In short
Endpoint security vendors we supply include CrowdStrike, SentinelOne, ThreatDown, Bitdefender, TrendAI, WatchGuard, Sophos and Check Point for EDR, XDR and vendor-run MDR, plus Lookout and IBM MaaS360 for mobile, and specialists such as Halcyon, Keeper, Absolute, Acronis and Blackpoint Cyber. Forever Systems supplies several, so we can recommend what fits.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Why we list several vendors
Most endpoint security buying guides are written by a vendor, or by someone paid by one. We supply and support several endpoint security platforms, so this page sets out what each vendor offers for detection and response in its own product names, without rankings, awards or analyst scores.
Every EDR platform below protects Windows and macOS laptops and desktops, and most cover Linux servers too; Lookout and IBM MaaS360 focus on phones and tablets. The real differences are in how detection and investigation work, how much the vendor will do for you through its own managed service, what else the platform watches beyond the endpoint, and how licences are counted. Those are the questions that decide what fits your organisation, and they are the ones we ask when we recommend a platform.
This site covers detection, response, policy and compliance. If you are buying antivirus or an endpoint protection platform (EPP) on its own, our sister site endpointprotection.uk covers those products and editions. For the wider picture of endpoint security alongside email, identity and cloud security, see our Cloud Security site.
Vendors we supply
Endpoint security vendors at a glance
One row per vendor. "Read more" goes to our in-depth page where we have one, otherwise to the specialist Forever Group site that covers that vendor.
| Vendor | Detection and response offerings | Read more |
|---|---|---|
| CrowdStrike | Falcon Insight XDR (EDR with identity, cloud and mobile telemetry), Adversary OverWatch threat hunting, Falcon Complete Next-Gen MDR, Falcon for Mobile | Falcon Insight XDR |
| SentinelOne | Singularity Complete (EDR, Storylines, Purple AI), Wayfinder MDR (formerly Vigilance), Wayfinder Threat Hunting | Vigilance MDR |
| ThreatDown (Malwarebytes) | ThreatDown EDR with 7-day ransomware rollback, Managed Threat Hunting, ThreatDown MDR, Mobile Security | ThreatDown |
| Bitdefender | GravityZone EDR, GravityZone XDR sensors, Bitdefender MDR | GravityZone XDR and Bitdefender MDR |
| TrendAI (Trend Micro) | TrendAI Vision One Endpoint Security (Essentials adds the EDR sensor), Vision One XDR, Security Operations | TrendAI Vision One |
| WatchGuard | Endpoint Security Prime, 360 and Elite (EDR and EPDR), ThreatSync XDR, Core, Total and Open MDR | WatchGuard EPDR and WatchGuard MDR |
| Sophos | Sophos EDR, Sophos XDR (now Powered by Secureworks), Sophos MDR and MDR Plus, Sophos Mobile | Sophos XDR |
| Check Point | Check Point Endpoint Security (Harmony Endpoint) with EDR, cross-product XDR in the Elite edition or as an add-on, Check Point MDR, Check Point Mobile Security | Harmony Endpoint |
| Lookout | Lookout Mobile AI Security (formerly Mobile Endpoint Security), with an optional Advanced SOC module for mobile threat hunting | Lookout mobile security |
| IBM MaaS360 | Unified endpoint management; the Enterprise edition includes mobile threat management, and IBM lists a mobile threat defence add-on | Mobile threat defence |
Specialist vendors that sit beside these platforms are covered further down this page.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
EDR and XDR platforms
These vendors provide the agent, the console and the detection engine. Each one combines prevention and EDR in one agent, and most extend into XDR by adding identity, email, network or cloud signals.
CrowdStrike CrowdStrike's EDR is Falcon Insight XDR, which unifies endpoint detection and response with identity, cloud and mobile telemetry. It brings Real Time Response for remote investigation, Falcon Fusion SOAR workflows, Charlotte AI-assisted investigation and MITRE ATT&CK mapping. We supply Falcon through the bundles CrowdStrike makes available to managed service providers: Falcon Defend, Advanced Defend (adds Adversary OverWatch threat hunting) and Complete Defend (adds Falcon Complete Next-Gen MDR, where CrowdStrike's own team detects and responds for you). Insight XDR is not listed as a component of those bundles, so if you want it for your own team, ask us and we will check the options at quote. Read our Falcon Insight XDR guide, or the CrowdStrike Falcon platform overview.
SentinelOne SentinelOne's endpoint packages are Singularity Control (prevention, behavioural detection, automated remediation, rollback, device control and remote shell) and Singularity Complete, which adds EDR, correlated Storylines, 14 days of searchable telemetry and Purple AI. See SentinelOne Singularity.
