--- title: "12 of 36 endpoint tools roll back ransomware; 10 say where your data sits" summary: "What TechBag’s count of 36 endpoint protection SKUs showed on rollback, published price and Indian data region, and where the 2022 shortlist stands, as of September 2026." url: https://www.thetechbag.com/blog/challenges-solutions-endpoint-security-organization format: Analysis desk: "Endpoints & devices" published: 2024-11-27 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["endpoint protection","EDR","ransomware rollback","pricing","data residency","CrowdStrike","SentinelOne","Microsoft Defender","Seqrite","Kaspersky","CERT-In","DPDP","GST"] cover: https://www.thetechbag.com/blog/covers/challenges-solutions-endpoint-security-organization.png --- # 12 of 36 endpoint tools roll back ransomware; 10 say where your data sits *What TechBag’s count of 36 endpoint protection SKUs showed on rollback, published price and Indian data region, and where the 2022 shortlist stands, as of September 2026.* Analysis · Endpoints & devices · By TechBag · Published 2024-11-27 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/challenges-solutions-endpoint-security-organization The short version - Of the 36 endpoint protection SKUs TechBag has checked against vendor documentation, 12 document file rollback after ransomware, 23 publish a price, and 10 document an Indian data region.[1] - The published lists cluster: prevention tiers at US$36 to US$60 a device a year, the two reference third-party EDR bundles at US$180 to US$185. EDR is a 3× step, not a 30% one; Microsoft’s P2 is the exception.[2] [3] [4] - Of the five vendors our 2022 post recommended, two are now quote-only, one is barred from new US sales, and one crashed about 8.5 million Windows machines with a faulty update in July 2024.[6] [16] In February 2022 we published a list of five endpoint security challenges and five products to buy. The challenges were IoT devices, new malware, ransomware, patching and the fact that small companies are targets too. Four years on, every one of those is still true and none of them is a buying criterion. A buyer cannot test “new kinds of malware”. What a buyer can test is whether the product rolls a file back, whether it patches Linux, what it costs per device and where the telemetry sits. So this time we counted those things across the 36 endpoint SKUs on TechBag’s Endpoint Protection guide, and we went back to the 2022 shortlist to see what happened to it. ## Five challenges become five tests The 2022 list is worth keeping because the mapping from challenge to checkable capability is tight. IoT and unmanaged devices becomes: does the agent cover Linux, and are phones in the same console? New malware becomes: is this an EDR with a timeline, or a prevention tier that stops at blocking? Ransomware becomes: when a file is encrypted, does the product restore it, contain it, or hand you a backup? Patching becomes: is patch management bundled or a separate purchase? Everyone is a target becomes the only question a 40-person company really has: is there a published price, and is there a managed service sized for me? **Figure: 36 SKUs from 20 vendors, and the four counts that decide a shortlist** *TechBag Endpoint Protection guide, capability tags verified against vendor documentation, August 2026* 36 Endpoint SKUs on the guide, from 20 vendors TechBag count 23 Publish a list price or a priced tier TechBag count 12 Document file rollback after ransomware TechBag count 10 Document an Indian data region TechBag count Source: TechBag Endpoint Protection guide, 36 product rows · as of 30 September 2026 The depth split matters before anything else. Of the 36, 14 are full EDR SKUs, 12 are prevention tiers, 8 are EDR-only layers that sit on a prevention product, and 2 are add-ons such as hardening or web filtering.[1] A 2022 reader comparing “Trend Micro against CrowdStrike” was comparing a prevention tier with an EDR bundle without knowing it, and the price gap that follows is mostly that. TechBag countHow TechBag counted Each of the 36 rows carries tags for depth, rollback, Linux, mobile, on-premises console, India region, published price and managed service, set from the vendor’s own documentation on 22 August 2026. A tag we could not verify is recorded as “unverified” and is never counted as a no.