Endpoint protection for enterprise buyers
Asked as “endpoint protection platform”, and as “business antivirus and endpoint security tool”, on behalf of an enterprise B2B company. 54 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
44%
Clear leader
44Microsoft Defender for Endpoint35CrowdStrike Falcon07SentinelOne Singularity13others
44% of first choices, clear leader.
Since September 2026▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Microsoft Defender for Endpoint held the lead, −5 points on 46%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Microsoft Defender for Cloud50%Clear leader▼−4Since September 2026: 50% → 46%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-market
Microsoft Defender for Endpoint22%Contested↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (23%) replaces Microsoft Defender for Cloud (22% then, 17% now), 6 points clear, inside the 11-point floor.Standing →EnterpriseMicrosoft Defender for Endpoint44%Clear leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This page
Microsoft Defender for Cloud50%Clear leader▼−4Since September 2026: 50% → 46%, −4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-marketMicrosoft Defender for Endpoint22%Contested↗new leaderNew leader since September 2026: Microsoft Defender for Endpoint (23%) replaces Microsoft Defender for Cloud (22% then, 17% now), 6 points clear, inside the 11-point floor.Standing →EnterpriseMicrosoft Defender for Endpoint44%Clear leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Microsoft Defender for Endpoint44%5%65endorsed leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.46% → 41%
Microsoft Defender for Endpoint44%5%65endorsed leader▼−5Since September 2026: 46% → 41%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.46% → 41%02
CrowdStrike Falcon35%13%60endorsed leader▲+4Since September 2026: 30% → 35%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.30% → 35%
CrowdStrike Falcon35%13%60endorsed leader▲+4Since September 2026: 30% → 35%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.30% → 35%03
SentinelOne Singularity7%8%39accepted challenger=heldSince September 2026: 9% → 9%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.9% → 9%
SentinelOne Singularity7%8%39accepted challenger=heldSince September 2026: 9% → 9%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.9% → 9%04
CrowdStrike4%33%12criticized challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%
CrowdStrike4%33%12criticized challenger▼−1Since September 2026: 5% → 4%, −1 point. Inside the 11-point floor: within noise. Read over the models both editions asked.5% → 4%05
Bitdefender GravityZone2%16%19accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Bitdefender GravityZone2%16%19accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%Show the four products at 0%, ordered by negative rate
09
Trend Micro Apex One0%23%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Trend Micro Apex One0%23%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%08
SentinelOne Singularity Endpoint0%15%26accepted challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%
SentinelOne Singularity Endpoint0%15%26accepted challenger▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 0%07
Sophos Intercept X0%13%31accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Sophos Intercept X0%13%31accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%06
Palo Alto Networks Cortex XDR0%3%36accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Palo Alto Networks Cortex XDR0%3%36accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All twenty-eight head-to-head pages: the top eight products, each against each
Microsoft Defender for Endpoint vs Sophos Intercept XMicrosoft Defender for Endpoint vs SentinelOne SingularityMicrosoft Defender for Endpoint vs SentinelOne Singularity EndpointMicrosoft Defender for Endpoint vs ESET PROTECTBitdefender GravityZone vs Microsoft Defender for CloudBitdefender GravityZone vs CrowdStrike FalconBitdefender GravityZone vs Sophos Intercept XBitdefender GravityZone vs SentinelOne SingularityBitdefender GravityZone vs SentinelOne Singularity EndpointBitdefender GravityZone vs ESET PROTECTMicrosoft Defender for Cloud vs CrowdStrike FalconMicrosoft Defender for Cloud vs Sophos Intercept XMicrosoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs SentinelOne Singularity EndpointMicrosoft Defender for Cloud vs ESET PROTECTCrowdStrike Falcon vs Sophos Intercept XCrowdStrike Falcon vs SentinelOne SingularityCrowdStrike Falcon vs SentinelOne Singularity EndpointCrowdStrike Falcon vs ESET PROTECTSophos Intercept X vs SentinelOne SingularitySophos Intercept X vs SentinelOne Singularity EndpointSophos Intercept X vs ESET PROTECTSentinelOne Singularity vs SentinelOne Singularity EndpointSentinelOne Singularity vs ESET PROTECTSentinelOne Singularity Endpoint vs ESET PROTECT
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