ThreatDown ThreatDown is the business brand of Malwarebytes. It sells Core, Advanced, Elite and Ultimate bundles direct; through our OneView console, the multi-tenant console ThreatDown provides to IT providers, modules are switched on per endpoint instead. ThreatDown EDR isolates the network, process or desktop and can restore files encrypted or deleted by ransomware up to seven days back. See ThreatDown.
Bitdefender GravityZone EDR correlates detections across endpoints into one incident, draws the attack chain and maps it to MITRE ATT&CK. GravityZone XDR adds sensors for identity, productivity apps, network, cloud and business applications. Read GravityZone XDR.
TrendAI (Trend Micro) Trend Micro now markets its enterprise security products under the TrendAI brand; the company is still Trend Micro Incorporated. TrendAI Vision One Endpoint Security comes in Core, Essentials (adds the EDR sensor) and Pro (server protection) tiers, and Vision One XDR correlates endpoint, email, network and cloud telemetry. See TrendAI Vision One.
WatchGuard WatchGuard Endpoint Security comes in Basic, Prime, 360 and Elite editions; Prime and above add EDR, and 360 is the edition formerly sold as EPDR. Detections feed ThreatSync, WatchGuard's XDR layer, in WatchGuard Cloud. Read WatchGuard EPDR.
Sophos and Check Point Sophos sells Sophos EDR, Sophos XDR (now Powered by Secureworks, following Sophos's 2025 acquisition of Secureworks) and its managed services on Sophos Central, which Sophos describes as evolving into Sophos Fusion; read more on our Sophos site about Sophos EDR and Sophos XDR. Check Point's Harmony Endpoint, now officially Check Point Endpoint Security, combines prevention, anti-ransomware and EDR in one agent, with cross-product XDR in the Elite edition or as an add-on; see Harmony Endpoint EDR on our Check Point site.
Vendor-run MDR services
EDR raises alerts, and someone has to act on them, including at night and at weekends. If you do not have that cover in-house, several vendors run their own managed detection and response service on top of their platform. Their analysts monitor, investigate and contain threats within the response permissions you agree; we help you choose, set up and agree those permissions, but we do not run a security operations centre ourselves.
| Vendor | MDR service | Runs on |
|---|---|---|
| CrowdStrike | Falcon Complete Next-Gen MDR, in the Falcon Complete Defend bundle | Falcon platform |
| SentinelOne | Wayfinder MDR (formerly Vigilance MDR), part of Wayfinder TDR | Singularity platform |
| ThreatDown | ThreatDown MDR, plus the lighter Managed Threat Hunting service | ThreatDown EDR |
| Bitdefender | Bitdefender MDR | GravityZone EDR and XDR |
| WatchGuard | Core MDR, Core MDR for Microsoft, Total MDR and Open MDR | WatchGuard Endpoint Security, Microsoft Defender for Endpoint or third-party EDR |
| Sophos | Sophos MDR and Sophos MDR Plus (formerly MDR Essentials and MDR Complete) | Sophos Central, now evolving into Sophos Fusion |
| Check Point | Check Point MDR | Check Point Endpoint Security, other Check Point products and supported third-party tools |
For the difference between running EDR yourself and handing it to a managed service, see managed detection and response and EDR vs XDR vs MDR on our Cloud Security site. On this site, read SentinelOne Vigilance MDR, WatchGuard MDR and Bitdefender MDR, or the Sophos and Check Point services on Sophos MDR and Check Point MDR.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Mobile threat defence and mobile EDR
Phones and tablets carry email, files and sign-in prompts, so most endpoint strategies now include them. The vendors we supply for mobile are:
- Lookout Mobile AI Security (formerly Mobile Endpoint Security) for iOS and Android, protecting against phishing, risky apps, device compromise and network attacks. We supply the Essentials and Advanced bundles; optional modules such as Social Engineering Protection and the Advanced SOC module for mobile threat hunting are scoped separately.
- CrowdStrike Falcon for Mobile, which is built on Falcon Insight XDR, brings Falcon detection to iOS and Android and monitors designated corporate apps rather than personal content.
- ThreatDown Mobile Security for iOS and Android devices, licensed per device alongside your ThreatDown computers.
- IBM MaaS360, a cloud unified endpoint management platform whose Enterprise edition includes mobile threat management; IBM also lists a mobile threat defence add-on. We supply the Essentials, Deluxe and Enterprise editions.
- Check Point Mobile Security (Harmony Mobile) and Sophos Mobile, covered on our Check Point and Sophos sites.
Read our guides to mobile threat defence and mobile EDR for how these fit alongside mobile device management.
