IT AI Index
Index IT operations and endpoint Endpoint protection › Enterprise September 2026 Edition

Endpoint protection for enterprise buyers

Asked as “endpoint protection platform”, and as “business antivirus and endpoint security tool”, on behalf of an enterprise B2B company. 56 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Clear leader
43% of first choices, clear leader.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Microsoft Defender for Endpoint43%6%53endorsed leader
02CrowdStrike Falcon30%11%46endorsed leader
03SentinelOne Singularity9%10%29accepted challenger
04CrowdStrike5%27%15criticized challenger
05SentinelOne2%9%22accepted challenger
Show the five products at 0%, ordered by negative rate
10ESET PROTECT0%25%12criticized challenger
09Sophos0%10%10accepted challenger
08Sophos Intercept X0%8%12accepted challenger
07Bitdefender GravityZone0%6%16accepted challenger
06Palo Alto Networks Cortex XDR0%0%27accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Microsoft Defender for Endpoint43%
02CrowdStrike Falcon30%
03SentinelOne Singularity9%
04CrowdStrike5%
05SentinelOne2%
06Palo Alto Networks Cortex XDR0%
07Bitdefender GravityZone0%
08Sophos Intercept X0%
09Sophos0%
10ESET PROTECT0%

02What they warned about

Four of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike
27%
4 of 15 labels negative · 4 of 12 models
“The July 2024 faulty content update took out ~8.5 million Windows systems globally... created real **single-vendor dependency / systemic risk**” DeepSeek V4 Flash, negative prompt
CrowdStrike Falcon
11%
5 of 46 labels negative · 4 of 12 models
“offer strong security capabilities but typically come with per-endpoint per-year costs ranging from $18 to $35, which can add significant and less predictable expenses at scale” Mistral Small, budget prompt
Symantec Endpoint Security
100%
3 of 3 labels negative · 3 of 12 models · 2 hard negative
“**Verdict:** Avoid unless you are a premier Broadcom strategic partner with guaranteed white-glove support.” Gemini 3.5 Flash, negative prompt
ESET PROTECT
25%
3 of 12 labels negative · 3 of 12 models · 1 hard negative
“MITRE detection at 55.9%—middling at best... Not ideal for high-velocity SOCs in large orgs.” Grok 4.1 Fast, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

65 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 890 links across 244 sites, every framing counted. Ranked by the number of answers carrying the site or page.

