--- title: "Of 38 security vendors, none is shortlisted in all five endpoint layers" summary: "How the 38 vendors in TechBag's endpoint, email, DLP, DNS and firewall guides spread across those layers, and which pairs buy well together, as of September 2026." url: https://www.thetechbag.com/blog/comprehensive-endpoint-security-solutions-securing-every-layer format: Analysis desk: "Endpoints & devices" published: 2026-07-08 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["endpoint security","EDR","XDR","DLP","email security","DNS security","firewall","vendor consolidation","Sophos","Fortinet","CERT-In"] cover: https://www.thetechbag.com/blog/covers/comprehensive-endpoint-security-solutions-securing-every-layer.png --- # Of 38 security vendors, none is shortlisted in all five endpoint layers *How the 38 vendors in TechBag's endpoint, email, DLP, DNS and firewall guides spread across those layers, and which pairs buy well together, as of September 2026.* Analysis · Endpoints & devices · By TechBag · Published 2026-07-08 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/comprehensive-endpoint-security-solutions-securing-every-layer The short version - Across TechBag’s five layer guides (endpoint, email, DLP, DNS and web, firewall) we counted 38 vendors. None is shortlisted in all five; Sophos and Fortinet reach four; 20 appear in one layer only.[1] - The layers come in pairs. Endpoint with email (seven vendors) and firewall with DNS filtering (five) are the bundles the market actually sells; DLP pairs mostly with email. - Our view: plan for two or three vendors, not one. Consolidate where a pair exists, and do not buy a weak sixth layer to complete a console. Our 2024 version of this piece argued that comprehensive endpoint security means six layers: EDR, XDR, data loss prevention, email security, DNS security and a firewall. It was right about the layers and silent on the question a buyer asks next. Can one vendor supply all of them, and if not, how many contracts does a layered stack take? A single vendor means one console, one agent and one renewal; several mean the best product in each layer and the work of stitching them together. We counted the answer from the guides TechBag maintains for each layer, as they stood on 30 September 2026. ## Nobody is shortlisted in all five layers TechBag keeps a decision guide for each layer the 2024 piece named; EDR and XDR share one, the endpoint protection guide, because vendors sell them as tiers of the same agent. The five guides list 38 distinct vendors.[1][2][3][4][5] Not one appears in all five. Two, Sophos and Fortinet, appear in four, and neither is in the DLP guide. Four more reach three layers: Check Point, Cisco, Barracuda and Coro. 0 of 38 vendors shortlisted in all five of TechBag's layer guides Sophos and Fortinet reach four; 20 vendors appear in one layer only. **Figure: Only Sophos and Fortinet are shortlisted in four of the five layers; most vendors that span layers stop at two** *Number of TechBag layer guides listing each vendor, of 5, vendors listed in two or more, September 2026* Sophos no DLP 4 Fortinet no DLP 4 Check Point 3 Cisco 3 Barracuda 3 Coro 3 CrowdStrike 2 Bitdefender 2 Trend Micro 2 Kaspersky 2 Seqrite 2 Proofpoint 2 Mimecast 2 Forcepoint 2 Cloudflare 2 Zscaler 2 Netskope 2 Palo Alto Networks 2 | | Value | | --- | --- | | Sophos | 4 | | Fortinet | 4 | | Check Point | 3 | | Cisco | 3 | | Barracuda | 3 | | Coro | 3 | | CrowdStrike | 2 | | Bitdefender | 2 | | Trend Micro | 2 | | Kaspersky | 2 | | Seqrite | 2 | | Proofpoint | 2 | | Mimecast | 2 | | Forcepoint | 2 | | Cloudflare | 2 | | Zscaler | 2 | | Netskope | 2 | | Palo Alto Networks | 2 | Source: TechBag endpoint protection, email security, DLP & insider risk, secure web & DNS, and firewall guides, TechBag count · as of 30 September 2026 TechBag countHow TechBag counted A vendor counts in a layer when the guide lists at least one of its products, as committed on 30 September 2026. The guides are shortlists of products a buyer would evaluate on their own, not catalogues of everything a vendor sells, so the count measures where a vendor is competitive enough to shortlist, not where it has a SKU. That caveat matters most for Microsoft, which appears in the endpoint guide only. Its licences carry more: Defender for Office 365 Plan 1 sits in Business Premium and, from 1 July 2026, in E3, with Plan 2 in E5,[2] and Purview supplies DLP, with the advanced classifiers on E5 or a US$12 add-on over E3.[6] A Microsoft 365 estate already owns three of the five layers as features. The evidence against our headline is real; a licence that contains a layer is not the same as a product that wins it on a shortlist, and our guides record the second. ## Endpoint is crowded; DNS filtering belongs to network vendors The layers differ in shape. The endpoint guide lists 20 vendors, and half of them sell nothing else the other four guides list: SentinelOne, ESET, Elastic, Microsoft and Acronis among them. The DNS and web guide lists eight vendors, and every one of them also appears in another layer, mostly the firewall. DNS filtering has stopped being a product category of its own; it is a subscription on the network vendor’s edge.