# EPP and EDR answer different questions. Most buyers purchase one believing they bought both.

*Endpoint Protection — a TechBag decision guide. Last reviewed 2026-10-03.*

> Prevention stops what it recognises. Detection and response records what got through so a person can find it and act — and without that person, the EDR console is the most expensive dashboard nobody opens.

**The checkable fact:** Microsoft 365 E3 includes Defender for Endpoint Plan 1 — prevention only. The EDR is Plan 2, and that is in E5. Check the SKU before assuming you own detection.

- Canonical: https://www.thetechbag.com/browse/security/endpoint-protection
- Category: [Security](https://www.thetechbag.com/browse/security)
- Products compared: 47

## What endpoint protection actually is

An agent on every laptop, desktop, server and (usually) phone that does two jobs. The first is **prevention**: block known malware, exploit techniques and ransomware behaviour before they run — the antivirus lineage, now machine-learning and behaviour-based. The second is **detection and response**: record process, file, network and identity events continuously, raise what looks wrong, and give a person the tools to investigate and act — isolate the machine, kill the process, roll files back, hunt across the estate.

The first job runs itself. The second does not — it produces alerts, and alerts need someone with time and skill to read them. That is why every vendor on this page also sells **people**: a managed detection and response service that runs the console for you (its own guide is [here](https://www.thetechbag.com/browse/security/managed-detection-response)). Whether you need the second job, and who will do it, decides this purchase more than any detection-rate chart.

**The most common mis-purchase.** EDR without someone to triage it is **shelfware with a licence fee**. If nobody on your side will open the console daily, buy the managed tier or stay with prevention — and say so in the evaluation, because the vendor’s demo will not.

## EPP · EDR · XDR — and why they aren’t a quality ladder

Three letters that every vendor sells as tiers. They are not better-worse; they are narrower-wider. Each one widens the scope of what is recorded — and each widening costs more and needs more people to read what it records.

### EPP — Endpoint Protection Platform

Prevention at the endpoint: block known malware, exploit techniques and ransomware behaviour before they run. The console is for policy and reporting; it runs itself. Every vendor's entry tier. Broad enough for many estates under ~300 seats that accept nothing is hunting.

### EDR — Endpoint Detection & Response

Continuous recording of process, file, network and identity events on the endpoint, alerts on what looks wrong, and a console to investigate, isolate, kill, hunt — and at some vendors roll files back. It produces work for a person every day. Not 'better EPP'; a different job that assumes EPP missed something.

### XDR — Extended Detection & Response

EDR's recording joined with email, identity, cloud and network signals so one incident is one story. Wider scope again — more to see, more to staff, and worth it only when those other sources exist and someone correlates them. Platform vendors sell it as the reason to buy everything from them.

**These are widening scopes, not tiers of quality.** A good EPP is not a worse EDR; an XDR is not the best EPP. Broader records more, costs more, and needs more people to run it. Buy the scope someone on your side will operate — and if that is nobody, the next guide (MDR) is the one you need.

## The decision variables

Seven variables decide this purchase — the instrument tests the ones documentation can verify; the rest are prose because the honest answer depends on your team.

**Prevention depth vs detection-and-response depth.** Which job you are buying — the entry tier blocks, the higher tier records and lets a person respond. Every vendor sells both; the price gap is the second job.

**Who operates it.** The honest cut. An EDR with no one to triage it is shelfware — so the chip asks whether the vendor sells the people too, and whether that managed tier is priced for you or enterprise-gated.

**Agent coexistence.** What is already on the machine: UEM, RMM, backup, an old AV. One real-time engine per machine; Windows steps Defender aside automatically; two third-party engines do not coexist.

**Rollback and remediation.** Four mechanisms and one absence — protected-copy restore, agent-level rollback, containment, restore-from-backup, or isolate-and-kill only. Know which you bought before the first incident.

**Managed option availability.** Whether the vendor's own 24/7 service exists for this SKU, what it covers, and what it costs — the MDR guide takes it from here.

**Platform bundling vs best-of-breed.** One suite (Microsoft, Sophos, Trend, Kaspersky, Bitdefender, ESET) or the best agent most consoles integrate (CrowdStrike, SentinelOne) — and the UEM / RMM / backup vendors selling security inside their console. Convenience versus depth; the card's limitation tells you the price.

**India data residency.** Documented for SentinelOne and Sophos (Mumbai), Seqrite, Acronis, Scalefusion; announced for CrowdStrike; unknown for most. The instrument never eliminates on 'unknown' — it flags and you ask in writing.

## The 47 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Elastic Defend — Elastic

- **Who it's for:** Estates already running Elastic Security: the SAME Elastic Agent that ships your logs enforces endpoint protection, so there is no second agent to deploy or upgrade — and it runs on-premises or air-gapped, which most EPP consoles cannot.
- **The honest limitation:** It is the endpoint half of a platform, not a standalone EPP you would buy against CrowdStrike or SentinelOne on their own terms: no dedicated mobile console, no automated ransomware rollback, and no managed-detection service of its own.
- **Price:** Free → tier — included in Elastic Security rather than sold as a standalone endpoint SKU — on Serverless with no per-endpoint fee since 23 March 2026; self-managed or Cloud Hosted, Basic gives malware prevention only, and ransomware, memory and behaviour protection and host isolation need Platinum or Enterprise
- **Details:** https://www.thetechbag.com/elastic/elastic-security

### CrowdStrike Falcon Prevent (Go / Pro) — CrowdStrike

- **Who it's for:** Teams that want CrowdStrike's prevention agent today and a path to Insight EDR tomorrow without a second install.
- **The honest limitation:** Prevention only — no timeline, hunting or response until you add Insight; no file rollback; India in-country cloud is announced, not yet documented live.
- **Price:** $59.99–99.99 (≈ ₹4,979) — per device / year — Falcon Go (prevention) · Pro; the reference cloud-native agent
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-prevent

### CrowdStrike Falcon Insight XDR — CrowdStrike

- **Who it's for:** Security teams that will hunt — the reference EDR telemetry, forensic timeline and Real Time Response.
- **The honest limitation:** An EDR that needs operators: no automatic file rollback, Falcon Complete (managed) is enterprise-priced on quote, and the bundle is the cloud-only Falcon platform.
- **Price:** $184.99 (≈ ₹15,354) — per device / year (Falcon Enterprise bundle with Prevent); Falcon Complete MDR on quote
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-insight-xdr

### SentinelOne Singularity Endpoint — SentinelOne

- **Who it's for:** Autonomous prevention-to-response on one agent with documented one-click rollback and an India data region.
- **The honest limitation:** Enterprise is quote-only and street price varies by partner; no on-prem console; mobile is a paid Singularity Mobile add-on.
- **Price:** $179.99–229.99 (≈ ₹14,939) — per endpoint / year list for 5–100 workstations, bought through a partner (Complete $179.99 · Commercial $229.99); Enterprise on quote; Core and Control no longer priced publicly; MDR an add-on; Mumbai region
- **Details:** https://www.thetechbag.com/sentinelone/sentinelone-singularity-endpoint

