Business Security Test H1 2026 (March – June)

Avast Ultimate Business Security:
https://www.avast.com/en-us/business/products/ultimate#pc

Bitdefender GravityZone Business Security Premium:
https://download.bitdefender.com/resources/media/materials/business/en/bitdefender-business-security-datasheet.pdf

Cisco Secure Client:
https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/secure-client-aag.html

CrowdStrike Falcon Enterprise:
https://assets.crowdstrike.com/is/content/crowdstrikeinc/falcon-endpoint-protection-enterprise-data-sheetpdf

Elastic Security:
https://www.elastic.co/guide/en/security/current/index.html

ESET PROTECT Entry with ESET PROTECT Cloud:
https://web-assets.eset.com/fileadmin/ESET/INT/Docs/Others/ESET_B2B_solutions_overview_landscape_WEB_render.pdf

G DATA Endpoint Protection Business:
https://www.gdata.help/display/BS/Business+Solutions

K7 On-Premises Enterprise Security Advanced:
https://www.k7computing.com/us/pdf/k7-enterprise-brochure.pdf

Kaspersky Endpoint Security (Select, with KSC):
https://content.kaspersky-labs.com/se/media/de/business-security/KESB_Product_Datasheet_Advanced_Customer.pdf

ManageEngine Endpoint Central with Malware Protection:
https://www.manageengine.com/products/desktop-central/features.html?ec-home

Microsoft Defender Antivirus with Microsoft Endpoint Manager:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/?view=o365-worldwide

Norton Small Business:
https://us.norton.com/products/small-business

SenseOn Platform with EPP:
https://www.senseon.io/protect

Sophos Intercept X Advanced:
https://assets.sophos.com/X24WTUEQ/at/2b38x8h3fjg68jmm7tvbsp8m/sophos-intercept-x-ds.pdf

Trellix Endpoint Security (ENS):
https://www.trellix.com/en-us/assets/solution-briefs/trellix-endpoint-protection-platform-solution-brief.pdf

VIPRE Endpoint Detection & Response:
https://www.vipre.com/wp-content/uploads/2023/12/vipre-ds-edr-endpoint-detection-and-response.pdf

Avast Ultimate Business Security includes a next-gen antivirus with online privacy tools and patch management automation software to help keep business devices, data, and applications updated and secure.

Key Features

Online Management Platform: Get real-time visibility of cyberthreats, comprehensive reporting, and administrative capabilities – right from your web browser. A cloud-based console lets you centrally manage your Avast Business security services and their subscriptions.

Next-gen Antivirus: Next-gen endpoint protection with File Shield, Web Shield, Mail Shield, real-time Behaviour Monitoring, and Cloud Sandbox help secure users’ devices against malware infections and zero-day threats.

Advanced Firewall: Monitor network traffic between your employees’ devices and the internet. Improve blocking of dangerous or superfluous data transmissions for better protection of your business against malicious data manipulation.

Ransomware Shield: Reinforce the protection of your sensitive data and other critical business documents against modification, deletion, or encryption by ransomware attacks. Choose which applications have permission to access your protected folders and block the rest.

Real Site: Real Site supports safer web browsing and banking by helping your employees avoid fake websites created to steal sensitive data such as usernames, passwords, and credit card details. It is designed to secure users against DNS (Domain Name System) hijacking.

Browser Shield: Secure your browser-stored passwords against theft. Prevent unwanted programs from accessing browser cookies to protect your personal and sensitive data.

VPN: Built-in personal VPN with no data limits encrypts your data traffic over the internet to help protect your employees’ data, making them also private when using public Wi-Fi networks, such as those in cafes or the airport.

USB Protection: Prevent employees from using unauthorized removable storage devices, including flash drives, external drives, and memory cards to avoid data theft, data loss, and malware infections.

Web Control: Create a safer, more productive business environment for you and your employees by controlling their access to potentially dangerous or non-work-related websites through web domain and content filtering.

Patch Management: Automatically fix vulnerabilities in Windows and third-party applications that are susceptible to cyberattacks by remotely patching devices, no matter where they are. Patch Management helps you distribute tested patches to hundreds of devices in minutes, with minimal impact on your network.

GravityZone Business Security Premium is designed to protect small to medium organizations, covering any number of file servers, desktops, laptops, physical or virtual machines. It is based on a layered next-gen endpoint protection platform with prevention, detection and blocking capabilities, using machine learning techniques, behavioural analysis, and continuous monitoring of running processes.

Key Features

Effortless Deployment: The GravityZone agent is designed for easy deployment across multiple systems, providing immediate protection without requiring reboots or extensive configuration.

Machine Learning Anti-Malware: Bitdefender’s machine learning models utilize 40,000 features and billions of file samples to predict and block advanced attacks effectively, improving malware detection accuracy while minimizing false positives.

Process Inspector: Operating in zero-trust mode, Process Inspector continuously monitors all processes in the system, detecting suspicious activities and anomalous behaviours. It effectively identifies unknown advanced malware, including ransomware, and takes remediation actions such as termination and undoing changes.

Advanced Anti-Exploit: This technology protects memory and vulnerable applications by detecting and blocking exploit techniques like API caller verification, stack pivot, and return-oriented-programming (ROP).

Integrated Risk Analytics: Evaluates endpoint risks continuously to identify and prioritize misconfigurations. Automates hardening actions and detects risky user behaviours, such as insecure logins and poor password practices.