[1] ## Ransomware: 12 of 36 restore the file, 8 do not Rollback is the ransomware test, because detection is table stakes and the question on the day is how long the finance team is down. Twelve SKUs document file rollback from the agent itself: SentinelOne Singularity Endpoint, both Sophos Intercept X tiers, both Bitdefender GravityZone tiers, all four ESET PROTECT tiers, both Kaspersky SKUs and Check Point Harmony Endpoint.[1] Five more, the four Seqrite SKUs and Acronis Cyber Protect, restore from a backup copy rather than from the agent, which works but takes longer and depends on the backup being current. Three Xcitium SKUs contain the unknown file in a virtual sandbox so it never encrypts anything, a different mechanism with a different failure mode. **Figure: Only 12 of 36 endpoint SKUs document file rollback from the agent; 8 document none** *Ransomware recovery mechanism documented by the vendor, 36 endpoint SKUs, August 2026* File rollback from the agent 12 SKUs Restore from a backup copy Seqrite, Acronis 5 SKUs Containment, no encryption Xcitium 3 SKUs None documented 8 SKUs Unverified 8 SKUs | | Value (SKUs) | | --- | --- | | File rollback from the agent | 12 | | Restore from a backup copy | 5 | | Containment, no encryption | 3 | | None documented | 8 | | Unverified | 8 | Source: TechBag Endpoint Protection guide, rollback tag · as of 30 September 2026 · Unverified means TechBag found no vendor document either way; it is not a no The 8 with none include the two most-cited names in the category. CrowdStrike Falcon Prevent and Falcon Insight have no file rollback; the model is to detect and respond fast enough that there is nothing to roll back. Microsoft Defender for Endpoint relies on OneDrive Files Restore rather than the agent, which is fine for a Microsoft 365 estate and useless for a file server.[1] Neither is a mark against the product. It is a mark against buying either one for a company whose real fear is a Monday morning with encrypted shares and no backup discipline. ## Price: prevention is US$36 to US$60, third-party EDR is 3× that Twenty-three of the 36 SKUs publish a list price or a priced tier; 13 are quote-only.[1] Among the published lists the prevention tiers sit in a narrow band: Microsoft Defender for Endpoint P1 at US$3 a user a month, which is US$36 a year; ESET PROTECT Entry at US$42.20 a device a year; ESET Advanced at US$55; Bitdefender GravityZone Business Security from US$57; ESET Complete at US$57.54; and CrowdStrike Falcon Go at US$59.99.[1] [4] [2] Trend Vision One Endpoint Security Essentials is the outlier below, at US$2.25 an endpoint a month, or US$27 a year.[5] **Figure: Prevention tiers cluster at US$36 to US$60 a device a year; the two reference third-party EDR bundles cost three times that** *Published list price per device per year, US$, nine endpoint SKUs, September 2026* Trend Vision One Essentials US$27 Defender for Endpoint P1 US$36 ESET PROTECT Entry US$42.2 Bitdefender Business Security US$57 ESET PROTECT Complete US$57.54 CrowdStrike Falcon Go US$59.99 Defender for Endpoint P2 EDR US$62.4 SentinelOne Singularity Complete US$179.99 CrowdStrike Falcon Enterprise US$184.99 | | Value (US$) | | --- | --- | | Trend Vision One Essentials | 27 | | Defender for Endpoint P1 | 36 | | ESET PROTECT Entry | 42.2 | | Bitdefender Business Security | 57 | | ESET PROTECT Complete | 57.54 | | CrowdStrike Falcon Go | 59.99 | | Defender for Endpoint P2 | 62.4 | | SentinelOne Singularity Complete | 179.99 | | CrowdStrike Falcon Enterprise | 184.99 | Source: Vendor pricing pages (CrowdStrike, SentinelOne) and TechBag's Microsoft, ESET, Bitdefender and Trend Micro pages · as of 30 September 2026 · Defender P1 and P2 are per user per month ×12; Trend Essentials is per endpoint per month ×12 Then the step. SentinelOne Singularity Complete lists at US$179.99 an endpoint a year for 5 to 100 workstations through a partner; CrowdStrike’s Falcon Enterprise bundle, which is Prevent plus Insight EDR, lists at US$184.99 a device a year.