### Microsoft Defender for Endpoint P1 / P2 — Microsoft

- **Who it's for:** Microsoft 365 estates — the EPP/EDR you may already hold, with the tightest Intune and Entra integration there is.
- **The honest limitation:** E3 carries only P1 (no EDR); file rollback is OneDrive Files Restore, not the agent; Defender Experts (managed) needs E5 and a quote; the console assumes a Microsoft estate.
- **Price:** $3 / $5.20 (≈ ₹249) — per user / month standalone (P1 prevention / P2 EDR); $0 marginal when bundled
- **Details:** https://www.thetechbag.com/microsoft/microsoft-defender-for-endpoint

### Sophos Intercept X Advanced — Sophos

- **Who it's for:** Prevention with CryptoGuard file rollback for teams that want Sophos MDR to be the default operating model later.
- **The honest limitation:** The Advanced SKU is prevention — detection and response is the separate 'with XDR' tier; no published list; CryptoGuard rollback needs ~3 GB free disk.
- **Price:** Quote — per user / year, reseller-reported from ~$66 at 1–9 users down to ~$25 at 5,000+; Sophos Central; Mumbai region
- **Details:** https://www.thetechbag.com/sophos/sophos-intercept-x

### Sophos Intercept X Advanced with XDR — Sophos

- **Who it's for:** Teams that want EDR/XDR on the Sophos agent with the MDR tier one step away.
- **The honest limitation:** Estimates only — no published list; XDR breadth across email / firewall / cloud is a Sophos-estate story; no on-prem console.
- **Price:** Quote — per user / year (reported ~$48); adds XDR data lake, cross-product detections; Mumbai region
- **Details:** https://www.thetechbag.com/sophos/sophos-xdr

### Bitdefender GravityZone Business Security — Bitdefender

- **Who it's for:** Price-sensitive mixed fleets wanting published per-device prevention with Ransomware Mitigation and an on-prem console option.
- **The honest limitation:** Prevention tier — EDR is the Premium SKU; first-year promotional pricing renews at standard rates (users report 2–3×); India cloud region not documented.
- **Price:** $57–74 (≈ ₹4,731) — per device / year — Small Business · Business Security (EPP); Premium adds automated detection and response actions, full EDR is in Enterprise
- **Details:** https://www.thetechbag.com/bitdefender/bitdefender-business-security

### Bitdefender GravityZone EDR / XDR (Premium · Enterprise) — Bitdefender

- **Who it's for:** Bitdefender prevention plus a real EDR tier, with MDR available from the same vendor.
- **The honest limitation:** XDR and Enterprise are quote-only; the published Premium price is first-year promotional; India region not documented.
- **Price:** ~$95.89 (≈ ₹7,959) — per device / year for Business Security Premium as reported by a pricing site (Bitdefender’s calculator shows none); full EDR with cross-endpoint search is in Business Security Enterprise, on quote with XDR
- **Details:** https://www.thetechbag.com/bitdefender/bitdefender-edr-xdr

### Bitdefender GravityZone PHASR — Bitdefender

- **Who it's for:** GravityZone estates that want the attack surface tailored per user before prevention ever has to fire.
- **The honest limitation:** An add-on, not standalone protection — it hardens, it does not detect or roll back; quote-only.
- **Price:** Quote — add-on to GravityZone — proactive hardening and attack-surface reduction per user behaviour
- **Details:** https://www.thetechbag.com/bitdefender/bitdefender-phasr

### ESET PROTECT Entry — ESET

- **Who it's for:** Lean teams wanting a light agent, published pricing, on-prem or cloud console and Ransomware Remediation.
- **The honest limitation:** Prevention only — no EDR (Elite), no mobile (Advanced+), no sandbox; ESET MDR is a separate quote.
- **Price:** $42.20 (≈ ₹3,503) — per device / year (5-device packs); endpoint + file-server protection
- **Details:** https://www.thetechbag.com/eset/eset-protect-entry

### ESET PROTECT Advanced — ESET

- **Who it's for:** ESET Entry plus sandboxing, encryption and phones in the same console.
- **The honest limitation:** Still prevention — EDR arrives only at Elite (quote, 25-device minimum); India cloud region not documented.
- **Price:** $55 (≈ ₹4,565) — per device / year; adds cloud sandbox, full-disk encryption, Mobile Threat Defense
- **Details:** https://www.thetechbag.com/eset/eset-protect-advanced

### ESET PROTECT Complete — ESET

- **Who it's for:** One ESET console for endpoint, mail and patching in a small estate.
- **The honest limitation:** Breadth without EDR — detection and response is the Elite tier; the M365 / Workspace protection is email filtering, not an EDR for mail.
- **Price:** $57.54 (≈ ₹4,776) — per device / year after ESET’s 15% online discount ($336.50 for 5 devices, ~$67.30 each, undiscounted; reported April 2026); adds Microsoft 365 / Google Workspace protection, mail server, vulnerability & patch
- **Details:** https://www.thetechbag.com/eset/eset-protect-complete

### ESET PROTECT Elite (ESET Inspect XDR) — ESET

- **Who it's for:** ESET estates that outgrew prevention and want the XDR tier and ESET MDR on the same agent.
- **The honest limitation:** Quote-only with a 25-device minimum; ESET Inspect is an operator's console — budget the analyst or the MDR.
- **Price:** Quote — per device / year, 25-device minimum; adds ESET Inspect (XDR) and MFA
- **Details:** https://www.thetechbag.com/eset/eset-protect-elite

### Trend Vision One Endpoint Security — Trend Micro

- **Who it's for:** Estates that want Trend's endpoint sensor feeding Vision One XDR, with Service One MDR from the same vendor.
- **The honest limitation:** Advanced is the EDR-grade tier at ~6× Essentials; credit-based Vision One billing is hard to forecast; automatic file rollback is not documented.
- **Price:** $2.25–14.92 (≈ ₹187) — per endpoint / month — Essentials · Standard · Advanced; Apex One on-prem still sold
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-endpoint-security

### Trend Vision One XDR — Trend Micro

- **Who it's for:** Trend estates correlating endpoint with email, network and cloud telemetry in one platform.
- **The honest limitation:** Needs Trend sensors to be worth it; credit consumption is opaque until you run it; no published list.
- **Price:** Credits — Vision One credits, annual; correlates endpoint, email, network, cloud, identity
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-xdr

### Kaspersky Next (EDR Foundations · Optimum · Expert) — Kaspersky

- **Who it's for:** Estates wanting a full prevention-to-EDR ladder with the Remediation Engine rollback and an MXDR option on the same agent.
- **The honest limitation:** Procurement-sensitive in some sectors and countries (US ban; check your regulator); EDR Expert is enterprise-priced; India data region not documented.
- **Price:** from €287.50 — per 5 users / year (Foundations); Optimum / Expert and MXDR on quote; on-prem or cloud console
- **Details:** https://www.thetechbag.com/kaspersky/kaspersky-next