Endpoint Control and Hardening: Policy-based controls include firewall management, USB scanning for device control, and web content filtering with URL categorization.

Anti-Phishing and Web Security Filtering: Real-time scanning of web traffic, including SSL, HTTP, and HTTPS, prevents the download of malware. Anti-phishing protection automatically blocks fraudulent web pages.

Response and Containment: GravityZone automatically blocks and contains threats, terminates malicious processes, and rolls back unauthorized changes.

Ransomware Protection: Bitdefender can detect new ransomware patterns, offering robust protection against evolving threats.

Automate Threat Remediation and Response: GravityZone neutralizes threats through actions such as process terminations, quarantine, removal, and rollback. Real-time threat information sharing with Bitdefender’s cloud-based threat intelligence service prevents similar attacks globally.

GravityZone Control Center: GravityZone Control Center is an integrated and centralized management console that can be cloud-hosted or deployed locally, providing comprehensive oversight and management of all security components.

Cisco Secure Client is Cisco’s unified security agent. It builds upon the modular approach of AnyConnect and incorporates Cloud Client Management. The solution can be deployed as a standalone product or integrated with Cisco XDR and allows organizations to deploy a range of security modules through a single agent.

Key Features

Unified Security Agent: Cisco Secure Client combines secure connectivity and endpoint security capabilities within a single agent for Windows, macOS, and mobile devices.

Cloud Client Management: Centralized cloud-based management enables administrators to deploy, configure, and monitor endpoint security policies across their environments.

Cisco Secure Endpoint: One of the security modules available within Cisco Secure Client. It provides endpoint protection, endpoint detection and response (EDR) capabilities, and integrates with Cisco XDR.

Protection Technologies: Multiple protection layers, including machine learning, behavioural analysis, reputation services, and threat intelligence, support the identification and blocking of known and unknown threats.

Endpoint Detection and Response (EDR): Continuous monitoring of endpoint activity provides visibility into security events and supports investigation and response activities.

Extended Detection and Response (XDR): Integration with Cisco XDR enables the correlation of endpoint telemetry with data from other security controls for investigation and response.

Threat Intelligence: Cisco Talos Intelligence provides continuously updated threat intelligence to help identify and prevent emerging threats.

Secure Connectivity: Provides secure and consistent connectivity across wired, wireless, and VPN environments for desktop and mobile users.

Device Trajectory: Visual mapping of endpoint activity helps analysts understand attack progression and investigate security incidents.

Cisco Secure Access: Another security module available within Cisco Secure Client, providing Security Service Edge (SSE) functionality including Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), and VPN-as-a-Service (VPNaaS).

Additional Security Capabilities: Cisco Secure Access also provides Digital Experience Monitoring (DEM), Remote Browser Isolation (RBI), AI application visibility and control, AI-assisted policy creation, and AI-powered threat detection.

Unified Policy Management: Enables centralized and context-aware policy management across endpoint security and connectivity components.

Integrated Security Modules: Additional modules include Cisco Umbrella, which provides DNS-layer security and web protection to help block access to malicious domains, IP addresses, and websites.

Deployment: Cisco Secure Client can be deployed and managed across distributed environments.

CrowdStrike Falcon Enterprise offers cloud-native capabilities through a lightweight agent and a centralized command center. In addition to threat protection, it provides investigative functions and threat intelligence for analysis and remediation of attacks. The solution is scalable, making it suitable for managing networks with thousands of devices.

Key Features

Easy to deploy: The Falcon agent is easy to deploy at scale, offering instant protection without the need for a reboot or tuning processes.

Advanced Threat Detection: Falcon Enterprise is designed to detect advanced and unknown threats, including fileless attacks, ransomware, adware, and potentially unwanted programs.

Full Attack Visibility: The solution provides attack visibility through a process tree. It unravels complete attack scenarios, enriches them with contextual threat intelligence, and maps adversary behaviours using MITRE ATT&CK® terminology.

Signatureless Approach: Falcon Enterprise does not rely on signatures, eliminating the need for daily virus definition updates. This reduces the administrative overhead and ensures protection against emerging threats.

Exploit Blocking: The solution proactively blocks the execution and spread of threats through unpatched vulnerabilities, preventing potential exploitation.

On-Write Quarantine: Falcon Enterprise detects and isolates malicious files as soon as they appear on a host, ensuring they are contained and unable to cause harm.

Custom Indicators of Attack (IOAs): Teams can utilize custom IOAs to create behaviour-based blocking rules tailored to their specific organizational needs, providing enhanced protection against targeted attacks.

Advanced Memory Scanning: Automated memory scans are performed using behavioural triggers to prevent fileless and memory-based attacks, such as ransomware and the use of dual-purpose tools like Cobalt Strike, earlier in the kill chain.

Quarantine Functionality: Blocked files are quarantined, allowing analysts to access and investigate them for deeper analysis and understanding of the threat landscape.

Script-Based Execution Monitoring: Falcon Enterprise inspects and blocks malicious office macros, preventing script-based attacks.

Incident Response Acceleration: The solution accelerates incident response workflows by offering automated, scripted, and manual response capabilities. This streamlines the incident management process and enables faster resolution.

Device Control: Falcon Enterprise includes Falcon Device Control, providing the visibility and control of USB device usage.