[3] [2] That is the honest price of a forensic timeline, threat hunting and an agent someone will operate. The 2022 post called Trend Micro “a lot of value at a relatively low price” and CrowdStrike “unmatched”; both sentences were describing the gap between a prevention tier and an EDR bundle, not a difference in engineering quality. Microsoft is the exception. Defender for Endpoint P2, its EDR tier, lists at US$5.20 a user a month, US$62.40 a year, which is a prevention-tier price, and it is already included in Microsoft 365 E5.[4] [1] The catch is in the rollback section above and in the console: it assumes an Intune and Entra estate. Our view Our view: a company without a security analyst should not buy the US$180 tier unless a managed service comes with it. Of the 36 SKUs, 25 are sold with a managed detection service aimed at smaller companies and 6 only with an enterprise-priced one.[1] Buy the EDR you can afford to have watched, not the one that scored best. ## India: 10 of 36 document a region, 23 do not say Endpoint telemetry is a log of everything a user runs, so where it lands matters under the CERT-In Directions and, from May 2027, the DPDP Rules. Ten SKUs document an Indian data region: Elastic Defend, SentinelOne Singularity Endpoint, both Sophos tiers, the four Seqrite SKUs, Acronis Cyber Protect and Scalefusion Veltar.[1] Those ten come from six vendors. Two CrowdStrike SKUs carry an Indian cloud announced in January 2026 that TechBag could not find documented as live by September 2026.[1] [8] One documents hosting outside India with no Indian option, and 23 say nothing we could verify either way. **Figure: Only 10 of 36 endpoint SKUs document an Indian data region; 23 do not say** *India data-region tag, 36 endpoint SKUs, vendor documentation checked August 2026* - Indian region documented (6 vendors)10 SKUs 28% - Unverified23 SKUs 64% - Announced, not documented live (CrowdStrike)2 SKUs 6% - No Indian region1 SKUs 3% | | Value (SKUs) | Share | | --- | --- | --- | | Indian region documented (6 vendors) | 10 | 28% | | Unverified | 23 | 64% | | Announced, not documented live (CrowdStrike) | 2 | 6% | | No Indian region | 1 | 3% | Source: TechBag Endpoint Protection guide, india tag; CrowdStrike regional-clouds announcement · as of 30 September 2026 · Announced is CrowdStrike's planned Indian cloud; unverified is no vendor document found either way The unverified column is the finding. More than half the category does not publish where an Indian customer’s telemetry is processed, and a buyer who does not ask will not be told. The question costs nothing in an RFP and it eliminates vendors faster than any feature grid: “Name the region, and put it in the order form.” ## The 2022 shortlist, four years on We recommended Palo Alto Networks, Trend Micro Apex One, Kaspersky EDR, Symantec Endpoint Security and CrowdStrike Falcon. Here is where each stands as of September 2026, from the vendors’ own pages and TechBag’s intel pages. **Figure: Of the five 2022 picks, three still print a list price, two are quote-only, and one is barred from new US sales** *The February 2022 shortlist against each vendor's documented standing, September 2026* As pitched in February 2022 - Palo Alto Networks: highest independent test scores - Trend Micro Apex One: a lot of value at a low price - Kaspersky EDR: second-lowest price, everything included - Symantec Endpoint Security: a market leader in EDR - CrowdStrike Falcon: unmatched detection Documented standing, September 2026 - Cortex XDR: quote-only through partners; no published list - Trend Vision One: published US$2.25 to US$14.92 an endpoint a month; Apex One on-prem still sold - Kaspersky: new US sales prohibited from 20 July 2024; legal in India; Next from €287.50 per 5 users - Symantec (Broadcom): quote-only through partners; no Indian region documented for the cloud console - CrowdStrike: US$59.99 to US$184.99 published; 19 July 2024 faulty update crashed about 8.5 million Windows machines; Indian cloud announced Source: TechBag vendor hubs and product pages; Broadcom; US Bureau of Industry and Security; CrowdStrike · as of 30 September 2026 Two of the five changed character rather than quality. Symantec’s enterprise business has been inside Broadcom since 2019 and is now sold by quote through partners, with no list price and no Indian region documented for the cloud console.