Endpoint protection
Asked as “endpoint protection platform”, and as “business antivirus and endpoint security tool”, on behalf of a mid-market B2B company. 59 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
22%
Contested · Bitdefender GravityZone 17%
22Microsoft Defender for Endpoint17Bitdefender GravityZone17Microsoft Defender for Cloud44others
22% of first choices, contested.
Since September 2026↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (23%) replaces Microsoft Defender for Cloud (22% then, 17% now), 6 points clear, inside the 11-point floor.Microsoft Defender for Endpoint leads at 23%, replacing Microsoft Defender for Cloud, which led at 22% and stands at 17% now: 6 points clear, inside the floor, so the swap reads as unsettled.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Microsoft Defender for Cloud50%Clear leader▼−4Since September 2026: 50% → 46%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-market
Microsoft Defender for Endpoint22%Contested↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (23%) replaces Microsoft Defender for Cloud (22% then, 17% now), 6 points clear, inside the 11-point floor.This pageEnterpriseMicrosoft Defender for Endpoint44%Clear leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →
Microsoft Defender for Cloud50%Clear leader▼−4Since September 2026: 50% → 46%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-marketMicrosoft Defender for Endpoint22%Contested↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (23%) replaces Microsoft Defender for Cloud (22% then, 17% now), 6 points clear, inside the 11-point floor.This pageEnterpriseMicrosoft Defender for Endpoint44%Clear leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Microsoft Defender for Endpoint22%5%40accepted challenger▲+5Since September 2026: 18% → 23%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.18% → 23%
Microsoft Defender for Endpoint22%5%40accepted challenger▲+5Since September 2026: 18% → 23%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.18% → 23%02
Bitdefender GravityZone17%3%34accepted challenger▼−1Since September 2026: 20% → 19%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.20% → 19%
Bitdefender GravityZone17%3%34accepted challenger▼−1Since September 2026: 20% → 19%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.20% → 19%03Microsoft Defender for Cloud17%8%12accepted challenger▼−5Since September 2026: 22% → 17%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 17%
Microsoft Defender for Cloud17%8%12accepted challenger▼−5Since September 2026: 22% → 17%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 17%04
CrowdStrike Falcon12%22%41accepted challenger▲+8Since September 2026: 4% → 12%, +8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 12%
CrowdStrike Falcon12%22%41accepted challenger▲+8Since September 2026: 4% → 12%, +8 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 12%05
Sophos Intercept X5%12%42accepted challenger▼−4Since September 2026: 8% → 4%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.8% → 4%
Sophos Intercept X5%12%42accepted challenger▼−4Since September 2026: 8% → 4%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.8% → 4%06
SentinelOne Singularity5%0%25accepted challenger▲+2Since September 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 6%
SentinelOne Singularity5%0%25accepted challenger▲+2Since September 2026: 4% → 6%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 6%07
SentinelOne Singularity Endpoint3%9%22accepted challenger▼−2Since September 2026: 6% → 4%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.6% → 4%
SentinelOne Singularity Endpoint3%9%22accepted challenger▼−2Since September 2026: 6% → 4%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.6% → 4%08
ESET PROTECT2%6%16accepted challenger▼−2Since September 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 2%
ESET PROTECT2%6%16accepted challenger▼−2Since September 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 2%Show the three products at 0%, ordered by negative rate
11
Trend Micro Apex One0%38%13criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Trend Micro Apex One0%38%13criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%09
Palo Alto Networks Cortex XDR0%0%20accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Palo Alto Networks Cortex XDR0%0%20accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%10
Huntress Managed EDR0%0%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Huntress Managed EDR0%0%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All twenty-eight head-to-head pages: the top eight products, each against each