Firewall Management: Falcon Enterprise includes Falcon Firewall Management, delivering centralized host firewall management, making it easy to manage and enforce host firewall policies.

Built-in Threat Intelligence: Falcon Enterprise integrates comprehensive threat intelligence, strengthening detection capabilities and enhancing the efficiency of Security Operations Centers (SOCs). From automatic sandbox submissions of blocked files to actor profiles, analysts can gain valuable insights into threats and adversaries without exposing their local systems and network infrastructure.

Elastic Security’s native endpoint protection component, Elastic Defend, provides prevention, detection, investigation, and response capabilities for Windows, macOS, and Linux systems. Operating at the operating-system level, it collects detailed telemetry on process, file, network, registry, and memory activity to support threat detection and incident investigation. Elastic Security combines endpoint protection, threat detection, investigation, response, and automation capabilities within a unified platform and can also ingest telemetry and alerts from third-party security products.

Key Features

Native and extended endpoint protection
Elastic Defend provides endpoint protection for Windows, macOS, and Linux. In addition, Elastic Security can integrate telemetry and alerts from third-party endpoint security solutions, enabling centralized visibility and management across heterogeneous environments.

Multi-layered malware and threat prevention
Elastic Defend combines machine-learning models, signature-based detection, behavioural analysis, and memory-threat protection to detect and prevent malicious activity. Additional protection mechanisms are included to identify and mitigate ransomware and other advanced threats.

Endpoint visibility and telemetry collection
The platform collects detailed endpoint telemetry, including process, file, network, DNS, registry, and DLL activity. Integrated Osquery support enables administrators and analysts to perform live or scheduled endpoint queries for investigation and system assessment purposes.

Integrated investigation and response capabilities
Elastic Security provides response actions such as host isolation, process termination, malware scanning, and forensic artifact collection. Investigation workflows are integrated into the management console and support role-based access controls and auditing.

Automation and orchestration
Built-in automation capabilities allow organizations to create workflows that can be triggered by alerts, schedules, or API calls. Automated actions can be applied across endpoint, SIEM, cloud, identity, and third-party security components.

Transparent detection framework
Elastic publishes many of its detection rules and protection logic through publicly accessible repositories. Detection content is aligned with the MITRE ATT&CK® framework to assist organizations in understanding and evaluating coverage.

Flexible deployment options
Elastic Security supports deployment in connected, restricted-network, and air-gapped environments. Security content and updates can be distributed through internal infrastructure when direct Internet access is not available.

Centralized policy management
Security policies, protection settings, exceptions, trusted applications, event filters, and blocklists can be managed centrally, allowing organizations to tailor protection levels and telemetry collection to operational requirements.

Elastic Security Labs
Elastic Security Labs is Elastic’s internal threat research team. Research findings contribute to the development of detection rules, machine-learning models, and threat intelligence used by the platform.

ESET PROTECT provides real-time visibility across all endpoints, ensuring users always in the know. Plus, comprehensive reporting and security management cover every operating system (OS). ESET PROTECT Platform is powered by ESET LiveSense®, ESET’s multi-layered technology that combines machine learning and ESET LiveGrid®, ESET’s global, cloud-based threat intelligence network. It’s security made simple and powerful.

Key Features

Combines cybersecurity needs: ESET PROTECT Platform consolidates multiple cybersecurity capabilities, empowering customers to select the most effective tools for safeguarding their organization. It offers simplicity, scalability, tailored solutions, modularity, adaptability, and continuous innovation.

Protection across various platforms: ESET’s security solution covers Windows, Linux, and macOS, leaving no room for vulnerabilities. But that’s not all—we go beyond. Android and iOS devices are safeguarded under the same license, and your servers are also part of this all-in-one protective umbrella. It’s security without compromise.

Modern endpoint protection and comprehensive multi-layered defense: ESET PROTECT Entry leverages advanced, multi-layered technologies that surpass basic antivirus or antimalware solutions. It shields against ransomware, botnets, targeted attacks, data breaches, zero-day threats, fileless attacks, anti-phishing, and advanced persistent threats, ensuring robust protection for endpoints.

Accessible endpoint security: ESET’s endpoint security solution is available in 23 languages, making it the most accessible and easy-to-use option on the market. Whether you are in a bustling metropolis or a remote village, ESET’s global technology ensures you’re covered.

In-house security research and development: ESET’s teams not only develop products but also share elite know-how and intelligence through research. They pioneered investigations into the Sandworm group, leading to some of the most significant discoveries in cybersecurity. ESET’s discoveries, such as Industroyer, KrØØk, and Lojax, provide warning of threats on a global scale. Organizations can leverage this expertise by using ESET technology and solutions. ESET is also currently among the top 5 contributors and top 10 referenced sources in the MITRE Enterprise Matrix. This positions us as a valuable intelligence provider regarding tactics, techniques, and procedures (TTPs) exploited by diverse Advanced Persistent Threat (APT) groups. ESET’s research teams are widely recognized by leading technology media worldwide, reinforcing their authority and impact in the cybersecurity landscape.

Hyperlocal language support: Wherever you are on the globe, ESET provides support in your language. Both cloud and on-premises management consoles are available in 23 languages, ensuring a seamless experience for users worldwide.

