Gartner Endpoint Protection: Quick Takeaways and MQ Vendors

Key Takeaways from the 2021 Gartner Magic Quadrant

The Gartner Magic Quadrant for Endpoint Protection covers solutions that help protect enterprise endpoints from attacks and breaches.

In the report, researchers assess the strengths and weaknesses of solutions they consider to be the most important in the market. The reader is provided with a graph, known as the Magic Quadrant, which shows vendors based on their ability to execute (Y-axis) and completeness of vision (X-axis).

According to Gartner, skills and practices in the endpoint protection field are influenced by two trends:

• The growth and increasing stealth of endpoint attacks
• The sudden surge in remote work

Today, Gartner views endpoint protection as an essential digital security hygiene component needed to protect against malware. However, researchers also note the importance of investing in more advanced features to extend protection against more stealthy, sophisticated, or unknown threats. Gartner predicts that by the end of 2021, over 95% of deployed EPPs will be provided as a cloud offering.

Learn more in our detailed guide to advanced endpoint protection.

2021 Gartner MQ EPP Leaders

Microsoft

Microsoft Defender for Endpoint is a cloud-based solution that centralizes EPP, EDR, and threat hunting capabilities. It offers management through one console and a data lake for the information. It includes Defender Antivirus for Windows, as well as Linux and macOS protection capabilities. Defender also covers Android and iOS devices.

Related content: Read our guide to Microsoft Defender for Endpoint

CrowdStrike

CrowdStrike Falcon offers an EDR product that helps detect, respond, and remediate advanced threats. It also includes file-based malware prevention and behavioral machine learning to help protect against known threats. Additionally, CrowdStrike offers advanced firewall management and mobile device protection.

Trend Micro

Trend Micro provides various capabilities via the Apex One platform and an XDR add-on that integrates other Trend Micro security tools. Trend Micro supports all operating systems and provides versatile deployment options for on-premises, cloud, and hybrid setups. Additionally, Trend Micro offers an XDR platform and cloud and container security tools.

Related content: Read our guide to Trend Micro endpoint security

SentinelOne

SentinelOne offers an XDR solution, called Singularity, that adds third-party integrations to existing threat hunting and EDR. It is hosted on a new cloud platform and data lake and automated mitigation via the Storyline Active Response features. It also offers IoT discovery and protection capabilities via Ranger.

McAfee

McAfee MVISION is an XDR solution. McAfee’s standard solution offers native operating system capabilities and advanced protection features, such as ransomware rollback. The premium MVISION EDR package includes the MVISION Insights solution that can prioritize threats and countermeasures for responders.

Related content: Read our guide to endpoint security McAfee

Sophos

Sophos Central offers EPP, EDR, and MTD via a single console. It provides visibility, management, and threat detection for all endpoint types. Sophos Central can also manage disk encryption, firewall, email gateways, and server protection. Sophos Central’s cloud-hosted solution includes Live Response, device discovery data, and forensics features.

Related content: Read our guide to Sophos endpoint protection

2021 Gartner MQ EPP Challengers

ESET

ESET offers various endpoint protection products. ESET Endpoint Security offers EPP capabilities, Enterprise Inspector offers EDR, and Dynamic Threat Defense provides sandbox features. ESET PROTECT Enterprise includes browser anti-tampering, cloud management, and Apple FileVault 2 encryption management.

Related content: Read our guide to ESET endpoint security

2021 Gartner MQ EPP Visionaries

Kaspersky

Kaspersky offers various protection capabilities. The Kaspersky Anti Targeted Attack (KATA) Platform covers detection and response functionality at the network and gateway levels. It provides a cloud-based management console for enterprises and fileless malware and advanced persistent threats (APTs) detection.

Related content: Read our guide to Kaspersky endpoint security

VMware Carbon Black

VMware offers Carbon Black for endpoint, network, and cloud workloads protection. It integrates with a diverse partner ecosystem, offering Next-Gen SOC Alliance with SOAR and SIEM vendors. Carbon Black is incorporated in existing VMware virtualization. It also works with VMware’s security tools via a single cloud-based console and data lake.

Symantec

Symantec offers various solutions, such as Symantec Endpoint Security Complete (SESC) and Symantec Endpoint Security Enterprise (SESE). Symantec solutions share a cloud console, allowing integration between this ecosystem of tools. It also partners with a global network of vendors to offer services to small and midsize businesses (SMBs).

Related content: Read our guide to Symantec endpoint protection

Cisco

Cisco offers an XDR platform called SecureX (formerly Cisco Threat Response). It provides investigation and response capabilities and integrates with Cisco’s EPP and EDR tools to offer centralized security analytics, threat intelligence, and threat hunting. SecureX is cloud native and integrates with various third-party solutions.

Cybereason

Cybereason Defense Platform offers cloud native EPP and EDR capabilities. Cybereason also provides managed detection and response, incident response services, and a mobile threat defense solution. The vendor employs an AI hunting engine and automated SOC activities to improve efficiency and productivity.

Learn more in our detailed guide to epp security.

Endpoint Protection With Cynet 360

Cynet 360 is a holistic security solution that protects against threats to endpoint security and across your network.

Cynet’s intelligent technologies can help you detect attacks by correlating information from endpoints, network analytics and behavioral analytics with almost no false positives.

With Cynet, you can proactively monitor entire internal environments, including endpoints, network, files, and hosts. This can help you reduce attack surfaces and the likelihood of multiple attacks.

Cynet 360 provides cutting edge EDR capabilities:

• Advanced endpoint threat detection—full visibility and predicts how an attacker might operate, based on continuous monitoring of endpoints and behavioral analysis.
• Investigation and validation—search and review historic or current incident data on endpoints, investigate threats, and validate alerts. This allows you to confirm the threat before responding to it, reducing dwell-time and performing faster remediation.
• Rapid deployment and response—deploy across thousands of endpoints within two hours. You can then use it to perform automatic or manual remediation of threats on the endpoints, disrupt malicious activity and minimize damage caused by attacks.

Learn more about our EDR security capabilities.

In addition, Cynet 360 provides the following endpoint protection capabilities:

• NGAV —providing automated prevention and termination of malware, exploits, Macros, LOLBins, and malicious scripts with machine learning based analysis.
• User Behavior Rules —detecting and preventing attacks using compromised credentials through the use of behavioral baselines and signatures.
• Deception technology —planting fake credentials, files and connections to lure and trap attackers, mitigating damage and providing the opportunity to learn from attacker activity.
• Monitoring and control —providing asset management, vulnerability assessments and application control with continuous monitoring and log collection.
• Response orchestration —providing manual and automated remediation for files, users, hosts and networks customized with user-created scripts.

Learn more about the Cynet 360 security platform.