behavior analysis and dynamic detection to strengthen cybersecurity measures and integrates with next-generation firewalls for added protection.

Room for Improvement: Trellix Endpoint Security Platform could benefit from better scalability solutions, streamlined automation processes, and faster support response times. Users have noted that it can be resource-intensive. Sangfor Endpoint Secure can enhance its VPN security, improve cloud migration support, and simplify its user interface to make navigation easier for users with basic technical knowledge.

Ease of Deployment and Customer Service: Trellix Endpoint Security Platform supports hybrid and public cloud deployments, providing flexibility for different organizational needs, but has variable technical support with some reported delays. Sangfor Endpoint Secure focuses on on-premises deployment with straightforward support responses, although it also experiences challenges in response times. Trellix generally offers more deployment versatility.

Pricing and ROI: Trellix Endpoint Security Platform is competitively priced for enterprises, delivering cost-effectiveness in large-scale deployments and substantial ROI for organizations focusing on security. Sangfor Endpoint Secure provides a cost-effective solution, particularly appealing to small and medium-sized businesses due to its competitive pricing, reflecting organizational priorities related to budget constraints.

To learn more, read our detailed Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform Report (Updated: September 2026).

Buyer's Guide

Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

September 2026

Download the complete report

Helped 920,769 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of Sangfor Endpoint Secure is 0.9%, up from 0.7% compared to the previous year. The mindshare of Trellix Endpoint Security Platform is 2.9%, down from 4.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.8%
Trellix Endpoint Security Platform	2.9%
Sangfor Endpoint Secure	0.9%
Other	92.4%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

Hasan Dawood

Cloud Engineer at REDtone Digital Services

Robust security with features like antivirus protection and centralized management, but it may have limitations in supporting migrations from public clouds

While it excels in migrating VMs from on-premises and local infrastructure, it does not provide support for public cloud migrations. Attempting to migrate from public clouds like AWS encountered challenges, and Sangfor's support team clarified that they don't offer assistance for migrations from public cloud environments. It would be much more convenient if the migration tool could be installed directly on the customer's VMs, enabling a smoother migration process to the new infrastructure, with potential restrictions addressed accordingly.

Read full review

AmitKumar22

Product Manager at Frontier Business systems

Strong endpoint protection has simplified compliance and reduced effort for large user environments

One of the best features of Trellix Endpoint Security Platform is its endpoint security, and I have been using it for the last four and a half to five years, so I can say this is one of the best EDR endpoint security solutions I have ever seen. The features that make Trellix Endpoint Security Platform stand out for me are ease of use and analytics, which I really appreciate the most. Trellix Endpoint Security Platform positively impacts my organization, ensuring we are compliant with SOC 2, HIPAA, and all other compliance requirements, so there are no issues with that.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices."

"My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one."

"I like that the product has behavior-based detection which offers many benefits over signature-based detection."

"If you are looking to deploy a security solution as a whole, this is a good option."

"I have found the solution to be very easy in respect of the integration and configurable."

"After deploying Traps, we saw the performance of the network improve by 65 to 70 percent."

"We have found in our test Cortex XDR by Palo Alto Networks to be a very good tool."

"The tool is easy to use."

More Cortex XDR by Palo Alto Networks pros

"The product's initial setup phase was straightforward."

"The tool's AI feature is helpful in endpoint security."

"What stands out to me is the dual-end user interface they provide."

"The most valuable feature I have found in the system is its comprehensive end-to-end protection."

"It has a quick response time, threat intelligence, cybersecurity features, quick report generation, behavior analysis, dynamic detection, and quarantine features."

"I like the tool's honeypot feature. Some features include having a honeypot to detect attacks in a certain area. Additionally, there is RDP protection, which means that when we remote into our server or any endpoint, we must enter a password as a second layer of security. It can also integrate with next-generation firewalls."

"We use the product for network protection from any malicious threat."

"Sangfor Endpoint Secure has some good policy certificates."

More Sangfor Endpoint Secure pros

"There are many other endpoint security solutions that are available today, but McAfee Suite has several distinct advantages when you make a procurement decision."

"Tech support is responsive. They're good, the very best."

"The most valuable feature is the integration between environments."

"The solution is stable."

"We use McAfee MVISION Endpoint to protect our environment."

"Leaving aside the fact that I sell this solution, when it comes to endpoint security solutions the world over, McAfee is one of the best, if not the best."

"It is a great solution overall."

"The solution is good and we always recommend."

More Trellix Endpoint Security Platform pros

Cons

"The configuration could be simplified. I would like to see better protection, specifically to protect email applications."

"It would be good if they could make an exception for applications. Sometimes, it can be a bit of a challenge to make exceptions for certain applications that have been used as rogue."

"I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent."

"For Cortex XDR by Palo Alto Networks, if I had to point out improvements, I would say the UI is still somewhat difficult for beginners."

"Every 30 or 40 days, there's a new version and we need to go and make sure our customer's laptops are upgraded."