Advanced remote management with one-click actions: Gain granular visibility into your IT environment. Monitor threats, track user activity, and manage quarantined items – all from a single, intuitive interface. Actions such as isolating the device from the network, creating an exclusion, or initiating a scan are available with a single click in the cloud-based or on-prem ESET PROTECT console.

Deep-dive insights into the network: ESET PROTECT Platform provides over 120 built-in reports and allows you to create custom reports from over 1000 data points.

Real-time alerts about incidents in your organization: Use pre-defined notifications or create your own. The notification system features a full “what you see is what you get” editor.

Effortless and quick installation: Deploy pre-configured live installers that automatically activate and connect your endpoints to the management console.

Ultra-light solution on your system: ESET PROTECT Entry boasts an ultra-light impact on system performance. Its cloud-powered, multilayered security ensures robust protection without slowing down your devices.

Cutting-edge cybersecurity: As a frontrunner in machine learning since the 1990s, ESET was the first to identify security threats via the UEFI (Unified Extensible Firmware Interface). It introduced the UEFI Scanner to combat these threats effectively. Additionally, ESET was among the first to provide ARM-specific protection, staying ahead of emerging risks.

Improved total cost of ownership (TCO): ESET PROTECT Platform enhances the TCO of security management. By streamlining processes and minimizing resource usage, it ensures efficient and cost-effective security administration.

G DATA Endpoint Protection Business is a long-standing product line that has developed from a static scanning engine only product into incorporating next generation scanning and heuristic technologies. These technologies help us detect and prevent malware even when normal scanning approaches fail.

Key Features

Privacy by design: G Data’s development only happens in Germany, which had very strict data privacy laws even before the GDPR, employing strict privacy by design and by default rules in the development of their software.

Online and offline protection: G Data’s products offer very strong offline and local protection by design. Protection modules work offline and do not require a cloud connection, although the cloud connection does improve detection against latest and unknown threats.

BehaviorStorage (BEAST) module: This module runs locally on the client and does not transmit user behaviour data into a cloud. BEAST is able to run completely independent of Internet connectivity and can still classify suspicious or malicious activity.

In house support: Support is not outsourced, being involved in the development processes which enables G Data to fix errors reported by customers.

MMC style admin: Allowing for easy use by Windows administrators.

K7 Security simplifies deployment and management, protecting client workstations and critical servers. The Centralised Management Server consolidates threats, implements endpoint security policies, and manages them with fewer IT resources. The web-based console handles K7 software installation on multiple endpoints, user group creation, policy enforcement, task scheduling, updates, and remote management of core capabilities such as Antivirus, Firewall, Application Control, and Web Content Filtering.

Key Features

Admin Console: The web-based interface enables complete security settings management, including client installation, group and policy management, task scheduling, updates, and control over Antivirus, Firewall, Application Control, Web Filtering, and Notifications.

Advanced Malware Detection and Remediation: The Host Intrusion Prevention System collates, analyses and triages various events to effectively detect and deal with malware. This feature deals with analysis of both pre-execution and runtime behaviour of monitored objects in the host.

Anti-Ransomware Protection: Monitors secured devices for ransomware, employing signature-less, behaviour-based detection mechanisms. K7 Ecosystem Threat Intelligence enhances protection against known and new ransomware variants. Real-time security defends against ransomware distribution through shared files and folders on the network.

K7 Device Control: This prevents USB and storage media infections by blocking unauthorized access to unknown devices. Host-level policies enforce device password access, file execution control, and on-demand/automatic device scanning.

K7 SafeSurf: This ensures secure online browsing by identifying and blocking malicious websites through URL analysis and cloud-based reputation services.

K7 Firewall / HIPS: The K7 Firewall, working with the integrated Host Intrusion Prevention System (HIPS), stealths system ports and protects against direct attacks. The Intrusion Detection System (IDS) blocks known malicious network-based exploits before processing.

System Security and Performance: K7 Security prioritizes system performance by utilizing a proprietary lean data-loading algorithm and ordering mechanism, minimizing RAM and CPU usage.

Web Categorisation: Web Categorization allows administrators to define website and content access for company devices, limiting access to unproductive or inappropriate sites.

Groups and Policies: Endpoint security is managed through groups and policies, controlling malware detection, and user settings. Default settings provide optimum security, and end-users are limited to updates and scans.

Application control: This enables automatic reporting and blocking of applications, including version-based blocking.

Fine control of administrative privileges: Administrative privileges can be fine-tuned with custom roles and group-based administration.

Scans: Options include Quick Scan, Full System Scan, and Vulnerability Scan, with patch links. Scans can be scheduled and deployed to desired endpoints.

Kaspersky Endpoint Security is a next-gen endpoint security solution which can secure organizations against a wide range of threats, from BIOS-related to fileless threats. The solution provides crucial endpoint management and security tools to IT administrators and cybersecurity specialists in organizations of any size and type.

Key Features

Protect user data: Kaspersky Endpoint Security protects all endpoints against widespread and emerging threats, thanks to Kaspersky technologies like behaviour-based protection from advanced threats including fileless ones, ML-based analysis, and specific protection against exploits, ransomware, miners and financial spyware. Recognizing threat behaviour patterns, allows for the neutralizing of unknown threats.

Proactive protection: Stops attacks before they start. System hardening by Adaptive Anomaly Control combines the simplicity of blocking rules with the smartness of automatic tuning, based on behaviour analysis.

