Published October 29, 2026
Endpoint detection and response (EDR) software runs an agent on laptops, servers and other devices. The agent records activity such as processes, network connections, logins, and registry and file changes, raises alerts on suspicious behavior, and lets analysts isolate a device or quarantine a file. Extended detection and response (XDR) correlates those endpoint signals with signals from identity, email and cloud applications to show one incident instead of separate alerts.
Where the market stands
On July 19, 2024, at 04:09 UTC, CrowdStrike released a content configuration update for its Falcon sensor on Windows that caused systems to crash. CrowdStrike reverted the update at 05:27 UTC and said Mac and Linux hosts were not affected. Microsoft estimated that the update affected 8.5 million Windows devices.
Sophos completed its acquisition of Secureworks on February 3, 2025. The all-cash deal valued Secureworks at about $859 million and brought its Taegis XDR and MDR platform. Sophos announced in October 2025 that Sophos Endpoint is included with all Taegis XDR and Taegis MDR subscriptions.
Microsoft began including Security Copilot in Microsoft 365 E5 on November 18, 2025, starting with existing Security Copilot customers. Microsoft describes a phased rollout to all eligible Microsoft 365 E5 and E7 customers.
On March 23, 2026, Trend Micro said its enterprise cybersecurity business would operate as TrendAI. Its platform is now TrendAI Vision One.
EDR, XDR and managed services
Buyers choose among three layers.
- EDR. The agent and its console. Microsoft Defender for Endpoint stores the behavioral telemetry it collects for six months.
- XDR. Correlation across sources. It covers the sources a vendor's platform ingests. Microsoft Defender XDR correlates signals only from the Microsoft security products the customer has licensed and provisioned.
- Managed detection and response (MDR). The vendor or a partner watches the platform and responds around the clock. CrowdStrike sells Falcon Complete. SentinelOne lists MDR as an add-on to its Commercial and Enterprise tiers and shows it as not included in Complete. Since November 2025, Sophos MDR and Sophos XDR subscriptions include third-party integrations across endpoint, firewall, network, cloud, email, identity, backup and productivity tools at no additional cost.
Decide whether you will staff detection 24 hours a day before you shortlist tools. The answer changes which tier and which vendors fit.
What the published tiers include and cost
These are list prices as published on October 17, 2026. SentinelOne and Microsoft's Security Copilot page state US dollars. CrowdStrike's and Microsoft's Defender pages do not state a currency.
- CrowdStrike Falcon. Prices are per device, billed annually. Falcon Go costs $59.99, is limited to 100 devices, and includes next-gen antivirus, device control, mobile device protection and Express Support. Falcon Pro costs $99.99 and adds firewall management. Falcon Enterprise costs $184.99 and adds endpoint detection and response and threat intelligence and hunting. No published bundle includes identity protection, IT hygiene or Next-Gen SIEM. Falcon Complete, the MDR service, is priced through sales.
- SentinelOne Singularity. Singularity Complete costs $179.99 per endpoint per year, with 14 days of data retention and managed threat hunting as an add-on. Singularity Commercial costs $229.99 and adds identity threat detection and response, 90-day retention and managed threat hunting. Singularity Enterprise is priced through sales and adds an agentic AI SOC analyst. SentinelOne says the prices apply to 5 to 100 workstations, and purchases go through partners whose pricing governs.
- Microsoft Defender for Business. $3.00 per user per month on an annual subscription, for up to 300 users and five devices per user. It includes EDR.
- Microsoft Defender for Endpoint Plan 2. Included in Microsoft 365 E5 and Microsoft 365 E5 Security. Plan 1 and Defender for Business include only four manual response actions: run an antivirus scan, isolate a device, stop and quarantine a file, and add a block or allow indicator. The Microsoft Defender Suite costs $12.00 per user per month on an annual subscription. It covers endpoint, email and collaboration, identity and SaaS security, and requires Microsoft 365 E3, or Office 365 E3 with Enterprise Mobility + Security E3.
- Security Copilot in Microsoft 365 E5 and E7. Customers receive 400 Security Compute Units a month per 1,000 paid user licenses, up to 10,000. Unused units do not roll over. Microsoft says usage beyond the allocation will be throttled at a future date, with extra units at $6 each, pay as you go.
Ask every vendor on the shortlist for a quote that separates the endpoint license, XDR or SIEM data ingest and retention, identity modules and managed services.
The agent as an operational risk
In its root cause analysis of August 6, 2024, CrowdStrike said it had completed an updated deployment ring process for content updates. It said it had deployed capabilities that let customers control how this content is deployed. It also said work had begun with two independent software security vendors to review the sensor code and its quality control and release processes.
Since April 1, 2025, version 3.0 of the Microsoft Virus Initiative has set new requirements that antivirus vendors must meet to keep signing rights for their Windows drivers. Microsoft released a first private preview of the Windows endpoint security platform in June 2025. It moves antivirus enforcement from the kernel to user mode, so a bug affects the antivirus app rather than Windows. Microsoft's November 18, 2025 update gives no date for wider availability.
Microsoft released Quick Machine Recovery in August 2025. When PCs cannot start Windows and fall back to the Windows Recovery Environment, Microsoft can push a fix through Windows Update. Cloud remediation is off by default on enterprise-managed devices, including Windows Enterprise and Education editions.
Ask each vendor whether you can hold content updates, deploy them to your own rings, and roll them back.
Independent testing
Microsoft announced on June 13, 2025 that it would not take part in MITRE's 2025 ATT&CK Enterprise evaluation. SentinelOne and Palo Alto Networks announced the same on September 12, 2025.
Compare results only among vendors that took part in the same round. Then run your own emulation on your own devices.
What a switch requires
Microsoft documents how its antivirus behaves next to another product. On Windows 10 and 11 not onboarded to Defender for Endpoint, Microsoft Defender Antivirus disables itself when another antivirus is installed. On Windows Server it does not enter passive mode automatically when another antivirus is installed. To keep it in passive mode, Microsoft says to set that before onboarding the server, and to add Defender for Endpoint to the existing product's exclusion list.
Ask the incoming vendor for the same documentation for every operating system you run.
- Pilot on a sample of every device type, including servers and virtual desktops, alongside the current agent.
- Tune detections and exclusions against your own business software before turning on prevention.
- Roll out in rings, and remove the old agent from each group only after the new one is proven there.
- Connect identity, email and cloud sources, and check that correlation reduces the number of incidents analysts handle.
Questions to settle first
Settle these before choosing a platform.
- Who watches alerts at night and on weekends: your staff, the vendor or a partner?
- Which data sources must the XDR correlate, and which of them does the vendor ingest natively?
- How many days of telemetry do investigations and regulators need, and which tier provides it?
- What control do you have over the vendor's content and sensor updates?
- If you hold Microsoft 365 E5, what does a second vendor add that Defender for Endpoint Plan 2 does not?