Microsoft Defender for Endpoint vs Sophos Intercept XMicrosoft Defender for Endpoint vs SentinelOne SingularityMicrosoft Defender for Endpoint vs SentinelOne Singularity EndpointMicrosoft Defender for Endpoint vs ESET PROTECTBitdefender GravityZone vs Microsoft Defender for CloudBitdefender GravityZone vs CrowdStrike FalconBitdefender GravityZone vs Sophos Intercept XBitdefender GravityZone vs SentinelOne SingularityBitdefender GravityZone vs SentinelOne Singularity EndpointBitdefender GravityZone vs ESET PROTECTMicrosoft Defender for Cloud vs CrowdStrike FalconMicrosoft Defender for Cloud vs Sophos Intercept XMicrosoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs SentinelOne Singularity EndpointMicrosoft Defender for Cloud vs ESET PROTECTCrowdStrike Falcon vs Sophos Intercept XCrowdStrike Falcon vs SentinelOne SingularityCrowdStrike Falcon vs SentinelOne Singularity EndpointCrowdStrike Falcon vs ESET PROTECTSophos Intercept X vs SentinelOne SingularitySophos Intercept X vs SentinelOne Singularity EndpointSophos Intercept X vs ESET PROTECTSentinelOne Singularity vs SentinelOne Singularity EndpointSentinelOne Singularity vs ESET PROTECTSentinelOne Singularity Endpoint vs ESET PROTECT
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Microsoft Defender for Endpoint22%
Microsoft Defender for Endpoint22%02Bitdefender GravityZone17%
Bitdefender GravityZone17%03Microsoft Defender for Cloud17%
Microsoft Defender for Cloud17%04CrowdStrike Falcon12%
CrowdStrike Falcon12%05Sophos Intercept X5%
Sophos Intercept X5%06SentinelOne Singularity5%
SentinelOne Singularity5%07SentinelOne Singularity Endpoint3%
SentinelOne Singularity Endpoint3%08ESET PROTECT2%
ESET PROTECT2%09Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%10Huntress Managed EDR0%
Huntress Managed EDR0%11Trend Micro Apex One0%
Trend Micro Apex One0%What they warned about
Three of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Grok 4.1 Fast, Mistral Small, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike Falcon22%
9 of 41 labels negative · 9 of 14 models
“**CrowdStrike Falcon** (with significant caveats) ... It's still a strong product, but the outage demonstrated that relying on any single endpoint platform carries systemic risk.” DeepSeek V4 Flash, negative prompt
Kaspersky Endpoint Security88%
7 of 8 labels negative · 7 of 14 models · 5 hard negative
“Why to avoid: Because Kaspersky can no longer push threat signature and codebase updates to U.S. endpoints” Gemini 3.5 Flash, negative prompt
Trend Micro Apex One38%
5 of 13 labels negative · 5 of 14 models · 2 hard negative
“Cautious Avoid / Immediate Patch Required ... critical security vulnerabilities that should be immediate red flags” GLM 4.7 FlashX, negative prompt
Sophos Intercept X12%
5 of 42 labels negative · 5 of 14 models
“Some platforms like Sophos Endpoint have received complaints about slow performance on older systems and high resource usage affecting productivity” MiniMax M2.5, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
74 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1015 links across 224 sites, every framing counted. Ranked by the number of answers carrying the site or page. 1 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
34 answers · 39 citations · 11 models
vendor site · Guideflow30 answers · 31 citations · 11 models
vendor site · Huntress29 answers · 39 citations · 8 models
23 answers · 24 citations · 11 models
vendor site · Microsoft22 answers · 33 citations · 9 models
vendor site · SentinelOne21 answers · 39 citations · 11 models
vendor site · Iru21 answers · 21 citations · 9 models
20 answers · 25 citations · 9 models
vendor site · CrowdStrike19 answers · 32 citations · 9 models
vendor site · G215 answers · 29 citations · 8 models
15 answers · 18 citations · 10 models
vendor site · Venn15 answers · 15 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
32 answers · 11 models
29 answers · 11 models
21 answers · 9 models
20 answers · 10 models
15 answers · 9 models
13 answers · 7 models
13 answers · 8 models
12 answers · 7 models
12 answers · 6 models
11 answers · 6 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best endpoint protection platform”, “endpoint protection platform”, “endpoint protection platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender parent site Microsoft Defender for Endpoint 22%, Microsoft Defender for Business / Defender for Endpoint 3%, Microsoft Defender for Business / Endpoint 0% | 25% | 268 | 18,100 | 3,525 | ||||
| Microsoft Defender microsoft.com Microsoft Defender for Cloud 17%, Microsoft 2% | 19% | 569 | 2,240,000 | 403,136 | 145,358,109 company | $12,455 | 103 | |
