12 of 36 endpoint tools roll back ransomware; 10 say where your data sits

01Five challenges become five tests

The 2022 list is worth keeping because the mapping from challenge to checkable capability is tight. IoT and unmanaged devices becomes: does the agent cover Linux, and are phones in the same console? New malware becomes: is this an EDR with a timeline, or a prevention tier that stops at blocking? Ransomware becomes: when a file is encrypted, does the product restore it, contain it, or hand you a backup? Patching becomes: is patch management bundled or a separate purchase? Everyone is a target becomes the only question a 40-person company really has: is there a published price, and is there a managed service sized for me?

The depth split matters before anything else. Of the 36, 14 are full EDR SKUs, 12 are prevention tiers, 8 are EDR-only layers that sit on a prevention product, and 2 are add-ons such as hardening or web filtering.¹ A 2022 reader comparing “Trend Micro against CrowdStrike” was comparing a prevention tier with an EDR bundle without knowing it, and the price gap that follows is mostly that.

02Ransomware: 12 of 36 restore the file, 8 do not

Rollback is the ransomware test, because detection is table stakes and the question on the day is how long the finance team is down. Twelve SKUs document file rollback from the agent itself: SentinelOne Singularity Endpoint, both Sophos Intercept X tiers, both Bitdefender GravityZone tiers, all four ESET PROTECT tiers, both Kaspersky SKUs and Check Point Harmony Endpoint.¹ Five more, the four Seqrite SKUs and Acronis Cyber Protect, restore from a backup copy rather than from the agent, which works but takes longer and depends on the backup being current. Three Xcitium SKUs contain the unknown file in a virtual sandbox so it never encrypts anything, a different mechanism with a different failure mode.

The 8 with none include the two most-cited names in the category. CrowdStrike Falcon Prevent and Falcon Insight have no file rollback; the model is to detect and respond fast enough that there is nothing to roll back. Microsoft Defender for Endpoint relies on OneDrive Files Restore rather than the agent, which is fine for a Microsoft 365 estate and useless for a file server.¹ Neither is a mark against the product. It is a mark against buying either one for a company whose real fear is a Monday morning with encrypted shares and no backup discipline.

03Price: prevention is US$36 to US$60, third-party EDR is 3× that

Twenty-three of the 36 SKUs publish a list price or a priced tier; 13 are quote-only.¹ Among the published lists the prevention tiers sit in a narrow band: Microsoft Defender for Endpoint P1 at US$3 a user a month, which is US$36 a year; ESET PROTECT Entry at US$42.20 a device a year; ESET Advanced at US$55; Bitdefender GravityZone Business Security from US$57; ESET Complete at US$57.54; and CrowdStrike Falcon Go at US$59.99.^{1 4 2} Trend Vision One Endpoint Security Essentials is the outlier below, at US$2.25 an endpoint a month, or US$27 a year.⁵

Then the step. SentinelOne Singularity Complete lists at US$179.99 an endpoint a year for 5 to 100 workstations through a partner; CrowdStrike’s Falcon Enterprise bundle, which is Prevent plus Insight EDR, lists at US$184.99 a device a year.^{3 2} That is the honest price of a forensic timeline, threat hunting and an agent someone will operate. The 2022 post called Trend Micro “a lot of value at a relatively low price” and CrowdStrike “unmatched”; both sentences were describing the gap between a prevention tier and an EDR bundle, not a difference in engineering quality.

Microsoft is the exception. Defender for Endpoint P2, its EDR tier, lists at US$5.20 a user a month, US$62.40 a year, which is a prevention-tier price, and it is already included in Microsoft 365 E5.^{4 1} The catch is in the rollback section above and in the console: it assumes an Intune and Entra estate.

04India: 10 of 36 document a region, 23 do not say

Endpoint telemetry is a log of everything a user runs, so where it lands matters under the CERT-In Directions and, from May 2027, the DPDP Rules. Ten SKUs document an Indian data region: Elastic Defend, SentinelOne Singularity Endpoint, both Sophos tiers, the four Seqrite SKUs, Acronis Cyber Protect and Scalefusion Veltar.¹ Those ten come from six vendors. Two CrowdStrike SKUs carry an Indian cloud announced in January 2026 that TechBag could not find documented as live by September 2026.^{1 8} One documents hosting outside India with no Indian option, and 23 say nothing we could verify either way.

The unverified column is the finding. More than half the category does not publish where an Indian customer’s telemetry is processed, and a buyer who does not ask will not be told. The question costs nothing in an RFP and it eliminates vendors faster than any feature grid: “Name the region, and put it in the order form.”

05The 2022 shortlist, four years on

We recommended Palo Alto Networks, Trend Micro Apex One, Kaspersky EDR, Symantec Endpoint Security and CrowdStrike Falcon. Here is where each stands as of September 2026, from the vendors’ own pages and TechBag’s intel pages.

Two of the five changed character rather than quality. Symantec’s enterprise business has been inside Broadcom since 2019 and is now sold by quote through partners, with no list price and no Indian region documented for the cloud console.⁹ Palo Alto’s endpoint product is Cortex XDR, also quote-only, and it is sold as the on-ramp to Cortex XSIAM rather than as a standalone agent.¹⁰ Kaspersky’s products remain legal and widely sold in India, but the US Commerce Department prohibited new sales and updates to US customers from 20 July and 29 September 2024, which matters if your company has US subsidiaries or US customers who audit your tooling.⁶

What the 2022 list got right was the instinct to compare. What it got wrong was comparing adjectives. The three questions that actually separate these products, rollback, published price and documented region, were answerable then and are counted now.