Reduced attack surface: This is achieved by controlling what applications, websites and devices can interact with endpoints and users.

Complete ecosystem: Users can grow their IT security maturity. Automated response and analysis leverages integrations with EDR and SIEM solutions

Single solution for any platform: Security for every workstation, server and mobile device that carries user data, regardless of location and ownership.

Cross platform support: A single solution, working from a single console covers every OS in a mixed environment.

High levels of automation: Particularly for essential but routine tasks such as patching and OS deployment.

Remote management capabilities: Covering different scenarios, like setting up workstations in home offices or securing data with encryption options.

Centralization: Integrated single-screen management, either at the user’s perimeter or in the cloud.

Futureproofing: Upgrading is seamless, allowing users to move through the tiers. The fully scalable solution is ready to support thousands of managed devices as companies grow.

Flexibility: Users can choose their preferred deployment option: in the cloud, on-premises, air gapped and in hybrid deployments. Then they can allocate different levels of security systems access to different team members with granular role-based access control (RBAC).

ManageEngine Endpoint Central with Malware Protection delivers comprehensive endpoint security through a single, lightweight agent. It offers 360-degree visibility and centralized control over all endpoint activities, scaling seamlessly as your business grows. The solution is easy to deploy and supports both on-premises and cloud environments.

Key features:

Next-Gen Antivirus: Provides end-to-end malware detection covering everything from files to memory, with both behaviour patterns and anomalies used for analysis. It leverages ML-based behavioural detection to identify unknown and fileless malware and uses signature-based detection for known variants. It employs a multi-layered detection approach to effectively identify a broad spectrum of malware. This includes advanced memory scanning to uncover memory-resident threats and evasive code execution, exploit detection to defend against zero-day attacks and vulnerability exploitation, and on-demand and file-write scans for comprehensive file analysis. In the event of malware infiltration, infected endpoints are automatically quarantined to prevent further spread, and complete malware removal ensures full system recovery.

Ransomware protection: Employs behavioural detection without relying on frequent definition updates. Reconstruct the complete attack timeline by tracing the malware process tree using MITRE ATT&CK® technique identifiers and indicators of compromise to uncover attacker tactics, techniques, and procedures and gain insights into the entry point, lateral movement, and overall impact. In the event of ransomware encryption, Endpoint Central offers single-click data recovery using Windows VSS backup, ensuring business continuity.

Comprehensive patching: Patch servers, laptops, and workstations across multiple OSs from a single console. Automatically scan for missing patches and deploy updates for over 850 apps, including third-party software. Maintain complete control over patch compliance with real-time analytics and audits.

Device control: Stay vigilant over peripheral device activity on your network with support for 15+ device types. Regulate the entry of peripheral devices into your enterprise by curating a trusted device list and blocking all others. When necessary, set a duration to provide temporary access for devices not in the trusted device list. Monitor file activity through file shadowing and tracing to prevent insider threats and plug-in-based attacks.

Vulnerability detection and remediation: Continuously scan endpoints in real time for vulnerabilities, detect and mitigate zero-day threats, enforce compliance with standards like CIS benchmarks, isolate non-compliant devices, and audit your network for risky software and open ports.

Data loss prevention (DLP): Define what constitutes sensitive data for your business, scan endpoints for sensitive data, and continuously monitor the movement of sensitive data across your network. Block unauthorized transfers of sensitive data across the cloud, email, peripheral devices, browsers, clipboards, and more.

Browser security: Create a secure enterprise browsing experience without requiring a dedicated enterprise browser. Gain granular control over any browser by managing everything from blocking malicious extensions and unauthorized websites to regulating web downloads. Enforce strict security policies to prevent code injection and other malicious attacks.

App control and privilege management: Ensure that only enterprise-approved apps are installed on business devices, block unauthorized app installations, and provide on-demand, time-limited access to apps when required. Revoke unnecessary local admin rights and manage user privileges to prevent privilege escalation-based cyberattacks.

BitLocker encryption: Encrypt every device that connects to your network, regardless of the TPM status, using advanced encryption methods. Maintain complete control over the life cycle of recovery keys, including automated periodic rotations.

Microsoft Defender Antivirus is pre-installed on Windows 10/11 systems. In business environments, it can be managed e.g. with Microsoft Defender for Endpoint’s P1 plan. It combines machine learning models trained on cloud-scale data and behaviour-based detection to protect in real-time against malware and malicious activity.

Key Features

Defender for Endpoint’s P1 plan (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1) allows security teams to do the following:

Eliminate blind spots in their environment: Discover unmanaged and unauthorized endpoints and network devices. Secure these assets using integrated workflows.

Block sophisticated threats and malware: Examples include novel polymorphic and metamorphic malware, and fileless and file-based threats. With cloud-delivered, next-generation protection, analysts benefit from near-instant detection and blocking of these threats.

Apply manual response actions: Security teams can act on devices or files when threats are detected, such as quarantining them.

Harness attack surface reduction capabilities: Harden devices, prevent zero-day attacks, and take granular control over endpoint access and behaviours. These capabilities include rules, ransomware mitigation, device control, web protection, network protection, network firewall, and application control.

Access unified security tools and centralized management: The Microsoft Defender portal provides security teams access to unified security tools and centralized management. This can be used to monitor and respond to alerts of potential threats and can go beyond protecting endpoints to securing across identities, data, apps, and infrastructure. Security administrators can use role-based access control from the Microsoft Defender customizable portal to manage which users have access to which assets.