| Bitdefender bitdefender.com Bitdefender GravityZone 17% | 17% | 99 | 90,500 | 3,261 | 649,861 company | 93 | ||
| CrowdStrike parent site CrowdStrike Falcon 12%, CrowdStrike Falcon Go 0% | 12% | 234 | 74,000 | 5,130 | ||||
| Sophos sophos.com Sophos Intercept X 5% | 5% | 252 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| SentinelOne sentinelone.com SentinelOne Singularity 5% | 5% | 534 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 2 |
| Bitdefender parent site Bitdefender GravityZone Business Security 3%, Bitdefender GravityZone Small Business Security 2% | 5% | 22 | 90,500 | 3,261 | ||||
| SentinelOne parent site SentinelOne Singularity Endpoint 3% | 3% | 67 | 33,100 | 1,675 | ||||
| ESET eset.com ESET PROTECT 2% | 2% | 81 | 18,100 | 1,812 | 637,959 company | $4,397 | 75 | 2 |
| CrowdStrike crowdstrike.com | 2% | 337 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | 5 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (crowdstrike.com, g2.com, sentinelone.com, venn.com). The first result for “best endpoint protection platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best endpoint protection platform for a mid-market B2B company?”Paraphrase“Which business antivirus and endpoint security tool would you recommend to a mid-sized B2B company?”Comparative“What are the top endpoint protection platforms and how do they differ?”Budget-constrained“What is the best endpoint protection platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating an endpoint protection platform. What should we look at?”Negative“Which endpoint protection platforms should I avoid or be cautious about?”
Claude Haiku 4.5Sophos Intercept Xagainst: CrowdStrike FalconBitdefender GravityZoneChangedCrowdStrike, SentinelOne Singularity EndpointMicrosoft Defender for Endpointagainst: ClamAVno first choiceagainst: Avast Business, Bitdefender GravityZone, Cybereason, Kaspersky Endpoint Security, Sophos Intercept X, ThreatDown
Three alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDRFour alternatives
CrowdStrike Falcon, ESET PROTECT, Microsoft Defender for Endpoint, Sophos Intercept XThree alternatives
Cynet, Huntress Managed EDR, Microsoft Defender for EndpointThree alternatives
Avast Business Antivirus, Bitdefender GravityZone Business Security, Kaspersky Endpoint SecurityGPT-5.4 miniCrowdStrike FalconMicrosoft Defender for CloudChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: FortiEDR, SentinelOne Singularity Endpoint, Sophos Intercept X
Three alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept XTwo alternatives
Bitdefender GravityZone, CrowdStrike FalconTwo alternatives
Bitdefender GravityZone, Microsoft 365Gemini 3.5 FlashSophos Intercept Xagainst: CrowdStrike Falcon CompleteMicrosoft Defender for Business / Defender for EndpointChangedCrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne SingularityMicrosoft Defender for Cloudagainst: SentinelOne Singularity EndpointSentinelOne Singularity Endpointagainst: Carbon Black, CrowdStrike Falcon, Datto EDR, Kaspersky Endpoint Security, Symantec Endpoint Security, Trellix Endpoint Security Suite, UltraAV
Three alternatives
Huntress Managed EDR, Microsoft Defender for Business / Defender for Endpoint, SentinelOne SingularityThree alternatives
CrowdStrike Falcon, Huntress Managed EDR, SentinelOne SingularityTwo alternatives
Palo Alto Networks Cortex XDR, Sophos Intercept XFive alternatives
Bitdefender GravityZone, CrowdStrike Falcon Go, Huntress Managed EDR, ThreatDown, WazuhThree alternatives
CrowdStrike, Microsoft Defender for Endpoint, Sophos Intercept XPerplexity SonarBitdefender GravityZoneBitdefender GravityZoneHeldCrowdStrike FalconMicrosoft Defender for Endpointno first choiceagainst: ESET PROTECT, McAfee Endpoint Security, Symantec Endpoint Protection, Trend Micro Apex One
Four alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XTwo alternatives
CrowdStrike, ESET PROTECTSix alternatives
Huntress Managed EDR, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, ThreatLocker Zero Trust PlatformThree alternatives
Bitdefender GravityZone SBS, ESET PROTECT, Trend Micro Worry-Free ServicesGrok 4.1 FastMicrosoft Defender for Endpointagainst: CrowdStrike FalconBitdefender GravityZoneChangedCrowdStrikeMicrosoft Defender for Cloudagainst: Microsoft DefenderCrowdStrike, Microsoft, SentinelOne Singularity Endpointagainst: Avast Business, Check Point Endpoint Security, CrowdStrike, Cybereason NGAV, HP (Wolfray Cyber Security) Wolf Pro Security, Kaspersky Endpoint Security, Malwarebytes, MicroWorld eScan Enterprise EDR, Sophos Intercept X, Symantec Endpoint Security, Trellix Endpoint Security Suite, Trend Micro Apex One