[1][4] **Figure: Half the endpoint vendors are specialists; every DNS vendor also sells another layer** *Vendors listed in each TechBag layer guide, split by whether they appear in that layer only, count, September 2026* Endpoint 10 10 20 vendors Email 12 14 vendors DLP 6 8 14 vendors DNS & web 8 8 vendors Firewall 6 8 vendors | | This layer only | Also in another layer | | --- | --- | --- | | Endpoint | 10 | 10 | | Email | 2 | 12 | | DLP | 6 | 8 | | DNS & web | 0 | 8 | | Firewall | 2 | 6 | Source: TechBag layer guides, TechBag count · as of 30 September 2026 The endpoint specialists are not all single-product companies, though. They bundle sideways, into layers the 2024 piece did not count. The guide records NinjaOne, Hexnode and Scalefusion selling their agents beside a device-management or remote-monitoring console, Acronis beside backup, and Microsoft inside the Microsoft 365 licence, while SentinelOne and CrowdStrike are the agents other consoles integrate with.[1] For many Indian mid-market buyers the real consolidation choice is endpoint security with endpoint management, not endpoint with firewall, and our layer count does not show it because device management has its own guide. DLP is the other specialist layer. Six of its fourteen vendors appear in no other layer guide: Varonis, Trellix, Safetica, Cyera, and two of the three DLP vendors built in India, Data Resolve and Seclore. The third, Seqrite, sells it beside its endpoint agent.[3] That is why neither four-layer vendor reaches five: the data layer is bought from people who sell data controls, not from people who sell agents or boxes. ## The layers that come in pairs If one vendor cannot supply the stack, the useful question is which two layers buy well together. We counted every pair of layers that the same vendor is shortlisted in. Endpoint with email leads, at seven vendors: Sophos, Fortinet, Check Point, Bitdefender, Trend Micro, Kaspersky and Coro. Firewall with DNS and web filtering follows at five: Sophos, Fortinet, Cisco, Barracuda and Palo Alto Networks.[1] **Figure: Endpoint with email and firewall with DNS are the two bundles the market sells** *Vendors shortlisted in both layers of each pair, count, across TechBag's five layer guides, September 2026* Endpoint + email 7 Firewall + DNS & web 5 Email + DLP 4 Email + firewall 4 Email + DNS & web 4 Endpoint + firewall 4 Endpoint + DLP 3 Endpoint + DNS & web 3 DLP + DNS & web 2 | | Value | | --- | --- | | Endpoint + email | 7 | | Firewall + DNS & web | 5 | | Email + DLP | 4 | | Email + firewall | 4 | | Email + DNS & web | 4 | | Endpoint + firewall | 4 | | Endpoint + DLP | 3 | | Endpoint + DNS & web | 3 | | DLP + DNS & web | 2 | Source: TechBag layer guides, TechBag count · as of 30 September 2026 The pairs follow the data. An endpoint agent and an email filter see the two halves of the most common intrusion, the message and the process it launched, and correlating them is most of what XDR is sold on; nine of the endpoint guide’s SKUs carry XDR in the name.[1] A firewall and a DNS filter enforce policy at the same edge. Email with DLP is the third pair, from Proofpoint, Mimecast, Forcepoint and Coro, because outbound mail is the oldest exit for data.[3] Our view Our view: for a mid-sized Indian company the honest stack is three contracts. An endpoint-and-email suite, a firewall-and-DNS network vendor, and DLP chosen for where your data actually leaves. Two of those can be one vendor if it is genuinely strong in both; a vendor that is weak in one layer is not worth a single console. ## Why layers at all: one intrusion crosses four of them The case for layering is mechanical, not a slogan. A common intrusion passes through four of the five layers in order, and each layer sees one step. MITRE ATT&CK, the public catalogue of attacker techniques, names each step.[7][8][9][10] **Figure: Each layer sees one step of the same intrusion; none sees all four** *A phishing-led intrusion mapped to MITRE ATT&CK techniques and the layer placed to stop each step* 1. 01Phishing (T1566)A message carries a link or attachment. The email layer sees it first, and is the only layer that sees the sender. 2. 02User execution (T1204)Someone opens it and a process starts. The endpoint agent sees the process tree; EDR can kill and roll it back. 3. 03DNS command channel (T1071.004)The implant calls home through DNS lookups. The DNS filter sees the domain; the firewall sees the traffic. 4. 04Exfiltration over a web service (T1567)Data leaves for a cloud drive. DLP sees what is in the file; the firewall sees only the destination. Source: MITRE ATT&CK Enterprise techniques T1566, T1204, T1071.004 and T1567; TechBag mapping · as of 30 September 2026 The 2024 piece named two vendors per layer. Nine of those twelve still appear in at least one of the five guides; Symantec, McAfee and Akamai do not.