010203040506070809Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Microsoft Defender for Endpoint44%
Microsoft Defender for Endpoint44%02CrowdStrike Falcon35%
CrowdStrike Falcon35%03SentinelOne Singularity7%
SentinelOne Singularity7%04CrowdStrike4%
CrowdStrike4%05Bitdefender GravityZone2%
Bitdefender GravityZone2%06Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%07Sophos Intercept X0%
Sophos Intercept X0%08SentinelOne Singularity Endpoint0%
SentinelOne Singularity Endpoint0%09Trend Micro Apex One0%
Trend Micro Apex One0%What they warned about
Four of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, Llama 4 Maverick, Qwen 3.7 Flash, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike Falcon13%
8 of 60 labels negative · 6 of 14 models
“While CrowdStrike remains a market leader, its high cost at scale and occasional stability problems are noted by enterprise users” Mistral Small, negative prompt
Trellix Endpoint Security Suite62%
5 of 8 labels negative · 5 of 14 models · 1 hard negative
“Legacy challenges make this a **questionable choice for new enterprise deployments**” Kimi K2, negative prompt
Avast Business100%
4 of 4 labels negative · 4 of 14 models · 3 hard negative
“Lack of mobile coverage and unclear pricing makes it a poor fit for large, heterogeneous enterprises.” Muse Glimmer 30B, negative prompt
Kaspersky Endpoint Security80%
4 of 5 labels negative · 4 of 14 models · 2 hard negative
“restrictions or hesitancy around using Kaspersky products due to geopolitical concerns” Claude Haiku 4.5, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
77 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1136 links across 268 sites, every framing counted. Ranked by the number of answers carrying the site or page. 1 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Huntress41 answers · 58 citations · 12 models
vendor site · Guideflow35 answers · 36 citations · 11 models
vendor site · SentinelOne28 answers · 55 citations · 11 models
vendor site · CrowdStrike28 answers · 50 citations · 10 models
vendor site · Microsoft27 answers · 33 citations · 12 models
22 answers · 22 citations · 10 models
20 answers · 24 citations · 10 models
vendor site · Iru20 answers · 21 citations · 9 models
vendor site · Venn19 answers · 19 citations · 9 models
17 answers · 20 citations · 11 models
17 answers · 20 citations · 9 models
vendor site · Palo Alto Networks16 answers · 21 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
35 answers · 11 models
32 answers · 11 models
20 answers · 9 models
19 answers · 10 models
19 answers · 9 models
18 answers · 10 models
18 answers · 9 models
15 answers · 7 models
14 answers · 11 models
14 answers · 7 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best endpoint protection platform”, “endpoint protection platform”, “endpoint protection platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender parent site Microsoft Defender for Endpoint 44% | 44% | 268 | 18,100 | 3,525 | ||||
| CrowdStrike parent site CrowdStrike Falcon 35% | 35% | 234 | 74,000 | 5,130 | ||||
| SentinelOne sentinelone.com SentinelOne Singularity 7% | 7% | 534 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 2 |
| Microsoft parent site Microsoft Defender 6% | 6% | 52 | 2,240,000 | 403,136 | ||||
| CrowdStrike crowdstrike.com | 4% | 337 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | 5 |
| Bitdefender bitdefender.com Bitdefender GravityZone 2% | 2% | 99 | 90,500 | 3,261 | 649,861 company | 93 | ||
| Kaspersky kaspersky.com Kaspersky Endpoint Security 2% | 2% | 18 | 18,100 | 2,386 | 1,377,058 company | 31 | ||
| Palo Alto Networks parent site Palo Alto Networks Cortex XDR 0% | 0% | 241 | 40,500 | 1,088 | ||||
| Sophos sophos.com Sophos Intercept X 0% | 0% | 252 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| SentinelOne parent site SentinelOne Singularity Endpoint 0% | 0% | 67 | 33,100 | 1,675 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (crowdstrike.com, gartner.com, sentinelone.com, venn.com). The first result for “best endpoint protection platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best endpoint protection platform for an enterprise B2B company?”Paraphrase“Which business antivirus and endpoint security tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade endpoint protection platforms and how do they differ?”Budget-constrained“What is the best endpoint protection platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an endpoint protection platform. What should we look at?”Negative“Which endpoint protection platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceKaspersky Endpoint SecurityChangedno first choiceMicrosoft Defender for Endpointagainst: Huntress Managed EDRno first choiceagainst: CrowdStrike Falcon, Kaspersky Endpoint Security, Microsoft Defender for Endpoint, Symantec Endpoint Security, Trend Micro Apex One
Four alternatives