Specialist vendors that work beside your EDR
Some of the vendors we supply do one job alongside the main platform rather than replacing it:
| Vendor | What it adds | Where it fits |
|---|---|---|
| Halcyon | An anti-ransomware agent that runs beside your existing EDR or antivirus, protects security tools from tampering and captures encryption keys for recovery | Preventing ransomware attacks |
| Keeper Security | Keeper Endpoint Privilege Manager removes standing local admin rights on Windows, macOS and Linux and replaces them with policy-controlled elevation | Endpoint privilege management |
| Absolute Security | Absolute Secure Endpoint, with Persistence in device firmware so its agent can be restored; the Resilience for Security edition adds patch management and Resilience for Automation adds automated vulnerability remediation | Patch management process |
| Acronis | Acronis Cyber Platform, which pairs backup with Acronis EDR, Acronis XDR (email, Entra ID and Microsoft 365) and Acronis MDR | Ransomware prevention |
| Blackpoint Cyber | CompassOne, a platform built around Blackpoint's own 24/7 MDR and ITDR services; the Core package adds application control | Application whitelisting |
Licensing for every vendor on this page is explained on our software licensing site, where you can see how each product is counted: per endpoint, per user or by data volume.
How to shortlist an endpoint security vendor
Rather than starting with a brand, start with your estate and your people:
- Coverage: list the operating systems you run, including servers, Macs, Linux and phones, and check each vendor supports all of them with the features you want.
- Who watches alerts: if nobody can respond out of hours, shortlist vendors whose own MDR service fits your size and budget, or plan an MDR service that can monitor the EDR you choose.
- Beyond the endpoint: decide whether you want identity, email, network or cloud signals correlated in one console. That is the step from EDR to extended detection and response.
- Microsoft 365 fit: if you already pay for Microsoft Defender for Endpoint, compare keeping it with an MDR service that monitors it against moving to another platform.
- Recovery features: look at rollback, ransomware file restore and how the agent protects itself from tampering.
- Licensing: per device or per user, monthly or annual, and what is an add-on rather than included.
Our guides to the best EDR solutions, EDR for small business and EDR deployment go into each step in more detail.
How Forever Systems helps
Because we supply several platforms, we can compare them honestly against your estate, your insurer's questions and your in-house skills, then recommend what fits. We can help with:
- A shortlist of two or three vendors that match your operating systems, risk and budget
- A trial or pilot where the vendor offers one, so you see detections on your own devices
- Rollout: removing the old product, deploying the new agent and building policies
- MDR onboarding: agreeing response permissions and contacts with the vendor's analysts
- One account for licences, changes and renewals across vendors
Pricing depends on vendor, edition, add-ons and quantity, so ask us for a quote. Contact us to talk through which endpoint security vendors suit your organisation.
Vendor and product guides
Falcon Insight XDRCrowdStrike's EDR, unified with identity, cloud and mobile telemetry, and how we supply Falcon.
Vigilance MDRSentinelOne's managed detection and response service, now Wayfinder MDR, explained.
WatchGuard EPDRWatchGuard EPDR is now Endpoint Security 360: the renamed editions, features and modules.WatchGuard MDRWatchGuard's 24/7 MDR service: Core MDR, Core MDR for Microsoft, Total MDR and Open MDR compared.
GravityZone XDRBitdefender's EDR plus native XDR sensors for identity, Microsoft 365, network, cloud and business apps.Bitdefender MDRBitdefender's managed detection and response on GravityZone: what its SOC does and what you agree up front.How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
Who are the main endpoint security vendors?
Widely used business endpoint security vendors include CrowdStrike, SentinelOne, Microsoft, Sophos, Check Point, Bitdefender, Trend Micro (now TrendAI), ThreatDown (Malwarebytes) and WatchGuard. We supply all of these except Microsoft licences, which Forever Group handles separately, and can recommend what fits your estate.
What is the difference between an EDR vendor and an MDR provider?
An EDR vendor makes the agent, console and detection technology. An MDR provider supplies people who watch that technology and respond to threats around the clock. Several EDR vendors, including CrowdStrike, SentinelOne, Bitdefender, WatchGuard, ThreatDown and Sophos, also run their own MDR services.
Can I mix endpoint security vendors?
Yes, within limits. You should run one main EDR agent on each device to avoid conflicts, but you can add specialist tools beside it, such as Halcyon for ransomware, Keeper Endpoint Privilege Manager for admin rights or Lookout on phones. Some MDR services, such as WatchGuard Open MDR, can also monitor another vendor's EDR.
Do all endpoint security vendors support Mac and Linux?
Most of the vendors we supply cover Windows, macOS and Linux, but features differ by platform, for example rollback or device control, and Lookout and IBM MaaS360 cover phones and tablets rather than computers. We can check support for your exact operating systems before we recommend a product.
How are endpoint security products licensed?
Most are licensed per endpoint, some per user, and add-ons such as SIEM data by volume. Billing can be monthly or annual depending on the vendor. Ask us for a quote and we will set out exactly what is counted.
Where can I compare antivirus products?
This site focuses on detection and response. For antivirus, next-generation antivirus and endpoint protection platform editions, see our sister site endpointprotection.uk.
Still have a question about endpoint security vendors?
Ask us and a member of our team will reply by email.