Customize the experience for what matters to your organization: The landing page provides a customizable view that shows at-risk devices, threats detected, alerts/incidents and actionable information depending on which Microsoft Defender capabilities the organization is using. Examples of what you can see:

• Incidents & alerts: Displays incidents created in response to alerts triggered by detected threats across devices
• Action center: This lists remediation actions taken. Analysts can see details like investigation package collection, antivirus scan, app restriction, and device isolation.
• Reports section: This section includes reports that show threats and their status.
• Device Inventory: A list of the devices in the user’s network that triggered alerts. This shows domain, risk level, OS platform, and other details for easy identification of devices most at risk.

Norton Small Business provides comprehensive, easy-to-manage cybersecurity for businesses with up to 20 devices. Designed for small business owners who need enterprise-grade protection without the complexity, Norton Small Business delivers always-on security across Windows, Mac, Android, and iOS devices – all managed through a cloud-based portal that requires no IT expertise to operate.

Key Features

Cloud Management Console: Norton Small Business is managed through the My Norton cloud portal, giving business owners visibility into device protection status. The Employee Management feature allows owners to invite employees via email or link to self-enroll, and manage devices centrally without on-premise infrastructure.

Next-Gen Antivirus and Malware Protection: Always-on real-time protection powered by Norton’s award-winning antivirus engine defends against viruses, malware, ransomware, and zero-day threats. Smart Scan performs comprehensive scheduled and on-demand scans covering malware, network vulnerabilities, privacy threats, and performance risks across all protected devices.

Smart Firewall: Norton’s Smart Firewall monitors network traffic to help prevent sensitive data from leaving devices and block intrusion attempts. It includes automatic Windows Firewall management, application rules, port protection, ARP and DNS spoofing protection, Wi-Fi SSL MITM detection, and IPS functionality with signature-based detection and app URL monitoring.

Internet Security and Phishing Protection: Safe Web blocks access to malicious and fraudulent URLs in real time. Norton Secure Browser adds Web Shield, privacy guard, ad blocking, and anti-tracking. Safe Search provides pre-click warnings on search results to help employees avoid dangerous sites before they visit them.

Dark Web Monitoring: Norton Small Business monitors the dark web for both personal and business identity data, including company name, employer ID number, domain name, DUNS number, VAT number, and a range of personal credentials. Business owners are alerted if their data is found so they can act quickly.

VPN: Norton Secure VPN encrypts internet connections to protect business data on public Wi-Fi networks. It includes auto-connect on compromised networks, kill switch, split tunnelling, and ad tracker blocking.

Cloud Backup: Automatically backs up selected business files and folders to secure cloud storage, protecting against data loss from ransomware, hardware failure, or device theft. Storage capacity varies by plan.

Software and Driver Updater: Software Updater automatically identifies outdated applications and recommends updates to close security vulnerabilities. Driver Updater scans for outdated, missing, or vulnerable drivers and updates them from a library of over 60 million malware-verified drivers.

Password Manager: An encrypted cloud-based vault stores usernames, passwords, credit card information, and other sensitive credentials across all devices. The password manager assesses password strength and auto-populates login fields to reduce risk from weak or reused passwords.

Norton Utilities Ultimate: Keeps business PCs running at peak performance through automated cleaning of junk files, broken registry keys, and browser data. Includes startup process management, disk optimization, data recovery, and an uninstall simulator to safely evaluate and remove unnecessary software.

Business Tech Support (Premium): 24/7 remote IT support from Norton experts covers device setup, network configuration, software troubleshooting, OS upgrades, and advanced diagnostics — available five times per year with no need for on-site service.

EPP complements SenseOn’s platform to deliver full protection, visibility of threats, and deception across an entire organisation’s infrastructure. Combined with SenseOn’s patented AI triangulation, it provides cost-effective endpoint protection, next-gen antivirus, and antimalware without compromising on quality – all into one consolidated platform.

Key Features

Advanced on-access: Automatically scans files upon access to determine if they are malicious, ensuring continuous protection.

Quarantine: Quarantine malicious files to prevent ransomware attacks and mitigate their impact – with options for automated or human-in-the-loop response.

Behavioural analysis: Accurately detect anomalies and zero-day attacks through machine learning algorithms and behavioural analytics.

Anti-tampering: Equip your organisation with robust safeguards to detect unauthorised changes to the agent, ensuring the reliability and integrity of SenseOn against adversarial activities.

Application protection: Guard against memory overflow attacks, injection notifications, malicious behaviours, or process group alerting that exploit processes in memory.

Ransomware protection: Proactively detect and prevent ransomware infections before they can encrypt your data or disrupt your operations by applying restrictive access control to sensitive locations.

Swift deployment: No need to wait for months to hit the ground running. SenseOn’s security architecture deploys through a single piece of software within minutes.

Compatibility with existing infrastructure: SenseOn supports a variety of endpoints, servers, and network devices, ensuring seamless integration with your current IT environment. SenseOn’s API enables ingestion of alerts from other tools to streamline analyst workflow. Even better, these sources are correlated and analysed in parallel in real-time, ensuring customers understand the full context of alerts.