"Dashboards do not allow everyone to see what's happening."

"If he is using a smaller company, he can depend on some other tools because Cortex XDR by Palo Alto Networks is a bit expensive."

"It is not a suitable solution if you are looking for a single product with multiple features such as DLP, encryption, rollback, etc."

More Cortex XDR by Palo Alto Networks cons

"I believe Sangfor Endpoint Secure could improve in terms of its user interface and management capabilities."

"I face issues while migrating from Kaspersky to Sangfor Endpoint Secure."

"Currently, the tool lacks reporting functionalities."

"Sometimes, the VPN is not secure and doesn't work properly in Sangfor Endpoint Secure."

"Sangfor Endpoint Secure should include healing capabilities."

"It would be much more convenient if the migration tool could be installed directly on the customer's VMs, enabling a smoother migration process to the new infrastructure, with potential restrictions addressed accordingly."

"Sangfor Endpoint Secure performs poorly."

"There are a few areas for improvement. We have encountered licensing issues on occasion, and sometimes updates don't apply properly."

More Sangfor Endpoint Secure cons

"I would like this solution to do what Palo Alto traps does because I would only need to run this one product."

"The integration and display of the dashboards have to be done better."

"The solution consumes a lot of end user memory and CPU, so you need to have a computer that has a lot of resources for you to properly run Trellix."

"The main area for improvement is the integration with Microsoft Windows Hello, which includes Face ID or fingerprint-based authentication. Currently, they don't support either, so users have to type in the username and password."

"The email protection isn't efficient enough, and I'd like to see DLP features in the next release."

"It would be a lot easier if I could add multiple user accounts within a single device."

"One thing I could have used was a more detailed description of the HIPS signatures."

"With McAfee, if there is a zero-day vulnerability, you have to download the patch for it from the McAfee website, then apply it to your endpoint."

More Trellix Endpoint Security Platform cons

Pricing and Cost Advice

"The return on investment is from the user side because we have seen the performance of it increase the delivery time of the product if we are using too many web-based and on-premise applications. In indirect ways, we saw the return of investment in terms of performance and user satisfaction increase."

"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."

"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."

"I don't like that they have different types of licenses."

"The price of the product is not very economical."

"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."

"The price was fine."

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"The solution is cheap. It is cheaper than other products by 15-20 percent."

"Sangfor Endpoint Secure is not a cheap solution."

"We were using Hyper-V. So, we switched to Sangfor because of the pricing."

"The product is expensive compared to other vendors."

"Its "pay as you grow" model offers cost-effectiveness compared to major cloud providers."

"Sangfor Endpoint Secure's pricing is cheap. I rate it seven out of ten."

"Price-wise, Sangfor Endpoint Secure can be considered a competitively priced product in the market as it offers quite low prices compared to other solutions."

"Licensing fees are paid yearly."

"Trellix may cost around $46 to $47 for a single license without an EDR."

"Annual license fee is good"

"Since the maintenance is done by our own team, the price of the subscription should really be cheaper."

"Trellix Endpoint Security is neither a cheap nor an expensive solution."

"I do licensing on an annual basis and this is what I always recommend to my clients over the monthly option."

"It is a yearly subscription-based product, which includes the license and hardware. There is also a subscription for technical support up to five years."

"The price of the product is similar to the ones in the market that offer the same features."

More Trellix Endpoint Security Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

920,769 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Comms Service Provider

14%

Outsourcing Company

12%

Construction Company

10%

Manufacturing Company

10%

Financial Services Firm

15%

Comms Service Provider

14%

Media Company

Outsourcing Company

14%

Manufacturing Company

10%

Financial Services Firm

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	50
Midsize Enterprise	21
Large Enterprise	57

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	3
Large Enterprise	3

By reviewers
Company Size	Count
Small Business	68
Midsize Enterprise	39
Large Enterprise	67

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

Ask a question

Earn 20 points

How does McAfee Endpoint Security compare with MVISION?

The flexible manageability of McAfee Endpoint Security is one of our favorite aspects of this solution. You can deplo...

See all answers

How does Crowdstrike Falcon compare with FireEye Endpoint Security?

The Crowdstrike Falcon program has a simple to use user interface, making it both an easy to use as well as an effec...

See all answers

What is your experience regarding pricing and costs for McAfee Endpoint Security?

I don't have visibility on pricing because it is negotiated by a different team, as I look after the technical side.