### Kaspersky Endpoint Security Cloud — Kaspersky

- **Who it's for:** Small estates wanting Kaspersky prevention with phones included and nothing to host.
- **The honest limitation:** Prevention-first — full EDR is the Next line; cloud-only; the same procurement caveats as Kaspersky Next.
- **Price:** Quote — per user / year, cloud console; Pro / Plus tiers add EDR Optimum-grade features
- **Details:** https://www.thetechbag.com/kaspersky/kaspersky-endpoint-security-cloud

### Seqrite Endpoint Protection (on-prem) — Seqrite

- **Who it's for:** India-regulated estates that need INR-billed, on-prem endpoint protection with local support from an Indian vendor.
- **The honest limitation:** Prevention tier — EDR/XDR are separate SKUs; mobile is mSuite (separate console); ransomware recovery restores from its own backup rather than rolling back; scale above 2,000 claimed, not documented.
- **Price:** ₹799+ — per endpoint / year, INR-native (EPS Core → Total); EDR / XDR on quote
- **Details:** https://www.thetechbag.com/seqrite/seqrite-endpoint-protection

### Seqrite Endpoint Protection Cloud — Seqrite

- **Who it's for:** The same Seqrite protection with nothing to host and data in India.
- **The honest limitation:** Cloud-only variant of a prevention tier; EDR/XDR are add-ons; scale above 2,000 endpoints not documented.
- **Price:** Quote — per endpoint / year, INR-native, India-hosted cloud console
- **Details:** https://www.thetechbag.com/seqrite/seqrite-endpoint-protection-cloud

### Seqrite EDR — Seqrite

- **Who it's for:** Seqrite estates adding detection and response without leaving the India-hosted stack.
- **The honest limitation:** An add-on to EPS, not standalone; quote-only; depth of hunting and telemetry retention is not documented at the level CrowdStrike or SentinelOne publish.
- **Price:** Quote — add-on per endpoint / year (≈ ₹350 over EPS Core reported); INR-native
- **Details:** https://www.thetechbag.com/seqrite/seqrite-edr

### Seqrite XDR (HawkkHunt) — Seqrite

- **Who it's for:** India estates wanting XDR and MDR from one India-headquartered vendor.
- **The honest limitation:** XDR breadth is Seqrite-stack-first; quote-only; unverified above 2,000 endpoints.
- **Price:** Quote — per endpoint / year, INR-native; correlates Seqrite endpoint, network and cloud telemetry
- **Details:** https://www.thetechbag.com/seqrite/seqrite-xdr

### Xcitium ZeroDwell (containment) — Xcitium

- **Who it's for:** Teams that want unknown files contained at the kernel before they run — a different bet from detect-then-respond.
- **The honest limitation:** Containment is the mechanism, not rollback — nothing to restore because nothing ran, and no file-restore if something is allowed; on-prem and India region not documented.
- **Price:** $2.39 (≈ ₹198) — per endpoint / month, modular and postpaid; OpenEDR free to 50 endpoints
- **Details:** https://www.thetechbag.com/xcitium/xcitium-zerodwell

### Xcitium EDR — Xcitium

- **Who it's for:** An EDR module that can sit on top of Defender AV or the Xcitium stack.
- **The honest limitation:** Module pricing adds up; unverified above 2,000 endpoints; India region not documented.
- **Price:** Modular — per endpoint / month module; runs beside Microsoft Defender (documented)
- **Details:** https://www.thetechbag.com/xcitium/xcitium-edr

### Xcitium XDR — Xcitium

- **Who it's for:** Xcitium estates widening the recording beyond the endpoint.
- **The honest limitation:** XDR depth is Xcitium-stack-first; scale and region unverified.
- **Price:** Modular — per endpoint / month module; network, cloud and endpoint telemetry
- **Details:** https://www.thetechbag.com/xcitium/xcitium-xdr

### Xcitium OpenEDR — Xcitium

- **Who it's for:** Teams that want real EDR telemetry for nothing, and will run it themselves.
- **The honest limitation:** Windows-only, EDR-only (no prevention engine), nobody watches it but you — shelfware unless someone reads the console daily.
- **Price:** Free — open-source EDR, free to 50 endpoints; paid platform beyond
- **Details:** https://www.thetechbag.com/xcitium/xcitium-openedr

### Check Point Harmony Endpoint — Check Point

- **Who it's for:** Check Point estates wanting prevention-first endpoint with anti-ransomware restore and Infinity-portal management.
- **The honest limitation:** No published list (reported ranges only); managed service is enterprise-gated; India data region not documented.
- **Price:** ~$25–45 (≈ ₹2,075) — per user / year reported (Basic · Advanced · Complete); on-prem or Infinity cloud management
- **Details:** https://www.thetechbag.com/checkpoint/checkpoint-harmony-endpoint

### Cisco Secure Endpoint — Cisco

- **Who it's for:** Cisco-network estates wanting endpoint telemetry that joins Umbrella, Secure Firewall and Cisco XDR.
- **The honest limitation:** Only Essentials is published; the XDR and hunting tiers are quote-only; file rollback not documented; mobile not covered.
- **Price:** $6.75 (≈ ₹560) — per user / month (Essentials); Advantage / Premier (XDR, hunting) on quote; private-cloud appliance option
- **Details:** https://www.thetechbag.com/cisco/cisco-secure-endpoint

### Cisco XDR — Cisco

- **Who it's for:** Cisco estates correlating endpoint, network, email and identity in one console.
- **The honest limitation:** Needs sources to correlate — alone it is a console; quote-only; no rollback; cloud-only.
- **Price:** ~$69 (≈ ₹5,727) — per user / year reported (Essentials · Advantage · Premier); correlates Cisco and third-party telemetry
- **Details:** https://www.thetechbag.com/cisco/cisco-xdr

### Fortinet FortiEDR — Fortinet

- **Who it's for:** Fortinet Security Fabric estates wanting pre- and post-infection protection with an MDR option on the same agent.
- **The honest limitation:** No published list; automatic file rollback not documented; no mobile coverage; strongest inside a Fortinet stack.
- **Price:** ~$20–35 (≈ ₹1,660) — per endpoint / year reported; on-prem or cloud; FortiGuard MDR option
- **Details:** https://www.thetechbag.com/fortinet/fortinet-fortiedr

### Acronis Cyber Protect (EDR) — Acronis

- **Who it's for:** Estates that want backup and EDR in one agent — recovery is a restore, not a rollback.
- **The honest limitation:** Recovery means restoring from Acronis backup (strong, but not automatic rollback); EDR depth is below the pure-play leaders; per-workload pricing climbs with servers.
- **Price:** ~₹3,500 — per workload / month (Advanced with EDR, India reseller list); cloud or on-prem; Mumbai data centre
- **Details:** https://www.thetechbag.com/acronis/acronis-cyber-protect

### Coro Endpoint & EDR — Coro

- **Who it's for:** SMBs that want endpoint, email, cloud-app and posture in one modular agent with a managed option.
- **The honest limitation:** Linux agent is remote scan-only; no documented file rollback; public list withdrawn in 2026; unverified above 2,000 endpoints.
- **Price:** Quote — per user / month, modular (historically ~$7.50–10.50); managed SOC option
- **Details:** https://www.thetechbag.com/coro/coro-endpoint-edr