Three alternatives
Bitdefender GravityZone, SentinelOne Singularity, Sophos Intercept XFive alternatives
CrowdStrike Falcon Go, ESET PROTECT Endpoint, Microsoft Defender for Business / Endpoint, SentinelOne Singularity, Sophos Intercept XSix alternatives
Bitdefender GravityZone, Microsoft, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Micro Apex OneThree alternatives
Bitdefender GravityZone Business Security, Malwarebytes, Trend Micro Worry-Free ServicesTwo alternatives
Bitdefender GravityZone, Sophos Intercept XMistral SmallBitdefender GravityZone, CrowdStrike FalconMicrosoft Defender for EndpointChangedCrowdStrike Falcon, SentinelOne SingularityBitdefender GravityZone Small Business Security, Microsoft Defender for Endpointno first choiceagainst: Avast Business, Cisco Endpoint Security, Malwarebytes Endpoint Protection, Microsoft Defender for Endpoint, Trend Micro Apex One
One alternative
Acronis Cyber ProtectThree alternatives
Bitdefender GravityZone, ESET Endpoint Security, Sophos Intercept XFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept X, Symantec Endpoint SecurityThree alternatives
ESET PROTECT, Malwarebytes for Business, Norton Small BusinessDeepSeek V4 FlashSentinelOne SingularitySentinelOne SingularityHeldCrowdStrike FalconMicrosoft Defender for CloudCrowdStrike Falcon, Microsoft Defender for Endpointagainst: Acronis Cyber Protect, Avast Business, CrowdStrike Falcon, Cynet, FortiClient, Guardio, Sophos Intercept X, Symantec Endpoint Security
Four alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Business / Endpoint, Sophos Intercept XThree alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Business / EndpointSix alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneThree alternatives
CrowdStrike Falcon Go, Huntress Managed EDR, Sophos Intercept XThree alternatives
Bitdefender GravityZone, SentinelOne Singularity, Sophos Intercept XLlama 4 MaverickBitdefender GravityZoneBitdefender GravityZoneHeldno first choiceESET PROTECT, Malwarebytes for Business, Norton Small Businessno first choicenothing named
Qwen 3.7 FlashMicrosoft Defender for EndpointBitdefender GravityZone, Microsoft Defender for EndpointChangedCrowdStrike Falcon, SentinelOne Singularity EndpointMicrosoft Defender for Cloudno first choiceagainst: Cisco Secure Client, CrowdStrike Falcon, G DATA, Huawei, Kaspersky Endpoint Security, VIPRE Business Security, VMware Carbon Black
Four alternatives
CrowdStrike Falcon, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Vision OneOne alternative
SentinelOne Singularity EndpointTwo alternatives
Microsoft Defender for Endpoints, Sophos Intercept XTwo alternatives
CrowdStrike Falcon Go, Malwarebytes for BusinessFour alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity EndpointKimi K2Microsoft Defender for EndpointBitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for EndpointChangedCrowdStrike FalconMicrosoft Defender for Cloudagainst: Comodo OpenEDR, FreeEDRno first choiceagainst: CrowdStrike Falcon, Kaspersky Endpoint Security, Microsoft Defender for Endpoint
Three alternatives
Bitdefender GravityZone, CrowdStrike Falcon, SentinelOne SingularityOne alternative
SentinelOne SingularityFive alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept X, Symantec Endpoint Security, Trellix Endpoint Security SuiteTwo alternatives
CrowdStrike Falcon Go, Malwarebytes ThreatDownOne alternative
Defender for EndpointGLM 4.7 FlashXCrowdStrike FalconMicrosoft Defender for CloudChangedCrowdStrike Falconagainst: MalwarebytesMicrosoft Defender for Cloudno first choiceagainst: Check Point Endpoint Security, CrowdStrike Falcon, Kaspersky Endpoint Security, Trend Micro Apex One
Two alternatives
Microsoft Defender for Endpoint, Sophos Intercept XFive alternatives
Bitdefender GravityZone Business Security, CrowdStrike Falcon, ESET PROTECT, SentinelOne Singularity, Sophos Intercept XFive alternatives
Bitdefender GravityZone, Carbon Black, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XThree alternatives
ESET Small Office Protection, Huntress Managed EDR, Malwarebytes for BusinessMiniMax M2.5Bitdefender GravityZone, CrowdStrike FalconMicrosoft Defender for Endpoint, SentinelOne SingularityChangedagainst: CrowdStrike FalconCrowdStrike FalconBitdefender GravityZone Business Security, Microsoft Defender for Endpointno first choiceagainst: CrowdStrike, McAfee, Sophos Intercept X
Two alternatives
Microsoft Defender for Endpoint, Sophos Intercept XOne alternative
Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityTwo alternatives
Kaspersky Small Office Security, Sophos Intercept XGPT-6 LunaCrowdStrike Falconagainst: Microsoft Defender for CloudMicrosoft Defender for EndpointChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike Falcon, Kaspersky Endpoint Security
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityTwo alternatives
Microsoft Defender for Cloud, Sophos Endpoint with MDRSeven alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneTwo alternatives
Bitdefender GravityZone, Microsoft 365Muse Glimmer 30BBitdefender GravityZone Business Security, Microsoft Defender for Business / Defender for EndpointSophos Intercept XChangedCrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity EndpointMicrosoft Defender built-in / Defender for Businessno first choiceagainst: Check Point Endpoint Security, Ivanti Endpoint Manager, Trend Micro Apex One
Three alternatives
CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XFour alternatives
Bitdefender GravityZone, ESET PROTECT, Microsoft, SentinelOne Singularity EndpointOne alternative
Sophos Intercept XThree alternatives
CrowdStrike Falcon Go, Huntress Managed EDR, SentinelOne Singularity EndpointBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:01 | yes | 15 | 10 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:16 | yes | 3 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:45 | yes | 16 | 27 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 11:47 | yes | 20 | 2 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:08 | yes | 23 | 9 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:28 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:26 | yes | 24 | 33 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 07:39 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:13 | no | 0 | 32 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:49 | yes | 10 | 18 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 13:40 | yes | 23 | 62 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:51 | yes | 10 | 26 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 09:22 | yes | 3 | 14 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:01 | yes | 14 | 27 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:15 | yes | 9 | 7 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:41 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:24 | yes | 10 | 22 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 11:44 | yes | 23 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 11:57 | yes | 24 | 8 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:11 | yes | 5 | 4 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:45 | yes | 23 | 27 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:03 | yes | 5 | 1 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:35 | yes | 9 | 18 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:43 | yes | 10 | 26 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:47 | yes | 16 | 76 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:12 | yes | 5 | 31 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:28 | yes | 3 | 11 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:36 | yes | 13 | 26 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:19 | yes | 9 | 7 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:09 | yes | 6 | 12 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:16 | yes | 12 | 26 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 12:35 | yes | 19 | 9 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:55 | yes | 23 | 11 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:27 | yes | 9 | 16 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:35 | yes | 23 | 52 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:53 | yes | 5 | 1 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 10:37 | no | 0 | 37 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:27 | yes | 14 | 28 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:08 | yes | 23 | 34 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:07 | yes | 10 | 19 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:57 | yes | 8 | 23 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:58 | yes | 13 | 28 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:29 | no | 0 | 4 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 07:42 | yes | 2 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:33 | yes | 18 | 24 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 10:13 | yes | 19 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:48 | yes | 25 | 9 