User-friendly platform: With limited IT resources in mind, SenseOn’s platform is easy to deploy, configure, and manage. SenseOn’s support team is on hand 24/7 to provide human assistance.

Sophos Intercept X Advanced is an endpoint security solution designed to minimize the attack surface and prevent attacks. It combines multiple technologies, including anti-exploit, anti-ransomware, deep learning AI, and control technology to detect and block threats before they can impact users’ systems.

Key Features

Stop Unknown Threats: Intercept X utilizes deep learning AI to identify and block malware that hasn’t been seen before. It analyses file attributes to detect threats without relying on signatures.

Block Ransomware: Intercept X incorporates anti-ransomware capabilities that identify and block the encryption processes used in ransomware attacks. Encrypted files can be rolled back to a safe state, minimizing the potential impact.

Prevent Exploits: The anti-exploit technology in Intercept X prevents attackers from leveraging exploit techniques to compromise devices, steal credentials, and distribute malware. This protection extends to file-less attacks and zero-day exploits.

Reduce the Attack Surface: Users have control over the apps and devices allowed to run in their environment. Intercept X enables blocking of malicious websites and potentially unwanted apps (PUAs).

Synchronized Security: Sophos solutions work together seamlessly. For instance, Intercept X and Sophos Firewall share data to isolate compromised devices during cleanup, restoring network access once the threat is neutralized, all without requiring admin intervention.

Straightforward Management: Intercept X is managed through Sophos Central, the cloud-based management platform for all Sophos solutions. This centralized management approach simplifies deployment, configuration, and management, including remote working setups.

AI and Expert Powered Data: Intercept X combines the power of deep learning AI with the expertise of Sophos Labs cybersecurity professionals to provide robust protection and accurate threat detection.

Trellix Endpoint Security (ENS) is a comprehensive security solution designed for enterprise networks of all sizes. The ePolicy Orchestrator management console offers flexible options, including both cloud-based and on-premises consoles, for efficient management of the endpoint protection software.

Key Features

Customizable Dashboard: The dashboard and reporting can be tailored to display relevant endpoint status information for each user.

Deployment Flexibility: The console offers a variety of deployment options, including cloud-based, on-premises hosting, and Amazon hosting.

Management Console: The ePolicy Orchestrator console is easily accessed through the primary navigation menu located at the top left of the main dashboard. It provides access to different sections and pages, such as Dashboard, Reporting, Policy Management, Automation, and Software and Systems Administration. Integration of additional components like DLP, Mobile Security, and Insights Threat Intelligence and EDR is also available.

ML Protect: Through machine learning classification, threats are detected in real time, and behaviour classification continually evolves to identify future attacks. Endpoints are restored to the last known good state, preventing infections and reducing administrative burdens.

Adaptive Scanning: The system intelligently skips scanning trusted processes and gives priority to suspicious processes and applications during scanning.

Endpoint Client Deployment: Client agent packages can be created on the Product Deployment page. The installer file can be distributed via a web link, manually executed, or deployed through a systems management product. After installation, the agent downloads the necessary protection engine before full protection becomes active. The client interface displays the installed and enabled protection components.

Web Control: This feature ensures safe browsing by providing web protection and filtering for endpoints.

Hostile network attack blocking: The integrated firewall utilizes reputation scores based on GTI to safeguard endpoints against botnets, DDoS attacks, advanced persistent threats, and suspicious web connections. During system startup, the firewall only allows outbound traffic, providing protection when endpoints are not connected to the corporate network.

Antimalware protection: Trellix protects, detects, and corrects malware quickly with an antimalware engine that works across multiple devices and operating systems.

VIPRE Endpoint Detection & Response provides comprehensive endpoint protection with next-gen antivirus (NGAV) and EDR features combined into a seamless platform. Designed to automatically block the vast majority of threats, and to provide for quick and efficient containment and investigation of potential threats, VIPRE provides everything you need to keep your endpoints and users safe.

Key Features

Detailed endpoint and network protection: This includes a full IDS, DNS Protection, and browser exploit prevention. The core NGAV components scan for and remove any latent malware, and behavioural process monitoring ensures that apps and users behave. The EDR layer on top of these core components orchestrates response to zero-day and persistent threats that can’t be immediately identified as malicious, but that represent a possible threat.

Supports investigation: EDR bundles in endpoint vulnerability scanning, raw event telemetry, and detailed root cause analysis. VIPRE Endpoint Detection & Response (EDR) includes access to cloud-based malware analysis sandboxes to investigate suspicious files and URLs, with detailed results presented right in the console. It also includes a simple method to isolate endpoints that are misbehaving, to prevent attack spread and give you time to understand what is happening on the endpoint.

Remediate threats on endpoints: EDR will help patch vulnerable applications automatically and provides for integrated remote access to the endpoint to clean up files, processes, registry keys, and more. Any files corrupted by zero-day ransomware will be restored. Any security gaps identified by your investigation can be closed quickly.

Single Interface: VIPRE EDR combines all these tools into a clean, easy to use interface that helps speed response times and reduce confusion. Mobile responders can access everything from their smartphones, avoiding the expense, annoyance, and delays of having to rush into the office. And with transparent delegated access via VIPRE Site Manager, MSPs, MSSPs, and MDR providers can assist in incident response and investigation with zero friction.