[1][3][4] The list was not wrong so much as incomplete: it named products by layer and left the reader to discover that the layers are bought from different companies. The diagram also shows why a single-vendor stack is tempting. When the email filter, the agent and the DNS filter come from one company, the four steps arrive in one console already joined; from three companies, someone has to join them, either a SIEM or a managed service. That joining work is the real price of best-of-breed, and it belongs in the comparison next to the licence lines. If you are buying this in India Seqrite is the one endpoint vendor in the guide whose own list is in rupees: Endpoint Protection on-premises from ₹799 per endpoint a year, with its EDR and XDR tiers quoted.[1] The rest are US dollar lists or quotes, invoiced in INR through a reseller with 18% GST on top. Where the data sits differs by layer: in the endpoint guide, SentinelOne and Sophos Central document Mumbai hosting, Seqrite offers Indian data centres and on-premises, and CrowdStrike announced an Indian cloud in January 2026 that the guide records as announced, not live.[1] Ask for the region of each layer in writing; a three-vendor stack has three answers. The regulation counts per incident, not per vendor. CERT-In’s Directions of 28 April 2022 require a reportable incident to reach CERT-In within six hours and ICT system logs to be kept for 180 days within India, which in a layered stack means the email, endpoint, DNS and firewall logs together.[11] The DPDP Rules, notified on 13 November 2025, bring the reasonable-security-safeguard and breach-intimation duties into force on 13 May 2027.[12] How we did this Figures as of 30 September 2026 Vendor lists come from five TechBag decision guides as committed on 30 September 2026, read from that commit rather than today’s pages: endpoint protection (36 products, 20 vendors), email security (22 products, 14 vendors), DLP and insider risk (18 products, 14 vendors), secure web and DNS (8 vendors) and firewall and network security (8 vendors). Records in those guides were verified against vendor documents on 22 August 2026. A vendor counts once per guide however many products it has there. Pairs count vendors listed in both guides of the pair. Managed detection and response, SASE and cloud workload guides were excluded because the 2024 piece did not name those layers. The ATT&CK mapping is TechBag’s illustration of one common sequence, not a statistic. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Endpoint protection decision guide (EPP, EDR and XDR; prices, India residency)](https://www.thetechbag.com/browse/security/endpoint-protection) — as committed 30 September 2026; records verified 22 August 2026 2. [TechBag, Email security decision guide (including what Microsoft 365 already filters)](https://www.thetechbag.com/browse/security/email-security) — as committed 30 September 2026; records verified 22 August 2026 3. [TechBag, DLP & insider risk decision guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — as committed 30 September 2026 4. [TechBag, Secure web & DNS decision guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns) — as committed 30 September 2026; records verified 22 August 2026 5. [TechBag, Firewall & network security decision guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security) — as committed 30 September 2026; records verified 22 August 2026 6. [TechBag, Microsoft Purview intel page (E5 classifiers; US$12 add-on over E3)](https://www.thetechbag.com/microsoft/microsoft-purview) — as committed 30 September 2026 7. [MITRE ATT&CK, T1566 Phishing](https://attack.mitre.org/techniques/T1566/) — technique page, undated 8. [MITRE ATT&CK, T1204 User Execution](https://attack.mitre.org/techniques/T1204/) — technique page, undated 9. [MITRE ATT&CK, T1071.004 Application Layer Protocol: DNS](https://attack.mitre.org/techniques/T1071/004/) — technique page, undated 10. [MITRE ATT&CK, T1567 Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567/) — technique page, undated 11. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 12. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025 Related on TechBag: the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) carries the prices and residency for every agent counted here, and [our endpoint shortlist piece](https://www.thetechbag.com/blog/challenges-solutions-endpoint-security-organization) tests them on ransomware rollback. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Endpoint protection guide (EPP, EDR, XDR)](https://www.thetechbag.com/browse/security/endpoint-protection) — 20 vendors' agents with prices and India residency - [Secure web & DNS guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns) — DNS and web filtering, every one sold by a network vendor - [Sophos vendor hub](https://www.thetechbag.com/sophos) — one of two vendors shortlisted in four of the five layers