CrowdStrike Falcon, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne Singularity EndpointFive alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, Sophos Intercept X, Trend Micro Maximum SecurityTwo alternatives
Bitdefender GravityZone, SentinelOne SingularityGPT-5.4 miniMicrosoft Defender for EndpointMicrosoft Defender for EndpointHeldno first choiceMicrosoft Defenderno first choicenothing named
Three alternatives
CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne SingularityOne alternative
CrowdStrike FalconFour alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityTwo alternatives
CrowdStrike, SentinelOne Singularity EndpointGemini 3.5 FlashCrowdStrike Falcon, SentinelOne SingularityMicrosoft Defender for EndpointChangedCrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne SingularityMicrosoft Defender for Endpointagainst: CrowdStrike FalconCrowdStrike Falconagainst: Carbon Black, CrowdStrike, Datto EDR, Kaspersky Lab, Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Symantec, Trellix Endpoint Security Suite, VIPRE, Webroot Business Endpoint Protection
Three alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept XThree alternatives
CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
Palo Alto Networks Cortex XDR, Sophos Intercept X, Trend Vision OneTwo alternatives
SentinelOne Singularity, Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityPerplexity SonarCrowdStrike FalconCrowdStrike Falcon, Microsoft Defender for EndpointChangedno first choiceMicrosoft Defender for Endpointagainst: CrowdStrike Falcon, SentinelOne Singularityno first choiceagainst: Bitdefender GravityZone, Broadcom Symantec Endpoint Protection, ESET PROTECT, Huntress Managed EDR, Sophos Intercept X, Trend Vision One
Two alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointTwo alternatives
Bitdefender GravityZone, Sophos Intercept XOne alternative
Bitdefender GravityZoneGrok 4.1 FastCrowdStrike FalconCrowdStrike FalconHeldagainst: Avast BusinessCrowdStrike FalconMicrosoft Defender for Endpointagainst: Palo Alto Networks Cortex XDR, Trend Micro Apex OneCrowdStrikeagainst: Check Point Endpoint Security, Cynet, ESET PROTECT, Kaspersky Endpoint Security, Trellix Endpoint Security Suite, Trend Micro Apex One
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityOne alternative
Microsoft Defender for EndpointFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
CrowdStrike Falcon, SentinelOne SingularityFour alternatives
Microsoft Defender, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Sophos Intercept XMistral SmallMicrosoft Defender for Endpoint, SentinelOne SingularityCrowdStrike Falcon, SentinelOne SingularityChangedCrowdStrike FalconMicrosoft Defender for Endpointagainst: CrowdStrike Falcon, SentinelOne Singularity Endpointno first choiceagainst: CrowdStrike Falcon, Fortinet FortiEDR, Microsoft Defender for Endpoint, Sophos Intercept X, Trellix Endpoint Security Suite
Three alternatives
Bitdefender GravityZone Business Security, ESET PROTECT, Sophos Intercept XThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Trend Micro Apex OneSix alternatives
ESET PROTECT, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneDeepSeek V4 FlashCrowdStrike FalconCrowdStrike FalconHeldCrowdStrike FalconMicrosoft Defender for Endpointagainst: SentinelOne SingularityCrowdStrikeagainst: Kaspersky Lab, Legacy McAfee / Trellix, Symantec Endpoint Protection
Three alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularitySix alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trellix Endpoint Security Suite, VMware Carbon Black CloudOne alternative
CrowdStrike FalconTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointLlama 4 MaverickMicrosoft Defender, SentinelOne SingularityBitdefender GravityZone, Microsoft DefenderChangedno first choiceno first choiceMicrosoft Defender for Endpointagainst: Avast Business, Malwarebytes Endpoint Protection
Five alternatives
CrowdStrike, Huntress Managed EDR, Microsoft Defender, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
CrowdStrike Falcon, SentinelOne Singularity Endpoint, Sophos Intercept XQwen 3.7 FlashCrowdStrike Falcon, Microsoft Defender for EndpointCrowdStrike FalconChangedCrowdStrike FalconMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike, McAfee, SentinelOne Singularity Endpoint, Signature-Only "AV" Solutions, Trellix Endpoint Security Suite
Three alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Trend Micro Apex OneThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity EndpointTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityOne alternative
CrowdStrike FalconKimi K2CrowdStrike FalconCrowdStrike FalconHeldCrowdStrike Falconagainst: Symantec Endpoint Security, Trellix EndpointMicrosoft Defender for Endpointagainst: CrowdStrike Falconno first choiceagainst: CrowdStrike Falcon, McAfee, SentinelOne Singularity Endpoint, Trellix Endpoint Security Suite, VMware Carbon Black
