Forrester analysts underscored the shift toward prevention and the necessity of efficient and integrated solutions that provide a seamless transition to extended detection and response (XDR) in its latest endpoint security Wave report.

The analysis firm identified two trends in the endpoint security market: first, while endpoint security vendors are building out their XDR platforms, their customers are still mainly concerned about attack prevention; second, endpoint security has transcended its conventional role of malware prevention or “next-generation antivirus,” to integrating behavioral analysis, vulnerability remediation and advanced threat prevention for data, identity and network.

Based on these trends, Forrester recommends organizations look for providers that

  • Prioritize prevention from a broad range of attack methods and various vectors at the endpoint, so security analysts can focus more of their time on attack investigation and recovery.
  • Integrate functions, including vulnerability and patch remediation or secure configuration management, to help consolidate tools security teams need to maintain a proper endpoint security posture.
  • Help seamlessly migrate from endpoint detection and response (EDR) to XDR without reconfiguration or changing the endpoints over solutions that require broad environment changes.
Endpoint security leaders in the spotlight

In this Endpoint Security Wave report for Q4, 2023, Forrester named CrowdStrike, Trend Micro, Bitdefender, and Microsoft as endpoint security leaders; Palo Alto Networks, SentinelOne, ESET, Sophos, Trellix and Broadcom as strong performers; and VMware Carbon Black, Cisco and BlackBerry as contenders.

The analysts revealed the strengths and weaknesses of the vendors:

CrowdStrike: A dominant force with room for price optimization

CrowdStrike's advancements in protection engines have positioned it as a leader, suited for both enterprises and small and medium-sized businesses (SMB), Forrester noted. “​​CrowdStrike’s superior vision focuses on how adversaries will attack the enterprise and how to prevent it from happening, as opposed to cleaning up the mess later, while having the lowest impact on endpoint performance.” Customers praised CrowdStrike for its robust endpoint security capabilities and rapid attack mitigation.

However, the company faces challenges with its pricing model, as customers must purchase multiple add-ons, leading to an increase in the final cost. Additionally, concerns arise regarding CrowdStrike’s expansion into non-endpoint protection domains which might affect its core capabilities. Meanwhile, some customers found its recent acquisitions’ interfaces didn’t integrate with its endpoint security product.

Trend Micro: A veteran player with challenges transitioning to a cloud-based solution

Trend Micro stands out for its consistent and comprehensive endpoint security solutions, its high customer loyalty for enterprises of all levels worldwide, and its continued investment in innovation and the XDR space, while ensuring endpoint protection is foundational to all its enterprise security offerings.

However, customers reported challenges when transitioning from on-premise Apex One to Trend Vision One, Trend Micro’s cloud-based threat defense platform.

Bitdefender: An aggressive prevention provider but relatively low data retrieval efficiency

Bitdefender differentiates itself with a prevention-first approach, focusing on defending endpoints as the base to secure user workloads. The platform offers a wide array of control functions and excels in cross-operating system capabilities, including mobile threat defense. It has a flexible pricing model and the majority of the vendor’s enterprise customers are based in Europe.

Despite Bitdefender's vision of moving to XDR, Forrester noted its roadmap doesn’t have the depth of some of its competitors. Additionally, customers pointed out its endpoint security product needs to be more efficient when finding data, not on missing functionality.

Microsoft: A go-to choice for E5 customers but falling short in reporting and management ease

Microsoft Defender for Endpoint has recently added strong vulnerability management functions. Its integration into the dominant global operating system and inclusion within the Microsoft 365 E5 license allows the platform to perform consistently across diverse customer sizes.

However, Forrester analysts pointed out Microsoft’s licensing models are the most challenging in the industry with advanced features requiring enterprise agreements. The Defender platform requires regularly moving between separate consoles to perform tasks and use other Microsoft solutions Intune and Purview to access functions. Its customers also confirmed these reporting and management issues.