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:49 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:46 | yes | 14 | 16 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:40 | yes | 5 | 1 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 07:53 | yes | 15 | 56 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:58 | yes | 15 | 20 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:47 | yes | 25 | 31 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:10 | no | 0 | 44 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 07:58 | yes | 3 | 14 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:23 | yes | 15 | 26 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 12:45 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:25 | no | 0 | 6 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:03 | no | 0 | 17 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 08:38 | yes | 15 | 4 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:38 | yes | 20 | 8 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:36 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:11 | yes | 24 | 51 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:00 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:02 | no | 0 | 27 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:05 | yes | 14 | 20 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:38 | yes | 15 | 38 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:29 | yes | 5 | 10 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:40 | yes | 3 | 15 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 11:53 | no | 0 | 1 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:10 | yes | 18 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:03 | yes | 5 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:38 | yes | 31 | 30 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 09:44 | yes | 25 | 7 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:42 | yes | 23 | 8 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:06 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:56 | yes | 24 | 26 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:53 | yes | 5 | 1 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:23 | yes | 21 | 125 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:13 | yes | 25 | 33 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 13:09 | yes | 23 | 72 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:47 | yes | 21 | 30 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:34 | yes | 3 | 24 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:45 | yes | 20 | 35 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Avast Business Security read as Avast Business
Bitdefender read as Bitdefender GravityZone
Broadcom Symantec read as Symantec Endpoint Security
Broadcom Symantec Endpoint Security Complete read as Symantec Endpoint Security
Check Point read as Check Point Harmony Endpoint
ESET read as ESET PROTECT
Huntress read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Security
Palo Alto read as Palo Alto Networks Cortex XDR
Palo Alto Networks read as Palo Alto Networks Cortex XDR
Palo Alto Networks (Cortex XDR) read as Palo Alto Networks Cortex XDR
Palo Alto Networks (Prisma Access) read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity Endpoint
SentinelOne (Singularity) read as SentinelOne Singularity Endpoint
Sophos read as Sophos Intercept X
Sophos (Intercept X / Sophos MDR) read as Sophos Intercept X
Sophos (Intercept X) read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Endpoint / Intercept X read as Sophos Intercept X
Sophos Intercept X Endpoint read as Sophos Intercept X
ThreatLocker read as ThreatLocker Zero Trust Platform
Trellix read as Trellix Endpoint Security Suite
Trellix (McAfee + FireEye) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee Enterprise & FireEye) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee/FireEye) read as Trellix Endpoint Security Suite
Trend Micro read as Trend Micro Apex One
Trend Micro (Trend Vision One) read as Trend Micro Apex One
Unresolved, counted raw
Bitdefender Endpoint Security
Broadcomm
Cisco Endpoint Security
Cisco Secure Client (AMP for Endpoints)
Comodo OpenEDR
Cybereason NGAV
ESET PROTECT Endpoint
ESET Small Office Protection
FreeEDR (GitHub)
Guardio
HP (Wolfray Cyber Security) Wolf Pro Security
Kaspersky Small Office Security
MicroWorld eScan Enterprise EDR
Microsoft Defender built-in / Defender for Business
Microsoft Defender for Endpoints
NetSecurity
UltraAV (Pango Group)
VIPRE Business Security
Discontinued, still offered
No shut-down product was recommended here.