### Norton Small Business — Norton

- **Who it's for:** Very small businesses that want consumer-grade antivirus with a business licence and nothing to manage.
- **The honest limitation:** Licensed for up to 20 devices — not an enterprise product; no EDR, no Linux, no console for compliance evidence, no managed option.
- **Price:** $179.99 (≈ ₹14,939) — per year for 10 devices (first year; Premium $299.99); up to 20 devices
- **Details:** https://www.thetechbag.com/norton/norton-small-business

### Hexnode XDR — Hexnode

- **Who it's for:** Hexnode UEM estates that want threat protection in the console they already run.
- **The honest limitation:** A young product from a UEM vendor — EDR depth, Linux coverage and rollback are not documented; no managed service; unverified at scale.
- **Price:** $5.50 (≈ ₹457) — per device / month; UEM-native endpoint security inside the Hexnode console
- **Details:** https://www.thetechbag.com/hexnode/hexnode-xdr

### Scalefusion Veltar — Scalefusion

- **Who it's for:** Scalefusion UEM estates adding web filtering, DLP and zero-trust access from the same India-hosted console.
- **The honest limitation:** Not an anti-malware engine — no detection and response, no rollback; a hardening and access layer beside your EPP, not instead of it.
- **Price:** ~$3–4 (≈ ₹249) — per device / month reported; UEM-native: web filtering, DLP, VPN/ZTNA, compliance
- **Details:** https://www.thetechbag.com/scalefusion/scalefusion-veltar

### NinjaOne Endpoint Security (Bitdefender / SentinelOne) — NinjaOne

- **Who it's for:** NinjaOne RMM estates that want the EDR engine deployed and watched from the RMM console.
- **The honest limitation:** You buy the RMM first; the engine is Bitdefender or SentinelOne with their capabilities — rollback and managed options depend on which; NinjaOne regions are US/EU/CA/OC, no India.
- **Price:** ~$3–5 (≈ ₹249) — per endpoint / month reported, on top of the NinjaOne RMM seat; resold Bitdefender or SentinelOne engine
- **Details:** https://www.thetechbag.com/ninjaone/ninjaone-endpoint-security

### Datto EDR (with Datto AV) — Datto

- **Who it's for:** MSPs and small IT teams on Datto RMM or VSA that want EDR with ransomware rollback deployed in one click from the RMM they already run.
- **The honest limitation:** No published price; no documented India region; the 99.62% detection figure is Datto’s own claim with Datto AV; best value inside the Kaseya stack.
- **Price:** Quote — per endpoint, quote-only standalone; also inside Kaseya 365 Endpoint with Datto AV and the RMM (50-endpoint minimum); 24/7 monitoring comes from Kaseya MDR
- **Details:** https://www.thetechbag.com/datto/datto-edr

### OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR) — OpenText

- **Who it's for:** Small offices and the MSPs serving them that want a light Windows and macOS agent with cloud verdicts, file journaling and rollback, run from a multi-site cloud console with 40+ RMM integrations.
- **The honest limitation:** Windows and macOS only — no Linux agent is documented — and a cloud console with no on-prem option or documented India region. OpenText classes its SMB and consumer security line as non-core and is divesting non-core units — ask about the roadmap.
- **Price:** Quote — per seat, annual, quote-only — mostly through MSPs, as the online cart sells to US buyers only; Core EDR and the 24/7 co-managed Core MDR are each quoted on top; 30-day trial on unlimited endpoints
- **Details:** https://www.thetechbag.com/opentext/opentext-core-endpoint-protection

### Symantec Endpoint Security (Broadcom) — Broadcom

- **Who it's for:** Existing Symantec estates that want to keep one agent and choose cloud, hybrid or on-premises management.
- **The honest limitation:** No agent file rollback documented; a Gartner Niche Player per a distributor’s listing (2026 EPP MQ); an Indian console region is not documented.
- **Price:** Quote — quoted per device; Enterprise and Complete editions (Complete adds EDR and Threat Hunter); cloud, hybrid or on-premises management; a UK G-Cloud reseller lists Enterprise at £93.75 per user a year
- **Details:** https://www.thetechbag.com/broadcom/broadcom-symantec-endpoint-security

### Carbon Black Cloud Endpoint (Broadcom) — Broadcom

- **Who it's for:** Security teams that want deep search and live response across Windows, macOS and Linux from one cloud console.
- **The honest limitation:** Data regions listed exclude India; Broadcom publishes neither a price nor a licence unit; the separate on-premises Carbon Black EDR is a different product.
- **Price:** Quote — quoted; next-gen antivirus and EDR on one sensor, Live Query and Live Response; alerts kept 180 days and other events 30, with extended retention as an add-on; no Indian region is listed
- **Details:** https://www.thetechbag.com/broadcom/broadcom-carbon-black-cloud-endpoint

### Carbon Black App Control (Broadcom) — Broadcom

- **Who it's for:** Fixed-function and critical systems — ATMs, POS, OT and servers — that should run only approved software.
- **The honest limitation:** Allowlisting is not EDR and needs approval workflows to stay usable; quote-only; the newest official videos are from 2021.
- **Price:** Quote — quoted; application allowlisting with High/Medium/Low enforcement, file-integrity and device control, on a server you host (8.11 line); agents for Windows, macOS and Linux
- **Details:** https://www.thetechbag.com/broadcom/broadcom-carbon-black-app-control

### Heimdal Next-Gen Antivirus & Firewall — Heimdal

- **Who it's for:** Small IT teams consolidating antivirus, firewall control and patching onto one agent and one dashboard.
- **The honest limitation:** Prevention only, with no rollback; ransomware protection is the separate REP line; no Linux agent and tenant data stays in Europe, the US or the UK.
- **Price:** Quote — quoted per device per year; signature, heuristic and behaviour scanning for Windows and macOS, with a host firewall on Windows only; one agent with the other Heimdal modules
- **Details:** https://www.thetechbag.com/heimdal/heimdal-next-gen-antivirus

### Heimdal Ransomware Encryption Protection — Heimdal

- **Who it's for:** Teams that want an anti-encryption layer on Windows and macOS on top of whichever antivirus they already run.
- **The honest limitation:** Stops encryption rather than rolling files back, so recovery still needs shadow copies or backups; no Linux agent and no India data region.
- **Price:** Quote — quoted per device per year; an add-on (marketed REP X) that spots processes encrypting files and guards shadow copies, and works alongside any antivirus
- **Details:** https://www.thetechbag.com/heimdal/heimdal-ransomware-encryption-protection

### Heimdal XDR — Heimdal

- **Who it's for:** Heimdal estates that want correlated detection and one-click response across the modules they already run.
- **The honest limitation:** Reads Heimdal’s own modules only, with no documented third-party EDR ingestion; the Action Center is Windows-only and ITDR has no price line, so confirm what the XDR line includes.
- **Price:** Quote — quoted per device per year; detection and response across the Heimdal modules, with the Threat-hunting & Action Center and identity threat detection folded in
- **Details:** https://www.thetechbag.com/heimdal/heimdal-xdr