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 16% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 5% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

TrendAI Vision One vs Cortex XDR by Palo Alto Networks

Compared 2% of the time

More Cortex XDR by Palo Alto Networks Competitors

CrowdStrike Falcon vs Sangfor Endpoint Secure

Compared 11% of the time

Kaspersky Next XDR Expert vs Sangfor Endpoint Secure

Compared 8% of the time

SentinelOne Singularity Endpoint vs Sangfor Endpoint Secure

Compared 4% of the time

TrendAI Vision One vs Sangfor Endpoint Secure

Compared 4% of the time

WatchGuard EPDR vs Sangfor Endpoint Secure

Compared 2% of the time

More Sangfor Endpoint Secure Competitors

SentinelOne Singularity Endpoint vs Trellix Endpoint Security Platform

Compared 6% of the time

CrowdStrike Falcon vs Trellix Endpoint Security Platform

Compared 5% of the time

Symantec Endpoint Security vs Trellix Endpoint Security Platform

Compared 4% of the time

HP Wolf Security vs Trellix Endpoint Security Platform

Compared 3% of the time

Microsoft Defender for Endpoint vs Trellix Endpoint Security Platform

Compared 3% of the time

More Trellix Endpoint Security Platform Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

October 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Sangfor Endpoint Secure

October 2026

Download Sangfor Endpoint Secure product report

Buyer's Guide

Trellix Endpoint Security Platform

October 2026

Trellix Endpoint Security Platform report

Download Trellix Endpoint Security Platform product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

No data available

McAfee Endpoint Security, McAfee Endpoint Protection, Intel Security Total Protection for Endpoint, McAfee Complete Endpoint Protection, Trellix Endpoint Security (ENS)

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

Organizations use Sangfor Endpoint Secure for endpoint protection and security management, managing devices, servers, and networks against malicious threats. It also assists in blocking websites, managing infrastructure, applications, antivirus needs, and aids in migrating to cloud environments.

Sangfor Endpoint Secure offers end-to-end protection, incorporating file protection, AI detection, behavior analysis, access control, and ISP load balancing. It facilitates VM migration with minimal downtime and includes a dual-end user interface for creating firewall rules, uploading images, and configuring VM settings. Enhancements such as Hyper-V capabilities, policy certificates, honeypot features, and next-generation firewall integrations are available. However, Sangfor Endpoint Secure could improve on console management, reporting functionalities, public cloud migration support, navigation, VPN system issues, licensing, update management, transitioning processes, and incorporating healing capabilities.

What are its most important features?

Comprehensive end-to-end protection including file protection
AI detection and behavior analysis
Access control and ISP load balancing
Ease of VM migration with minimal downtime
Streamlined dual-end user interface for firewall rules and VM settings
Hyper-V capabilities and policy certificates
Honeypot feature for attack detection and RDP protection
Integration with next-generation firewalls

What benefits or ROI should users look for?

Enhanced device, server, and network security from malicious threats
Simplified migration from on-premises to cloud environments
User-friendly navigation and management capabilities
Advanced detection and behavior analysis reducing potential threats
Streamlined enforcement of robust security policies

Sangfor Endpoint Secure is implemented across various industries to ensure comprehensive security management and protection. IT departments leverage its VM migration capabilities for seamless transitions to cloud environments. Healthcare organizations use it to secure sensitive patient data, while educational institutions utilize it for safeguarding academic records and personal information. Financial services employ it to protect critical transactional data and adhere to stringent compliance requirements.

Sangfor

Trellix Endpoint Security Platform offers essential features like centralized management, threat prevention, and encryption, facilitating seamless scaling and integration with other systems while prioritizing user security.

This comprehensive platform focuses on endpoint protection, antivirus capabilities, and malware defense. It enhances cybersecurity with data loss prevention, advanced threat detection, and AI-driven features for reliable protection without impacting performance. Central management and advanced reporting streamline integration and ease of use. Flexible policy deployment through the management console and its robust security measures, such as DLP and device control, further increase protection. Challenges include high CPU and memory usage affecting performance, a complex interface, and lengthy deployment. Third-party integration and Windows Hello support need improvement. Additional concerns involve improved threat detection and faster technical support responses.

What are the key features of Trellix Endpoint Security Platform?

Centralized Management: Allows seamless integration and scaling with consistent control across environments.
Threat Prevention: Provides comprehensive antivirus and malware protection to secure systems.
Encryption: Ensures data security with robust encryption techniques.
Advanced Reporting: Facilitates detailed insights and analysis for better decision-making.
AI-Driven Detection: Offers reliable threat detection without impacting system performance.

What benefits should users look for in reviews?

Comprehensive Protection: Offers extensive security measures for protecting digital environments.
Ease of Integration: Simplifies the process of incorporating into current systems and processes.
Flexible Policy Deployment: Supports adaptable policy management to meet diverse requirements.
Scalability: Enables growth while maintaining efficiency and security.
Robust Security Features: Provides advanced security measures like DLP and device control.

Trellix Endpoint Security Platform is widely implemented in industries such as banking and government for securing mobile and desktop devices. Its capabilities cover network security, device control, and remote access protection, catering to diverse environments by offering robust cybersecurity management against advanced threats.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Information Not Available

inHouseIT, Seagate Technology

Buyer's Guide

Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

September 2026

Free Report: Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform

Find out what your peers are saying about Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform and other solutions. Updated: September 2026.

DOWNLOAD NOW

920,769 professionals have used our research since 2012.

See our Sangfor Endpoint Secure vs. Trellix Endpoint Security Platform report.

See our list of best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.