CONFIDENTIAL - SOPHOS INTERNAL AND CHANNEL PARTNERS ONLY - DO NOT REDISTRIBUTE

Endpoint Competitive Overview

Sophos Advantages
 Award-winning endpoint protection with AI and XDR delivers unmatched defense against malware, exploits,
and ransomware
 Sophos Central provides unified management of endpoint, server, firewall, mobile, data, email, cloud, and
wireless security
 Synchronized Security enables real-time intelligence sharing across product portfolio to better protect
against advanced threats

Key competitors and products

Broadcom Symantec (Endpoint Security, SEP Cloud) CrowdStrike (Falcon Enterprise)
Key weaknesses Key weaknesses
 Disjointed management – still in the process of moving  Threat exposure – lacks tools to prevent exposure to

towards a fully featured cloud management console threats (no web protection or application control)
 Limited exploit prevention capabilities and no  Anti-exploit, anti-ransomware, and machine learning
specific anti-ransomware technology capabilities are less comprehensive than Intercept X
 Ownership woes – Broadcom has a history of buying tech  Expensive – per Gartner, CrowdStrike licenses are expensive
companies, drastically cutting costs, and selling to only the and products are rarely sold without accompanying services
largest customers
Watch out for
Watch out for CrowdStrike comes from a threat response background and offers
Symantec has a broad feature set and scores well in third-party granular EDR capabilities
tests

Trend Micro (Apex One, Worry-Free) Microsoft (Defender Antivirus, Defender for Endpoint)
Key weaknesses Key weaknesses
 Multiple products are required to benefit from all features  Management and reporting split across several consoles

 Separate components, consoles – plug-in-based architecture  Windows 10/11 focused – reduced protection on other
requires additional downloads, product activations, installs Windows platforms, Mac, and Linux machines
and disparate management consoles
 Complex configuration – Features like Exploit Guard require
 Server protection (Deep Security) is an expensive uplift manual configuration and the upload of an XML file
Watch out for Watch out for
Endpoint license suites include multiple products and are often Customers may be entitled to use endpoint protection features
aggressively priced through their existing corporate Microsoft license

VMware Carbon Black (Endpoint Standard) SentinelOne (Singularity Complete)

Key weaknesses Key weaknesses
 Lacks machine learning anti-malware protection  Lacks tools to prevent exposure to threats (no web protection

 Few tools to prevent exposure to threats (no web or application control)

protection, application control, or device control)  Clean up – cannot clean existing infections
 Lacks automated rollback, limited exploit prevention  Endpoint centric – no complimentary security products
Watch out for Watch out for
Single agent for all four key endpoint functions Has a rollback capability to revert files to their pre-infected state
The information in this document is based on Sophos’s interpretation of data publicly available as of the date it was prepared. Other companies named in the document had no part in its preparation. The
information contained in this comparison may be incomplete or inaccurate and is subject to change. The information is intended for informational purposes only and is not intended to be relied upon in making
any purchase decision. The information is provided "as is" without warranties of any kind either expressed or implied. This document is Sophos confidential information. Partners may use only the most up-to-
date version, and only if permitted by law in their Territory. Distribution to any third party other than a Sophos authorized partner is strictly prohibited.
Copyright 2022 Sophos Group. All Rights Reserved.

March 2022
ESET (Endpoint Protection) BlackBerry Cylance (Cylance PROTECT)
Key weaknesses Key weaknesses
 Limited portfolio and all products are not  Heavily focused on file-based malware; no web protection

managed from a single console and limited exploit prevention; BlackBerry lacks market
traction
 No app control; anti-exploit and anti-ransomware features
are only a subset of those available in Intercept X  Infrequent participation in 3rd party testing

 Management complexity – an admin must work  Lengthy deployment – recommends multi-day deployment by
its professional services to reduce false-positive detections
with ‘Tasks’ and ‘Triggers’ to perform common actions
Watch out for
Watch out for
Machine learning is key to CylancePROTECT and Cylance helped
ESET is often competitively priced
raise the profile of this protection technology

McAfee Enterprise (Endpoint Security, MVISION Endpoint) Webroot (SecureAnywhere Endpoint Protection)
Key weaknesses Key weaknesses
 The complex McAfee ePO console has a steep learning curve  ML-based detection is showing its age and continues to
 Features such as EDR, device control, and application control perform poorly in the few 3rd party tests it has participated in
require customers to deploy and manage additional products  Few tools to reduce threat exposure (no device control, and
only basic app ctrl), while anti-exploit and anti-ransomware
 Limited exploit and file-less attack prevention capabilities, capabilities are less comprehensive than Intercept X
and no specific anti-ransomware technology
 Lacks EDR capabilities and the Opentext / Carbonite
Watch out for ownership does not mitigate slowing momentum
Most McAfee products can be managed through the ePO Watch out for
administration console Webroot has strong presence in the Managed Service Provider
(MSP) market

Kaspersky (Endpoint Security)

Key weaknesses
 Limited cloud management – ‘Endpoint Security Cloud’ is
designed for SMBs, and lacks the granularity of its on-
premise counterpart – ‘Security Center’
 Limited anti-exploit and anti-ransomware capabilities – e.g.
‘Remediation Engine’ can remove newly created malicious
files during a ransomware attack but is unable to roll back
existing files that may have been encrypted
 Kaspersky EDR requires its own management console
(separate from Security Center and Endpoint Security Cloud)
and is primarily designed for trained security analysts

Watch out for

Broad endpoint feature set – In addition to security configuration,
the Security Center on-premise console enables administrative
tasks, such as client operating system installs and remote
connections to client machines, to be performed

The information in this document is based on Sophos’s interpretation of data publicly available as of the date it was prepared. Other companies named in the document had no part in its preparation. The
information contained in this comparison may be incomplete or inaccurate and is subject to change. The information is intended for informational purposes only and is not intended to be relied upon in making
any purchase decision. The information is provided "as is" without warranties of any kind either expressed or implied. This document is Sophos confidential information. Partners may use only the most up-to-
date version, and only if permitted by law in their Territory. Distribution to any third party other than a Sophos authorized partner is strictly prohibited.
Copyright 2022 Sophos Group. All Rights Reserved.

March 2022