### WatchGuard Endpoint Security (Basic, Prime, 360, Elite) — WatchGuard

- **Who it's for:** MSP-run fleets that want endpoint protection and EDR in tiers, feeding ThreatSync XDR alongside their Fireboxes.
- **The honest limitation:** The tier table lists no file rollback; no list price; WatchGuard Cloud has no Indian region, so confirm where telemetry is stored.
- **Price:** Quote — per endpoint through partners; four tiers renamed on 1 April 2026 (formerly EPP, EPDR and Advanced EPDR, plus the new Prime), with Patch Management and Full Encryption as paid add-ons
- **Details:** https://www.thetechbag.com/watchguard/watchguard-endpoint-security

### Iru EDR — Iru

- **Who it's for:** Apple-first fleets already on Iru that want Mac threat detection and response in the same agent and console as their device management.
- **The honest limitation:** Mac-first: on Windows it is file-based detection in Detect mode only, with no automatic quarantine; no Linux, no rollback, no managed service, and tenants sit in the US or EU.
- **Price:** Quote — per device by platform, quote-only, an add-on to Iru Endpoint Management; Mac gets file and behavioural detection with Protect mode, Windows gets file-based detection in Detect mode
- **Details:** https://www.thetechbag.com/iru/iru-edr

### Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense) — Arctic Wolf

- **Who it's for:** Former Cylance customers, and Arctic Wolf MDR estates that want the endpoint agent and the SOC from one vendor — Cylance’s AI-first prevention model, now with EDR and Arctic Wolf’s analysts on top.
- **The honest limitation:** Changed hands in February 2025 (BlackBerry to Arctic Wolf), so the roadmap is under a new owner and the docs are mid-rename (Protect = CylancePROTECT, Focus = CylanceOPTICS). No India data region, EDR retention is 30 days, the on-prem console’s status is unconfirmed, and there is no published price.
- **Price:** Quote — quote-only per endpoint; Aurora Protect (prevention) or Aurora Endpoint Defense (adds EDR, 30-day retention); the managed tier is Managed Endpoint Defense, $182.40 per device per year on AWS Marketplace
- **Details:** https://www.thetechbag.com/arcticwolf/arcticwolf-aurora-endpoint-security

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**Full EDR.** Rules out CrowdStrike Falcon Prevent (Go / Pro), Sophos Intercept X Advanced, Bitdefender GravityZone Business Security, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Xcitium ZeroDwell (containment), Norton Small Business, Hexnode XDR, OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Carbon Black App Control (Broadcom) and Heimdal Next-Gen Antivirus & Firewall — a prevention-tier SKU; EDR is a higher tier or a separate product; Bitdefender GravityZone PHASR, Scalefusion Veltar and Heimdal Ransomware Encryption Protection — a hardening / access add-on, not detection and response. That leaves Elastic Defend, CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Cisco XDR, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Coro Endpoint & EDR, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite), Iru EDR and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense).

**Prevention only is enough.** Rules out CrowdStrike Falcon Insight XDR, Trend Vision One XDR, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR and Cisco XDR — an EDR / XDR SKU that needs operators and a prevention engine beside it; Bitdefender GravityZone PHASR, Scalefusion Veltar and Heimdal Ransomware Encryption Protection — an add-on that needs a protection engine beside it. That leaves Elastic Defend, CrowdStrike Falcon Prevent (Go / Pro), SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Xcitium ZeroDwell (containment), Check Point Harmony Endpoint, Cisco Secure Endpoint, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Coro Endpoint & EDR, Norton Small Business, Hexnode XDR, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite), Iru EDR and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense).

**Nobody to triage alerts.** Rules out Elastic Defend, Xcitium OpenEDR, Norton Small Business, Hexnode XDR, Scalefusion Veltar, Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom) and Iru EDR — no managed detection service from the vendor. That leaves CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), Bitdefender GravityZone PHASR, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Cisco XDR, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Coro Endpoint & EDR, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite) and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags CrowdStrike Falcon Prevent (Go / Pro) — Managed tier is enterprise-gated (quote / E5), CrowdStrike Falcon Insight XDR — Managed tier is enterprise-gated (quote / E5), Microsoft Defender for Endpoint P1 / P2 — Managed tier is enterprise-gated (quote / E5), Check Point Harmony Endpoint — Managed tier is enterprise-gated (quote / E5), Cisco Secure Endpoint — Managed tier is enterprise-gated (quote / E5) and Cisco XDR — Managed tier is enterprise-gated (quote / E5) — marked, not removed.

**Automatic file rollback.** Rules out Elastic Defend, CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, Microsoft Defender for Endpoint P1 / P2, Cisco XDR, Coro Endpoint & EDR, Norton Small Business, Scalefusion Veltar, Symantec Endpoint Security (Broadcom), Carbon Black App Control (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite) and Iru EDR — no documented automatic file rollback (response is isolate, kill, restore from your own backups). That leaves SentinelOne Singularity Endpoint, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), Bitdefender GravityZone PHASR, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Hexnode XDR, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Carbon Black Cloud Endpoint (Broadcom) and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags Bitdefender GravityZone PHASR — Rollback not documented either way, Trend Vision One Endpoint Security — Rollback not documented either way, Trend Vision One XDR — Rollback not documented either way, Seqrite Endpoint Protection (on-prem) — Restores from its own backup rather than automatic rollback, Seqrite Endpoint Protection Cloud — Restores from its own backup rather than automatic rollback, Seqrite EDR — Restores from its own backup rather than automatic rollback, Seqrite XDR (HawkkHunt) — Restores from its own backup rather than automatic rollback, Xcitium ZeroDwell (containment) — Prevents by containing unknown files before they run, Xcitium EDR — Prevents by containing unknown files before they run, Xcitium XDR — Prevents by containing unknown files before they run, Xcitium OpenEDR — Rollback not documented either way, Cisco Secure Endpoint — Rollback not documented either way, Fortinet FortiEDR — Rollback not documented either way, Acronis Cyber Protect (EDR) — Restores from its own backup rather than automatic rollback, Hexnode XDR — Rollback not documented either way, NinjaOne Endpoint Security (Bitdefender / SentinelOne) — Rollback not documented either way, Carbon Black Cloud Endpoint (Broadcom) — Rollback not documented either way and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense) — Rollback not documented either way — marked, not removed.

**Linux servers with real-time protection.** Rules out Xcitium OpenEDR, Norton Small Business, Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR and Iru EDR — no Linux coverage; Coro Endpoint & EDR — Linux agent is scan-only, no real-time protection. That leaves Elastic Defend, CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), Bitdefender GravityZone PHASR, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Cisco XDR, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Hexnode XDR, Scalefusion Veltar, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom), WatchGuard Endpoint Security (Basic, Prime, 360, Elite) and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags Bitdefender GravityZone PHASR — Linux coverage not documented, Hexnode XDR — Linux coverage not documented, Scalefusion Veltar — Linux coverage not documented, OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR) — Linux coverage not documented and Symantec Endpoint Security (Broadcom) — Linux coverage not documented — marked, not removed.