34 answers · 54 citations · 9 models
26 answers · 35 citations · 9 models
21 answers · 24 citations · 9 models
17 answers · 17 citations · 8 models
vendor site · Huntress16 answers · 25 citations · 7 models
16 answers · 22 citations · 8 models
vendor site · Expert Insights15 answers · 17 citations · 5 models
vendor site · Microsoft14 answers · 22 citations · 8 models
vendor site · SentinelOne13 answers · 21 citations · 6 models
13 answers · 15 citations · 7 models
vendor site · Sophos13 answers · 14 citations · 7 models
vendor site · Broadcom13 answers · 13 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best endpoint protection platform for an enterprise B2B company?”Paraphrase“Which business antivirus and endpoint security tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade endpoint protection platforms and how do they differ?”Budget-constrained“What is the best endpoint protection platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an endpoint protection platform. What should we look at?”Negative“Which endpoint protection platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5CrowdStrike Falcon, SentinelOne Singularity
Two alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR
CrowdStrike Falcon, Microsoft Defender for EndpointChanged
Three alternativesBitdefender GravityZone, Kaspersky Endpoint Security for Business, Palo Alto Networks Cortex XDR
no first choiceCrowdStrike Falcon with Flex Licensing
One alternativeMicrosoft Defender for Endpoint
no first choiceagainst: CrowdStrike Falcon
GPT-5.4 miniMicrosoft Defender for Endpoint
Eight alternativesBitdefender, Check Point, CrowdStrike, Fortinet, Palo Alto Networks, SentinelOne, Sophos, TrendAI
Microsoft Defender for EndpointHeld
Two alternativesCrowdStrike Falcon, SentinelOne Singularity
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity
Three alternativesPalo Alto Networks Cortex XDR, Sophos Intercept X, Trend Micro Vision One / Apex One
against: VMware Carbon Black
Microsoft Defender for Endpoint
One alternativeCrowdStrike Falcon
against: SentinelOne Singularity
no first choicenothing named
Gemini 3.5 FlashCrowdStrike Falcon, Microsoft Defender for Endpoint
Three alternativesPalo Alto Networks, SentinelOne Singularity, Trend Micro
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne SingularityChanged
Two alternativesBitdefender GravityZone, Palo Alto Networks Cortex XDR
CrowdStrike Falcon
Five alternativesBroadcom Symantec CBX, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Sophos Endpoint
Microsoft Defender for Endpoint, SentinelOne Singularityagainst: CrowdStrike Falcon, Palo Alto Networksno first choiceagainst: Check Point, Cisco, CrowdStrike, Cybereason, Fortinet, Microsoft Defender for Endpoint, Symantec Endpoint Security, Trellix
Perplexity SonarCrowdStrike Falcon
Three alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint
Microsoft Defender for EndpointChanged
Three alternativesBitdefender GravityZone, CrowdStrike Falcon, SentinelOne Singularity
CrowdStrike Falcon
Six alternativesBitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Endpoint, Trend Micro Apex One
Microsoft Defender for Endpoint
Two alternativesTrellix XDR, Trend Vision One
against: CrowdStrike, Palo Alto
Microsoft Defender for Endpoint
Two alternativesCrowdStrike, SentinelOne
against: ESET PROTECT, Huntress
Grok 4.1 FastCrowdStrike Falcon
Three alternativesMicrosoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept X
CrowdStrike FalconHeld
One alternativeMicrosoft Defender for Endpoint
CrowdStrike Falcon
Five alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Vision One
against: Bitdefender GravityZone, ESET, Trellix
Microsoft Defender for Endpoint
Two alternativesCrowdStrike Falcon, SentinelOne Singularity
CrowdStrike, SentinelOne
Two alternativesMicrosoft, Palo Alto Networks Cortex XDR
against: Cisco, ESET PROTECT, Symantec Endpoint Security, Trellix, WatchGuard, WithSecure
Mistral SmallCrowdStrike Falcon, Microsoft Defender for Endpoint
Three alternativesBitdefender GravityZone, ESET PROTECT, SentinelOne Singularity
CrowdStrike FalconChanged
Two alternativesMicrosoft Defender for Endpoint, SentinelOne Singularity
CrowdStrike Falcon, SentinelOne Singularity
Three alternativesBitdefender GravityZone, ESET Endpoint Security, Microsoft Defender for Endpoint
Microsoft Defender for Endpointagainst: CrowdStrike Falcon, SentinelOne SingularityCrowdStrike
Three alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne
against: McAfee, Sophos, Xcitium
DeepSeek V4 FlashCrowdStrike, Microsoft
Three alternativesPalo Alto Networks, SentinelOne, Sophos
CrowdStrike FalconChanged
Three alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity
Five alternativesBitdefender GravityZone, ESET PROTECT, Palo Alto Networks Cortex XDR, Sophos Intercept X, Trend Micro Vision One / Apex One
Microsoft Defender for Endpoint P2
One alternativeCrowdStrike Falcon
against: SentinelOne Singularity
no first choiceagainst: CrowdStrike, Microsoft Defender for Endpoint, SentinelOne
Llama 4 Maverickno first choiceMicrosoft Defender for Endpoint, Webroot Business Endpoint ProtectionChangedno first choiceMicrosoft Defender for Endpoint P2
Six alternativesCarbon Black Enterprise EDR, CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Trellix XDR, Trend Vision One
no first choiceagainst: Bitdefender GravityZone SBS, CrowdStrike Falcon EPP, Microsoft Defender for Endpoint
Qwen 3.7 FlashCrowdStrike Falcon
Three alternativesMicrosoft Defender XDR, SentinelOne, Sophos Intercept X
CrowdStrike FalconHeld
Four alternativesMicrosoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne, Sophos Intercept X
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity
Three alternativesBitdefender GravityZone, ESET PROTECT, Palo Alto Networks Cortex XDR
Microsoft Defender for Endpoint
Two alternativesBitdefender GravityZone, CrowdStrike Falcon
no first choiceagainst: Kaspersky Business for Enterprise, Norton, Symantec Endpoint Security
Kimi K2Microsoft Defender for Endpoint, Trend Micro Vision One™ – XDRMicrosoft Defender for EndpointChanged
Two alternativesCrowdStrike Falcon, SentinelOne Singularity
CrowdStrike Falcon
Six alternativesBitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro Apex One
Microsoft Defender for Endpoint, SentinelOne Singularity
One alternativeCrowdStrike Falcon
Microsoft Defender for Endpoint
