Leaders

High Performers

Contenders

Niche

Market Presence

Satisfaction

See Reviews

G2 Grid® Scoring

Endpoint Detection & Response (EDR) Software Definition

Endpoint detection and response (EDR) software is the newest member of the endpoint security family. EDR tools combine elements of both endpoint antivirus and endpoint management solutions to detect, investigate, and remove any malicious software that penetrates a network’s devices. EDR solutions give greater visibility of a system’s overall health including each specific device’s state. Companies use these tools to mitigate endpoint penetrations quickly and prevent data loss, theft, or system failures. They are typically used as a complement to larger security systems such as security information and event management (SIEM), vulnerability management, and incident response tools.

The best EDR software solutions record and store system behaviors, employing various data analytics techniques to identify suspicious activities. They also provide contextual information, block malicious actions, and offer remediation suggestions to restore affected systems.

To qualify for inclusion in the Endpoint Detection and Response (EDR) category, a product must:

• Alert administrators when devices have been compromised
• Search data and systems for the presence of malware
• Possess analytics and anomaly detection features
• Possess malware removal features

Endpoint Detection & Response (EDR) Grid® Scoring Description

• Products in the Leader quadrant are rated highly by G2 users and have substantial Market Presence scores. Leaders include: Sophos Endpoint, CrowdStrike Falcon Endpoint Protection Platform, Acronis Cyber Protect Cloud, Huntress Managed EDR, ESET PROTECT, ThreatDown, Arctic Wolf, Check Point Harmony Endpoint, Iru, TrendAI Vision One, ThreatLocker Platform, Cynet, Coro Cybersecurity, Cortex XDR, SentinelOne Singularity Endpoint, Cisco Secure Endpoints, N-able N-central, Carbon Black EDR, and Kaspersky Next EDR Expert
• High Performing products have high customer Satisfaction scores and low Market Presence compared to the rest of the category. High Performers include: Todyl Security Platform, WithSecure Elements Extended Detection and Response (XDR), Lookout, BlackFog, Heimdal, Field Effect MDR, DefenseStorm, and Saner CVEM
• Contender products have relatively low customer Satisfaction scores and high Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Contenders include: IBM MaaS360, Microsoft Defender for Endpoint, N-able N-Sight RMM, SonicWall Capture Client, Barracuda Managed XDR, WatchGuard Endpoint Security, Trellix Endpoint Security, FortiEDR, Bitdefender GravityZone XDR, Acronis Cyber Protect, Symantec Protection Suite Enterprise Edition, Palo Alto Cortex XSIAM, Symantec Endpoint Detection and Response (EDR), and Carbon Black Cloud
• Niche products have relatively low Satisfaction scores and low Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Niche products include: Wazuh, N-able Endpoint Detection and Response (EDR), Intezer, Cybereason Defense Platform, Datto Endpoint Detection and Response (EDR), IBM QRadar EDR, CrowdSec, VIPRE Endpoint Security Cloud, Uptycs, and Xcitium