**Phones and tablets in the same console.** Rules out Elastic Defend, Bitdefender GravityZone PHASR, ESET PROTECT Entry, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium OpenEDR, Cisco Secure Endpoint, Cisco XDR, Fortinet FortiEDR, Acronis Cyber Protect (EDR), NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR and Iru EDR — no mobile coverage in this SKU. That leaves CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Check Point Harmony Endpoint, Coro Endpoint & EDR, Norton Small Business, Hexnode XDR, Scalefusion Veltar, Symantec Endpoint Security (Broadcom), WatchGuard Endpoint Security (Basic, Prime, 360, Elite) and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags CrowdStrike Falcon Prevent (Go / Pro) — Mobile is a paid add-on to the same console, CrowdStrike Falcon Insight XDR — Mobile is a paid add-on to the same console, SentinelOne Singularity Endpoint — Mobile is a paid add-on to the same console, Sophos Intercept X Advanced — Mobile is a paid add-on to the same console, Sophos Intercept X Advanced with XDR — Mobile is a paid add-on to the same console, Bitdefender GravityZone Business Security — Mobile is a paid add-on to the same console, Bitdefender GravityZone EDR / XDR (Premium · Enterprise) — Mobile is a paid add-on to the same console, Trend Vision One Endpoint Security — Mobile is a paid add-on to the same console, Trend Vision One XDR — Mobile is a paid add-on to the same console, Check Point Harmony Endpoint — Mobile is a paid add-on to the same console and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense) — Mobile is a paid add-on to the same console — marked, not removed.

**On-prem management console.** Rules out CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Trend Vision One XDR, Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection Cloud, Cisco XDR, Coro Endpoint & EDR, Norton Small Business, Hexnode XDR, Scalefusion Veltar, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Carbon Black Cloud Endpoint (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite) and Iru EDR — cloud-only console. That leaves Elastic Defend, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), Bitdefender GravityZone PHASR, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Kaspersky Next (EDR Foundations · Optimum · Expert), Seqrite Endpoint Protection (on-prem), Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Symantec Endpoint Security (Broadcom), Carbon Black App Control (Broadcom) and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags Xcitium ZeroDwell (containment) — On-prem option not documented either way, Xcitium EDR — On-prem option not documented either way, Xcitium XDR — On-prem option not documented either way and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense) — On-prem option not documented either way — marked, not removed.

**Vendor-published list price.** Rules out Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone PHASR, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One XDR, Seqrite EDR, Seqrite XDR (HawkkHunt), Check Point Harmony Endpoint, Cisco XDR, Fortinet FortiEDR, Coro Endpoint & EDR, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite), Iru EDR and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense) — quote-only (reported ranges at most). That leaves Elastic Defend, CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, Trend Vision One Endpoint Security, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR, Cisco Secure Endpoint, Acronis Cyber Protect (EDR), Norton Small Business, Hexnode XDR and Scalefusion Veltar.

**Above 2,000 endpoints.** Rules out Norton Small Business — licensed for up to 20 devices. That leaves Elastic Defend, CrowdStrike Falcon Prevent (Go / Pro), CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2, Sophos Intercept X Advanced, Sophos Intercept X Advanced with XDR, Bitdefender GravityZone Business Security, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), Bitdefender GravityZone PHASR, ESET PROTECT Entry, ESET PROTECT Advanced, ESET PROTECT Complete, ESET PROTECT Elite (ESET Inspect XDR), Trend Vision One Endpoint Security, Trend Vision One XDR, Kaspersky Next (EDR Foundations · Optimum · Expert), Kaspersky Endpoint Security Cloud, Seqrite Endpoint Protection (on-prem), Seqrite Endpoint Protection Cloud, Seqrite EDR, Seqrite XDR (HawkkHunt), Xcitium ZeroDwell (containment), Xcitium EDR, Xcitium XDR, Xcitium OpenEDR, Check Point Harmony Endpoint, Cisco Secure Endpoint, Cisco XDR, Fortinet FortiEDR, Acronis Cyber Protect (EDR), Coro Endpoint & EDR, Hexnode XDR, Scalefusion Veltar, NinjaOne Endpoint Security (Bitdefender / SentinelOne), Datto EDR (with Datto AV), OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR), Symantec Endpoint Security (Broadcom), Carbon Black Cloud Endpoint (Broadcom), Carbon Black App Control (Broadcom), Heimdal Next-Gen Antivirus & Firewall, Heimdal Ransomware Encryption Protection, Heimdal XDR, WatchGuard Endpoint Security (Basic, Prime, 360, Elite), Iru EDR and Arctic Wolf Aurora Endpoint Security (Protect · Endpoint Defense). It flags Seqrite Endpoint Protection (on-prem) — Unverified above 2,000 endpoints, Seqrite Endpoint Protection Cloud — Unverified above 2,000 endpoints, Seqrite EDR — Unverified above 2,000 endpoints, Seqrite XDR (HawkkHunt) — Unverified above 2,000 endpoints, Xcitium ZeroDwell (containment) — Unverified above 2,000 endpoints, Xcitium EDR — Unverified above 2,000 endpoints, Xcitium XDR — Unverified above 2,000 endpoints, Xcitium OpenEDR — Unverified above 2,000 endpoints, Coro Endpoint & EDR — Unverified above 2,000 endpoints, Hexnode XDR — Unverified above 2,000 endpoints, Scalefusion Veltar — Unverified above 2,000 endpoints, Datto EDR (with Datto AV) — Unverified above 2,000 endpoints, OpenText Core Endpoint Protection (formerly Webroot Business, with Core EDR) — Unverified above 2,000 endpoints, Heimdal Next-Gen Antivirus & Firewall — Unverified above 2,000 endpoints, Heimdal Ransomware Encryption Protection — Unverified above 2,000 endpoints, Heimdal XDR — Unverified above 2,000 endpoints, WatchGuard Endpoint Security (Basic, Prime, 360, Elite) — Unverified above 2,000 endpoints and Iru EDR — Unverified above 2,000 endpoints — marked, not removed.

**India data residency.** Documented: SentinelOne (Mumbai), Sophos Central (Mumbai), Seqrite (India data centres and on-prem), Acronis (Mumbai), Scalefusion Veltar (India-hosted). CrowdStrike announced an India in-country cloud in January 2026 — announced, not yet documented live. NinjaOne's regions are US / EU / CA / OC (no India). Not documented either way for the rest — so no chip, and nothing is ruled out on it. Ask for the region in writing.

**Platform bundling vs best-of-breed.** Not a chip because it is a strategy, not a capability: Defender inside Microsoft 365, NinjaOne / Hexnode / Scalefusion beside a UEM or RMM, Acronis beside backup, Sophos / Trend / Kaspersky / Bitdefender / ESET as platform suites, CrowdStrike / SentinelOne as the best-of-breed agents most other consoles integrate. The instrument tells you what each SKU does; whether one console or two is the right trade is the operating-capacity question.