Two alternativesCrowdStrike Falcon, SentinelOne Singularity
against: CrowdStrike, Kaspersky, Legacy McAfee, Legacy Symantec/Broadcom Endpoint Protection, Norton
GLM 4.7 FlashXCrowdStrike Falcon, Microsoft Defender for Endpoint
Six alternativesBitdefender GravityZone, Cynet, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X Endpoint, Symantec Endpoint Security Complete
CrowdStrike FalconChanged
Three alternativesBitdefender GravityZone, Microsoft Defender for Endpoint, SentinelOne
CrowdStrike Falcon, SentinelOne Singularity
Seven alternativesBitdefender GravityZone Business Security, ESET PROTECT, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept X, ThreatLocker, Trend Micro Apex One
Microsoft Defender for Endpoint
One alternativeCrowdStrike Falcon
no first choiceagainst: Bitdefender, ESET PROTECT, Kaspersky
MiniMax M2.5CrowdStrike Falcon, Microsoft Defender for Endpoint
Two alternativesSophos, Trend Micro
CrowdStrike Falcon, Microsoft Defender for EndpointHeld
One alternativeSentinelOne Singularity Endpoint
no first choiceMicrosoft Defender for Endpointagainst: CrowdStrike Falcon, SentinelOneCrowdStrike Falcon, SentinelOne Singularity
One alternativeMicrosoft Defender for Endpoint
against: Sophos Intercept X, Trellix
against: CrowdStrike Falcon, Malwarebytes, NetSecurity, Rapid7, SenseOn, VMware Carbon Black
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:07yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:35yes26 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:52yes917 s
Direct recommendationPerplexity Sonarsonar2026-09-17 11:09yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:57yes1910 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 10:15yes1110 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:21yes1014 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:15yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:34yes540 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:19yes1017 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:13yes1548 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:20yes1038 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:10no04 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:52yes45 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:50yes1021 s
ParaphrasePerplexity Sonarsonar2026-09-17 11:36yes207 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:37yes3116 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 12:39yes54 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:47yes1517 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:25yes54 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:45no039 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:45yes1521 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:08yes936 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:01yes524 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:52yes98 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 14:01yes717 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:39yes1630 s
ComparativePerplexity Sonarsonar2026-09-17 10:47yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:43yes3120 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 09:43yes613 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:01yes1824 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:48yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:13yes1034 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:34yes1433 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:37yes28132 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:59yes549 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:16yes179 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:50yes36 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:09yes1524 s
Budget constrainedPerplexity Sonarsonar2026-09-17 11:00yes208 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:57yes4218 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:32yes55 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:53yes1726 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:44yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:52yes1039 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:53yes1043 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:42yes34109 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:51yes2356 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:08no08 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:00no010 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:12no019 s
Scale constrainedPerplexity Sonarsonar2026-09-17 12:31yes1910 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:10yes2011 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:50no010 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:43yes2932 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:18yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:18no039 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:25yes2444 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:22yes3054 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:28yes528 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:12yes3413 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:42yes37 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:05yes1830 s
Negative framingPerplexity Sonarsonar2026-09-17 13:04yes208 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:38yes2518 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 12:49yes159 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:03yes2726 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:52yes55 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:26yes1566 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 14:00yes2434 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:26yes1049 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:15yes1671 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
Bitdefender GravityZone EDR
Broadcom Symantec CBX (incorporating Carbon Black)
Carbon Black Enterprise EDR
CrowdStrike Falcon EPP
CrowdStrike Falcon with Flex Licensing
Group‑IB EDR
IBM QRadar EDR & MaaS360
Kaspersky Business for Enterprise
Kaspersky Endpoint Security for Business
Legacy McAfee (now Trellix)
Legacy Symantec/Broadcom Endpoint Protection
NetSecurity
ThreatLocker Protect
Trellix/Symantec-class enterprise tools
Discontinued, still offered
No shut-down product was recommended here.
← APMIncidents →