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityTwo alternatives
Bitdefender GravityZone, SentinelOne SingularityGLM 4.7 FlashXCrowdStrike FalconMicrosoft Defender for EndpointChangedCrowdStrike Falcon, SentinelOne SingularityMicrosoft Defender for Endpointno first choiceagainst: Avast Business, Bitdefender GravityZone, Broadcom, Kaspersky Endpoint Security, Sophos Intercept X
Two alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointTwo alternatives
CrowdStrike Falcon, SentinelOne SingularityFour alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept XTwo alternatives
CrowdStrike, SentinelOne Singularity EndpointMiniMax M2.5CrowdStrike FalconCrowdStrike Falcon, Microsoft Defender for EndpointChangedCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for Endpointagainst: CrowdStrikeno first choicenothing named
Four alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Trend Vision OneTwo alternatives
Palo Alto Networks Cortex XDR, Trend Micro Apex OneOne alternative
SentinelOne SingularityTwo alternatives
Bitdefender GravityZone, Trend Micro Apex OneGPT-6 LunaCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for EndpointChangedno first choiceMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike Falcon, Kaspersky Endpoint Security
Two alternatives
Palo Alto Networks Cortex XDR, Sophos Intercept XOne alternative
CrowdStrike FalconSix alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneTwo alternatives
CrowdStrike, SentinelOne Singularity EndpointFour alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityMuse Glimmer 30BCrowdStrike Falcon, Microsoft Defender for EndpointCrowdStrike FalconChangedCrowdStrike Falcon, SentinelOne SingularityMicrosoft Defender for Endpointagainst: CrowdStrike, SentinelOne Singularityno first choiceagainst: Avast Business, Bitdefender GravityZone, Cisco Secure Endpoint, Sophos Intercept X, Symantec Endpoint Security
Three alternatives
Check Point Harmony Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointTwo alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDRTwo alternatives
Huntress Managed EDR, Sophos Intercept XBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:40 | yes | 9 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:31 | yes | 2 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:02 | yes | 8 | 17 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 08:23 | yes | 23 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:32 | yes | 25 | 7 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:57 | yes | 9 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:45 | yes | 24 | 38 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:07 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:25 | yes | 5 | 39 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:00 | yes | 15 | 21 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:51 | yes | 15 | 65 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:54 | yes | 10 | 14 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:21 | yes | 6 | 22 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 11:22 | yes | 15 | 29 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:25 | no | 0 | 4 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:56 | yes | 2 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:40 | yes | 13 | 25 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 11:03 | yes | 18 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:32 | yes | 22 | 7 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 08:00 | no | 0 | 6 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:53 | yes | 24 | 28 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:51 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:08 | no | 0 | 35 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:28 | yes | 20 | 19 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:01 | yes | 20 | 45 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:00 | yes | 13 | 42 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:42 | yes | 2 | 12 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:04 | yes | 11 | 20 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:14 | yes | 9 | 7 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:02 | yes | 4 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:31 | yes | 15 | 24 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 12:06 | yes | 20 | 7 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:38 | yes | 22 | 12 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:44 | yes | 13 | 10 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:13 | yes | 25 | 59 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:33 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 07:54 | yes | 10 | 38 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:16 | yes | 19 | 34 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 07:37 | yes | 15 | 63 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:50 | yes | 15 | 19 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:07 | yes | 8 | 32 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:49 | yes | 19 | 33 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:30 | yes | 15 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:52 | yes | 2 | 7 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:00 | yes | 22 | 25 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 12:19 | yes | 18 | 5 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:40 | yes | 24 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:58 | yes | 5 | 2 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:43 | yes | 25 | 28 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:50 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:51 | yes | 5 | 38 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:27 | yes | 24 | 26 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:47 | yes | 24 | 117 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:11 | yes | 21 | 46 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:36 | yes | 2 | 15 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:33 | yes | 14 | 26 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:37 | yes | 18 | 11 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:29 | yes | 4 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:35 | no | 0 | 17 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 10:22 | yes | 18 | 6 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:25 | yes | 25 | 13 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:19 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:23 | yes | 25 | 56 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 09:10 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:45 | no | 0 | 35 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:45 | yes | 25 | 32 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:20 | yes | 25 | 33 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:04 | no | 0 | 58 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:51 | yes | 4 | 26 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:16 | yes | 21 | 31 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:46 | yes | 17 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:45 | yes | 5 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:06 | yes | 20 | 32 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 09:14 | yes | 21 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:21 | yes | 25 | 9 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:57 | yes | 16 | 8 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:29 | yes | 25 | 45 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:23 | yes | 5 | 2 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:31 | yes | 24 | 183 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:54 | yes | 25 | 26 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 13:31 | yes | 24 | 27 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:31 | yes | 9 | 59 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:57 | yes | 3 | 20 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:32 | yes | 21 | 42 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Avast Business Security read as Avast Business
Bitdefender read as Bitdefender GravityZone
Broadcom Symantec read as Symantec Endpoint Security
Broadcom Symantec Endpoint Security read as Symantec Endpoint Security
Broadcom Symantec Endpoint Security Complete (SESC) read as Symantec Endpoint Security
Check Point read as Check Point Harmony Endpoint
Cisco read as Cisco Secure Endpoint
CrowdStrike Falcon EPP read as CrowdStrike Falcon
CrowdStrike Falcon Endpoint Protection Platform read as CrowdStrike Falcon
ESET read as ESET PROTECT
Huntress read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Security
Palo Alto Cortex read as Palo Alto Networks Cortex XDR
Palo Alto Networks (Cortex XDR) read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity Endpoint
Sophos read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Endpoint (Intercept X) read as Sophos Intercept X
Sophos Endpoint / Intercept X read as Sophos Intercept X
Sophos Intercept X Endpoint read as Sophos Intercept X
Trellix read as Trellix Endpoint Security Suite
Trellix (formerly McAfee Enterprise) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee) read as Trellix Endpoint Security Suite
Trend Micro read as Trend Micro Apex One
Trend Micro (Vision One / Apex One) read as Trend Micro Apex One
Webroot read as Webroot Business Endpoint Protection
Unresolved, counted raw
Broadcom Symantec Endpoint Protection
Koi
Legacy McAfee / Trellix
Microsoft Windows Security Center
Signature-Only "AV" Solutions
Trellix Endpoint
Trend Micro Maximum Security
VMware Carbon Black Cloud (Broadcom)
Discontinued, still offered
No shut-down product was recommended here.