**Agent coexistence.** Rules nothing out but decides the rollout: Windows drops Defender Antivirus to passive mode when another engine registers, so any EPP here coexists with Defender for Endpoint telemetry; Xcitium EDR documents running beside Defender; two third-party real-time engines do not coexist — and the RMM's or UEM's bundled security is the usual way a second one arrives.

**Under 50 endpoints.** Rules nothing out on published minimums — Xcitium OpenEDR is free to 50, ESET sells 5-device packs, Defender for Business is sized to 300 users, Bitdefender and CrowdStrike Falcon Go sell small packs, Norton covers up to 20. Which enterprise tiers are a poor fit at this size is delivery-team judgement: [TechBag to confirm].

## Eight situations, eight shortlists — with the operating question answered

Each shortlist states who will run it. If the answer is nobody, the shortlist changes — that is the point.

### 50–500 seats, no security team — someone else must watch it

**Shortlist:** Sophos Intercept X Advanced with XDR, Bitdefender GravityZone EDR / XDR (Premium · Enterprise), ESET PROTECT Elite (ESET Inspect XDR)

**Why:** Managed detection priced for mid-market, sold with the agent by the same vendor: Sophos leads with MDR as the default product, Bitdefender and ESET sell it on top of published tiers.

**Trade-off:** MDR scope is endpoint-first and the contract is what you are buying — read the scope on the Managed Detection & Response guide before the licence.

### Microsoft 365 E5 (or E5 Security) already in place

**Shortlist:** Microsoft Defender for Endpoint P1 / P2

**Why:** Defender for Endpoint P2 is already paid for; a second EDR duplicates it. On E3 you hold only P1 — prevention — so the choice becomes E5 Security against a third-party EDR.

**Trade-off:** No file rollback in the agent, Defender Experts is a quote, and the console assumes Intune and Entra. One survivor here is the answer, not a gap.

### Ransomware-scarred — file rollback is the requirement

**Shortlist:** SentinelOne Singularity Endpoint, Sophos Intercept X Advanced, Kaspersky Next (EDR Foundations · Optimum · Expert)

**Why:** Documented automatic rollback: SentinelOne one-click on Windows, Sophos CryptoGuard from protected copies / VSS, Kaspersky's Remediation Engine; ESET and Bitdefender and Check Point qualify too.

**Trade-off:** Rollback has conditions (disk space, Windows-first) and restores files, not the breach. Xcitium's containment is the other bet; Acronis and Seqrite restore from their own backups.

### A security team exists and wants to hunt

**Shortlist:** CrowdStrike Falcon Insight XDR, SentinelOne Singularity Endpoint, Microsoft Defender for Endpoint P1 / P2

**Why:** Full EDR telemetry, advanced hunting, forensic timeline and scripted response — the reference agents, and the Microsoft-estate equivalent in P2.

**Trade-off:** Self-run EDR is a staffing decision: budget analysts or an MDR contract beside the licence. CrowdStrike has no rollback; SentinelOne has no published list.

### India-regulated — on-prem console or India data centre

**Shortlist:** Seqrite Endpoint Protection (on-prem), ESET PROTECT Elite (ESET Inspect XDR), Acronis Cyber Protect (EDR)

**Why:** On-prem consoles (Seqrite, ESET PROTECT On-Prem, GravityZone, Kaspersky Security Center, Check Point, FortiEDR) and India data centres (Seqrite, Acronis Mumbai, SentinelOne and Sophos Mumbai for cloud).

**Trade-off:** On-prem means you run the console server. If cloud with an India region is acceptable, SentinelOne and Sophos reopen the field; CrowdStrike's India cloud is announced, not yet live.

### Budget decides — published prices, no sales cycle

**Shortlist:** ESET PROTECT Entry, Bitdefender GravityZone Business Security, Trend Vision One Endpoint Security

**Why:** ESET from $42.20 and Bitdefender from $57 per device per year, Trend Vision One Endpoint Essentials from $2.25 per endpoint per month, Xcitium modular from $2.39 — on the vendors' own pages.

**Trade-off:** Published entry tiers are prevention-only; EDR costs more at every vendor. Bitdefender's first-year price renews higher — price year two.

### You already run a UEM, an RMM or a backup agent — and want one console

**Shortlist:** NinjaOne Endpoint Security (Bitdefender / SentinelOne), Acronis Cyber Protect (EDR), Hexnode XDR

**Why:** NinjaOne deploys and watches a resold Bitdefender / SentinelOne engine from the RMM; Acronis puts backup and EDR in one agent; Hexnode XDR and Scalefusion Veltar add security inside the UEM.

**Trade-off:** Depth follows the engine: NinjaOne's is real EDR, Acronis recovers by restore, Hexnode XDR is young and Veltar is hardening and access, not an EDR. One console is a convenience; the catch on the card is what you give up.

### Prevention first, with containment instead of detection

**Shortlist:** Xcitium ZeroDwell (containment), Sophos Intercept X Advanced, Bitdefender GravityZone PHASR

**Why:** Xcitium contains unknown files at the kernel so nothing unrecognised runs; Sophos Intercept X Advanced is prevention with rollback; PHASR hardens the attack surface per user before prevention has to fire.

**Trade-off:** Containment can hold a benign-but-new binary until verdicted; PHASR is an add-on, not a protection engine; none of these is a substitute for someone watching when prevention misses.

## At scale

Detection quality barely moves with size. Alert volume per analyst, exclusion sprawl and the managed contract’s scope are what move — and they decide whether the EDR tier is real or nominal.

### 200 endpoints — The operating model is the constraint

- Prevention-only is often the honest tier here; an EDR console with no owner becomes noise by week three.
- Defender for Business, Falcon Go, ESET Entry, GravityZone Business, Trend Essentials, Xcitium's free tier and Norton are all sized for this band.
- If you buy EDR, buy the managed tier with it — the licence is the smaller half.

**The test:** Run a detection-only week: count alerts, count the ones a human read, count the ones acted on.

### 2,000 endpoints — Alert volume and exclusions are the constraint

- Untuned EDR produces more alerts than a small team can triage; tuning and exclusions become an engineering task with an owner.
- Agent coexistence with the UEM and RMM fleets must be documented per OS — one bad exclusion at this size is an outage.
- MDR scope matters now: which alerts they take, which they hand back, what ‘response’ means in the SLA.

**The test:** Deploy to a 200-device ring with the RMM and UEM agents present; measure false positives and CPU for a week; read the MDR SLA aloud.

### 10,000 endpoints — Telemetry, retention and the API are the constraint

- Retention windows (days of searchable telemetry) and hunting query performance become line items.
- Delegated, scoped administration by region or business unit is mandatory; console and API rate limits decide what you can automate.
- Agent updates need rings of their own — a bad sensor release across 10,000 machines is the category's worst day, and it has happened.

