Of 38 security vendors, none is shortlisted in all five endpoint layers

01Nobody is shortlisted in all five layers

TechBag keeps a decision guide for each layer the 2024 piece named; EDR and XDR share one, the endpoint protection guide, because vendors sell them as tiers of the same agent. The five guides list 38 distinct vendors.¹²³⁴⁵ Not one appears in all five. Two, Sophos and Fortinet, appear in four, and neither is in the DLP guide. Four more reach three layers: Check Point, Cisco, Barracuda and Coro.

That caveat matters most for Microsoft, which appears in the endpoint guide only. Its licences carry more: Defender for Office 365 Plan 1 sits in Business Premium and, from 1 July 2026, in E3, with Plan 2 in E5,² and Purview supplies DLP, with the advanced classifiers on E5 or a US$12 add-on over E3.⁶ A Microsoft 365 estate already owns three of the five layers as features. The evidence against our headline is real; a licence that contains a layer is not the same as a product that wins it on a shortlist, and our guides record the second.

02Endpoint is crowded; DNS filtering belongs to network vendors

The layers differ in shape. The endpoint guide lists 20 vendors, and half of them sell nothing else the other four guides list: SentinelOne, ESET, Elastic, Microsoft and Acronis among them. The DNS and web guide lists eight vendors, and every one of them also appears in another layer, mostly the firewall. DNS filtering has stopped being a product category of its own; it is a subscription on the network vendor’s edge.¹⁴

The endpoint specialists are not all single-product companies, though. They bundle sideways, into layers the 2024 piece did not count. The guide records NinjaOne, Hexnode and Scalefusion selling their agents beside a device-management or remote-monitoring console, Acronis beside backup, and Microsoft inside the Microsoft 365 licence, while SentinelOne and CrowdStrike are the agents other consoles integrate with.¹ For many Indian mid-market buyers the real consolidation choice is endpoint security with endpoint management, not endpoint with firewall, and our layer count does not show it because device management has its own guide.

DLP is the other specialist layer. Six of its fourteen vendors appear in no other layer guide: Varonis, Trellix, Safetica, Cyera, and two of the three DLP vendors built in India, Data Resolve and Seclore. The third, Seqrite, sells it beside its endpoint agent.³ That is why neither four-layer vendor reaches five: the data layer is bought from people who sell data controls, not from people who sell agents or boxes.

03The layers that come in pairs

If one vendor cannot supply the stack, the useful question is which two layers buy well together. We counted every pair of layers that the same vendor is shortlisted in. Endpoint with email leads, at seven vendors: Sophos, Fortinet, Check Point, Bitdefender, Trend Micro, Kaspersky and Coro. Firewall with DNS and web filtering follows at five: Sophos, Fortinet, Cisco, Barracuda and Palo Alto Networks.¹

The pairs follow the data. An endpoint agent and an email filter see the two halves of the most common intrusion, the message and the process it launched, and correlating them is most of what XDR is sold on; nine of the endpoint guide’s SKUs carry XDR in the name.¹ A firewall and a DNS filter enforce policy at the same edge. Email with DLP is the third pair, from Proofpoint, Mimecast, Forcepoint and Coro, because outbound mail is the oldest exit for data.³

04Why layers at all: one intrusion crosses four of them

The case for layering is mechanical, not a slogan. A common intrusion passes through four of the five layers in order, and each layer sees one step. MITRE ATT&CK, the public catalogue of attacker techniques, names each step.⁷⁸⁹¹⁰

The 2024 piece named two vendors per layer. Nine of those twelve still appear in at least one of the five guides; Symantec, McAfee and Akamai do not.¹³⁴ The list was not wrong so much as incomplete: it named products by layer and left the reader to discover that the layers are bought from different companies.

The diagram also shows why a single-vendor stack is tempting. When the email filter, the agent and the DNS filter come from one company, the four steps arrive in one console already joined; from three companies, someone has to join them, either a SIEM or a managed service. That joining work is the real price of best-of-breed, and it belongs in the comparison next to the licence lines.