[9] Palo Alto’s endpoint product is Cortex XDR, also quote-only, and it is sold as the on-ramp to Cortex XSIAM rather than as a standalone agent.[10] Kaspersky’s products remain legal and widely sold in India, but the US Commerce Department prohibited new sales and updates to US customers from 20 July and 29 September 2024, which matters if your company has US subsidiaries or US customers who audit your tooling.[6] ReportedThe 19 July 2024 outage, as reported A faulty Falcon sensor content update crashed Windows machines worldwide, disrupting airlines, banks and hospitals; Microsoft estimated about 8.5 million devices, under 1% of all Windows machines. CrowdStrike reported a content-validation bug, not a breach, and protection was not compromised.[16] [7] It remains the best argument for staged rollouts of the security agent itself, and for asking every vendor how it rings its own updates. What the 2022 list got right was the instinct to compare. What it got wrong was comparing adjectives. The three questions that actually separate these products, rollback, published price and documented region, were answerable then and are counted now. If you are buying this in India The US-list products are invoiced in rupees through a reseller. At the ₹83 to the dollar that TechBag’s guides use, the prevention band is roughly ₹3,000 to ₹5,000 a device a year and the third-party EDR bundles about ₹15,000, each plus 18% GST on the invoice.[1] The INR-native alternative is Seqrite: Endpoint Protection from ₹799 an endpoint a year on partner lists, with a reseller listing of ₹950 for the SME tier, ₹1,250 for Business and ₹2,550 for the Enterprise Suite, GST not stated; it is India-hosted and restores from backup rather than from the agent.[1] [11] Acronis Cyber Protect with EDR is listed by Indian resellers at about ₹3,500 a workload a month with a Mumbai data centre.[1] TechBag is an authorised partner of CrowdStrike and Sophos, two vendors named here; weigh the price sections with that in mind. Three obligations set the floor. The **CERT-In Directions of 28 April 2022** require reportable incidents to reach CERT-In within six hours and ICT logs to be kept for 180 days within Indian jurisdiction, which is why the data-region question above is not optional.[12] The **DPDP Rules**, notified on 13 November 2025, bring the security-safeguard and breach-intimation duties into force on 13 May 2027; the 2023 Act’s schedule sets penalties of up to ₹250 crore for failing to keep reasonable security safeguards.[13] [14] Banks also answer to the **RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026**, which require vendor contracts with audit and inspection rights, so the endpoint vendor’s order form needs those clauses too.[15] How we did this Figures as of 30 September 2026 All counts are TechBag’s, from the 36 product rows on the Endpoint Protection decision guide. Each row’s capability tags (depth, rollback, Linux, mobile, on-premises console, India region, published price, managed service) were set from vendor documentation on 22 August 2026; a tag TechBag could not verify is “unverified” and is reported as such, never as a no. Prices are the vendor’s published list where one exists (CrowdStrike and SentinelOne pages as published at review; Microsoft, ESET, Bitdefender and Trend Micro as recorded on TechBag’s Endpoint Protection guide) and are converted at ₹83 to the dollar only for the rupee bands in the India section. The 2022 shortlist’s standing is taken from TechBag’s vendor hubs, Broadcom’s product page, the US Bureau of Industry and Security notice and CrowdStrike’s own incident reporting. Independent test results are not used here; they are covered in the Seqrite against Kaspersky and MITRE 2025 pieces linked below. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Endpoint Protection decision guide: 36 product rows with depth, rollback, Linux, India-region, published-price and managed-service tags](https://www.thetechbag.com/browse/security/endpoint-protection) — capability check 22 August 2026 2. [CrowdStrike, Falcon bundles and pricing (Go US$59.99, Pro US$99.99, Enterprise US$184.99 per device per year)](https://www.crowdstrike.com/en-us/products/bundles/) — undated page 3. [SentinelOne, Singularity platform packages (Complete US$179.99, Commercial US$229.99 per endpoint per year, 5 to 100 workstations)](https://www.sentinelone.com/platform-packages/) — undated page 4. [Microsoft, Defender for Endpoint plans (P1 US$3, P2 US$5.20 per user per month standalone), as recorded on TechBag's Defender for Endpoint page](https://www.thetechbag.com/microsoft/microsoft-defender-for-endpoint) — mid-2026 5. [TechBag, Trend Vision One Endpoint Security page (Essentials US$2.25 to Advanced US$14.92 per endpoint per month)](https://www.thetechbag.com/trendmicro/trendmicro-endpoint-security) — mid-2026 6. [US Bureau of Industry and Security, Kaspersky Lab, Inc. prohibition (new sales from 20 July 2024; updates from 29 September 2024)](https://www.bis.gov/kaspersky) — 2024 7. [TechBag, CrowdStrike vendor hub (19 July 2024 faulty content update; content-validation bug, not a breach), citing CrowdStrike's remediation and guidance hub](https://www.thetechbag.com/crowdstrike) — mid-2026 CrowdStrike's own hub: crowdstrike.com/falcon-content-update-remediation-and-guidance-hub. 8. [CrowdStrike, CrowdStrike Announces New Regional Clouds to Expand Secure Data Sovereignty (Saudi Arabia, India, UAE; planned)](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-announces-new-regional-clouds-expand-secure-data) — January 2026 9. [Broadcom, Symantec Endpoint Security product page (no list price published; no Indian cloud region documented)](https://www.broadcom.com/products/cybersecurity/endpoint/end-user) — undated page 10. [TechBag, Palo Alto Networks Cortex XDR page: quoted, sold toward Cortex XSIAM](https://www.thetechbag.com/palo-alto/cortex-xdr) — mid-2026 11. [Techjockey, Seqrite EPS for Business listing (SME ₹950, Business ₹1,250, Enterprise Suite ₹2,550, one year; GST not stated)](https://www.techjockey.com/detail/seqrite-eps-for-business) — undated page 12. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; 180-day logs within Indian jurisdiction)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 13. [DPDP Rules 2025, commencement timeline (notified 13 November 2025; safeguard and breach duties from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — 13 November 2025 14. [Digital Personal Data Protection Act, 2023, Schedule (penalties up to ₹250 crore)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 15. [RBI, Commercial Banks – Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. 16. [Microsoft, Helping our customers through the CrowdStrike outage (about 8.5 million Windows devices, less than 1% of all Windows machines)](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/) — 20 July 2024 Related on TechBag: the [Endpoint Protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) holds the 36 rows counted here; the [Seqrite against Kaspersky](https://www.thetechbag.com/blog/seqrite-vs-kaspersky-endpoint-india) piece covers the lab results, and [the MITRE 2025 piece](https://www.thetechbag.com/blog/ai-endpoint-security-what-mitre-2025-measured) covers who sat the test; the [SentinelOne hub](https://www.thetechbag.com/sentinelone) and [Seqrite hub](https://www.thetechbag.com/seqrite) are the two India-region options at either end of the price band. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Endpoint protection decision guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the 36 SKUs counted here, with rollback, price and India-region tags - [SentinelOne vendor hub](https://www.thetechbag.com/sentinelone) — file rollback, a published partner list and the Mumbai region - [Seqrite vendor hub](https://www.thetechbag.com/seqrite) — the INR-native, India-hosted option at the low end of the price band