**The test:** Pull 30 days of telemetry through the API; run your three hardest hunts; confirm staged sensor-update control in writing.

CrowdStrike, SentinelOne, Defender, Sophos, Bitdefender, ESET, Trend, Kaspersky, Check Point, Cisco, Fortinet, Acronis and NinjaOne's engines document estates far above 2,000 endpoints; Xcitium, Seqrite, Coro, Hexnode, Scalefusion Veltar and OpenEDR are flagged unverified at that size, not ruled out; Norton is licensed to 20. Where a specific console strains for your estate: [TechBag to confirm].

## Swapping an EPP is a security event, not an install

The agent swap is scriptable through your UEM or RMM. What makes it expensive is the gap: the minutes between old engine off and new engine on, on every machine, and the tamper-protection password nobody remembers.

**The agent** — Push the new agent first (passive where the vendor supports it), then remove the old with its tamper-protection credential, then activate. Never the other order. *(Scriptable, in rings)*

**Policies and exclusions** — Exclusions for your line-of-business apps, the RMM, the UEM and backup agents are rebuilt by hand. Miss one and the first week is an outage. *(Rebuild)*

**Detection history** — Alerts, timelines and hunting data stay in the old console. Export what an audit might ask for before the licence ends. *(Export or lose)*

**The managed contract** — MDR terms run on their own calendar. Overlap two services or end one early — either is a cost line nobody put in the licence comparison. *(Overlap or gap)*

**Cut-over plan and hours for your estate:** [TechBag to confirm] — TechBag scopes it from your OS mix, the agents already present and the managed contract dates.

## The licence is the smaller half

What you may already hold, what the tiers cost in USD and INR, and the part that never appears on the licence line — the people who run it.

### Do you already own one?

Four licences you may hold carry endpoint protection. One of them is usually the answer for a Microsoft estate.

- **Microsoft 365 — Yes, if.** E5 or E5 Security (Defender for Endpoint P2 — full EDR) or Business Premium (Defender for Business). E3 carries P1 only: prevention, no EDR.

- **Your RMM / UEM — Sometimes.** NinjaOne resells Bitdefender / SentinelOne; Hexnode XDR and Scalefusion Veltar live inside the UEM; Acronis pairs EDR with backup. Check which engine — and that it is not a second one.

- **Your suite vendor — Often.** Sophos, Trend, Kaspersky, Bitdefender, ESET, Check Point, Cisco and Fortinet all bundle endpoint into their platform contracts. Read the SKU: prevention tier or EDR tier.

- **Google Workspace — No.** Gmail filters mail; Chrome Enterprise manages the browser. Neither is an endpoint protection agent for Windows, macOS or Linux.

If Defender P2 is already on your invoice, we say so first — and then talk about who will run it.

### What the tiers cost

Published USD with INR for scale; per device per year unless the vendor prices per user per month; the EDR tier named separately from the prevention tier wherever the vendor publishes both. Seqrite’s and Acronis’s INR are the India list.

### What isn't in the licence price

- **The analyst, or the MDR contract.** An EDR tier without a person is a licence for a dashboard. Price the analyst headcount or the managed service beside the tier — Sophos MDR is reported at $80 ≈ ₹6,640–$200 ≈ ₹16,600 per user per year on top of the agent; CrowdStrike Falcon Complete $25 ≈ ₹2,075–$45 ≈ ₹3,735 per endpoint per *month* reported. That line is usually larger than the licence.

- **The renewal, not the promotion.** First-year prices (Bitdefender’s in particular) renew at standard rates; reseller street prices (SentinelOne) move with volume; Microsoft’s E5 moved to $60 in July 2026. Ask for the year-two number in writing before comparing year one.

- **Removing the engine you replace.** Tamper-protection credentials, a staged cut-over, exclusion rebuilds and a week of tuning — people-hours, not licence dollars. It sits in [the switching-cost section](#migration), and the hours for your estate are [TechBag to confirm].

## What goes wrong

Each of these is documented vendor behaviour; the matching to real TechBag engagements happens before any becomes a named case. They are cheaper to read now than to live through after the contract.

- **EDR bought, nobody triages it.** The console fills; nobody owns it; by month three it is closed. The licence was the cheap half of a purchase that needed a person or a managed contract.

- **Two real-time engines on one machine.** The RMM's security add-on, the UEM's XDR or the backup vendor's AV lands beside the EPP you chose. Both degrade; one blocks the other's updates. Only Defender is designed to step aside.

- **Assuming EPP covers response.** Prevention tiers stop what they recognise and report the rest. When something gets through there is no timeline, no isolation, no hunt — because that was the next tier.

- **Rollback that doesn't cover what you assumed.** Windows-first; needs free disk (Sophos ~3 GB); no rollback if the process was stopped after encryption finished; restores files, not the breach — and absent at CrowdStrike, Defender, Cisco and Coro.

- **Alert volume makes the console unusable.** Untuned EDR at 2,000 endpoints outruns a small team within weeks; tuning and exclusions need an owner. The most common reason an EDR quietly fails.

- **E3 'includes Defender' — Plan 1, not Plan 2.** Prevention only. The EDR is P2, in E5 or E5 Security. A buyer who stops at 'included' has no detection and believes they do.

- **Tamper protection blocks the migration.** The old agent will not uninstall without its credential; the project stalls at machine one. Recover the password before you sign the new contract.

- **Year-two price shock.** Promotional first-year pricing (Bitdefender), reseller street pricing (SentinelOne), credit consumption (Trend) and the July 2026 E5 rise all move at renewal. Compare year-two numbers, tier-matched, or the comparison is fiction.

## Questions this guide answers

### What is the difference between EPP, EDR and XDR?

EPP prevents known and predicted threats at the endpoint. EDR records what happens on the endpoint so a person can detect, investigate and respond to what got through — it needs someone to read it. XDR extends that telemetry across email, identity, cloud and network. They are widening scopes, not tiers of quality: broader records more, costs more and needs more people to run. Most buyers purchase an EPP believing they bought detection and response.

### Is Microsoft Defender for Endpoint already included in Microsoft 365?

Partly. Microsoft 365 E3 includes Defender for Endpoint Plan 1 — prevention, attack-surface reduction, no EDR. E5 and the E5 Security add-on include Plan 2 — full EDR. Business Premium includes Defender for Business. Standalone, P1 is about $3 and P2 $5.20 per user per month. On E3, the real choice is E5 Security against a third-party EDR.

### Which endpoint-protection products can roll back ransomware-encrypted files?

Documented automatic rollback: SentinelOne (one-click on Windows), Sophos Intercept X (CryptoGuard), ESET PROTECT (Ransomware Remediation), Bitdefender GravityZone (Ransomware Mitigation), Kaspersky (Remediation Engine) and Check Point Harmony Endpoint (Anti-Ransomware restore). Acronis and Seqrite restore from their own backups. CrowdStrike, Microsoft Defender for Endpoint, Cisco and Coro respond by isolating and killing, not by restoring files. Xcitium contains unknown files before they run, so there is nothing to roll back.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/security/endpoint-protection*