Supports investigation: EDR bundles in endpoint vulnerability scanning, raw event telemetry, and detailed root cause analysis. VIPRE Endpoint Detection & Response (EDR) includes access to cloud-based malware analysis sandboxes to investigate suspicious files and URLs, with detailed results presented right in the console including Remote Browser Isolation feature for further website investigation. It also includes a simple method to isolate endpoints that are misbehaving, to prevent attack spread and give you time to understand what is happening on the endpoint.

Zero Trust features in endpoint security can be effective in controlled environments like kiosks, where interactions are limited and predictable. However, for everyday workstations, the administrative burden, performance issues, and user disruptions often outweigh the benefits.

In recent years, Zero Trust has become a key principle in endpoint security, aiming to eliminate the implicit trust granted to users or devices within a network. Every request is treated as untrustworthy until verified, enhancing protection against insider threats and lateral movement. Several enterprise products now include some form of Zero Trust features, such as application control, network segmentation, identity verification, etc. However, implementing these features—especially in dynamic environments like workstations—presents challenges. Continuous verification processes can introduce performance overhead, affecting user experience and daily operations if not carefully managed.

Zero Trust and Workstations: Too Much Overhead for Everyday Use

On workstations, where employees perform dynamic tasks and frequently install software, implementing Zero Trust can introduce significant challenges. Frequent changes in usage patterns make training lengthy and complex, even with cloud-based assistance. Moreover, the highly restrictive nature of Zero Trust can lead to excessive alerts and blocks during normal operations. The constant need for authorization, even for legitimate tasks, interrupts workflows, frustrates users, and burdens IT teams with the continuous task of approving or denying activities. In addition to this, features like continuous verification and real-time checks may negatively affect system performance, causing slower response times and reducing overall productivity. As a result, maintaining such a system is resource-intensive, with diminishing returns in terms of improved security. The overall user experience and operational efficiency are significantly impacted, making Zero Trust features impractical for most workstation environments. This is why these features are often disabled by default.

Zero Trust and Kiosk Computers: A Suitable Match

Kiosk computers, often used in public settings or tightly controlled environments, are designed for limited interaction, with users restricted from installing software or making system changes. In such cases, Zero Trust can be particularly beneficial. Its restrictive approach suits the limited and predictable usage patterns of kiosks—nothing is installed, executed, or modified without explicit authorization. This minimizes the attack surface while maintaining a high level of security with minimal user friction.

Since kiosks operate in a highly predictable and stable manner, the learning phase of Zero Trust systems is less burdensome. Administrators can pre-approve the necessary applications and workflows, resulting in fewer alerts and reduced maintenance requirements. As a result, Zero Trust can effectively enhance kiosk security by preventing unauthorized actions with minimal ongoing adjustments.

Where Zero Trust Makes Sense

Given these challenges, most organizations find Zero Trust more suitable for specialized systems like kiosks, while it is often disabled on workstations. Therefore, it’s crucial to assess the performance and security efficacy of endpoint protection products under “normal” conditions—without Zero Trust enabled. This helps determine the true value of the security solution for day-to-day operations, where a balance between security and usability is essential.

Built-in Windows Protections: Easier Alternatives

Windows 10 and 11 Pro editions offer built-in security features that can achieve similar levels of protection with significantly less complexity than Zero Trust models. Key features include:

• Attack Surface Reduction (ASR) Rules: ASR rules help reduce the attack surface by blocking potentially malicious behaviours, such as preventing Office macros from executing content downloaded from the web, blocking executable files running from email attachments, and more. These rules are flexible and can be tailored to different risk profiles, allowing for fine-grained control without overwhelming users with alerts. (https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference)
• Controlled Folder Access: This feature protects critical system files and user data by preventing unauthorized applications from making changes. It’s particularly effective against ransomware and other malware that targets sensitive data.
• AppLocker: Another valuable feature in Windows, AppLocker allows administrators to control which applications and files users can run. By creating policies that restrict unauthorized executables, scripts, and installers, AppLocker helps reduce exposure to malicious software. AppLocker is particularly useful in environments where maintaining tight control over executable permissions is crucial, offering a more straightforward alternative to Zero Trust for controlling application execution.

Collectively, these built-in features can provide strong protection, especially when configured correctly, making them viable alternatives to more expensive and operationally demanding Zero Trust implementations.

Key ASR Rules and Effectiveness

One of the most powerful sets of these features is Microsoft Defender’s Attack Surface Reduction (ASR) rules. These rules are configurable controls that block or limit specific behaviours often associated with malware and other malicious activities.

ASR Rules Examples

• Block executable files from running unless they meet a prevalence, age, or trusted list criterion: This rule prevents new or low-reputation executables from running, reducing the risk of zero-day attacks or novel malware. It assesses whether an executable is widely used, has been around long enough, or is from a known trusted source before allowing it to execute.
• Block Office applications from creating child processes: Many attacks exploit Office applications (like Word or Excel) to launch malicious scripts or executables.
• Block executable content from email and webmail clients: This rule blocks users from running executable files or scripts directly from email attachments or web-based email clients, a frequent entry point for malware.
• Block Office applications from injecting code into other processes: Some sophisticated attacks involve injecting malicious code into trusted processes, making them harder to detect.
• Use advanced protection against credential theft: Credential-stealing malware is a serious threat, and this rule blocks unauthorized processes from accessing sensitive credential stores or memory locations where authentication data is held.
• Block untrusted and unsigned processes that run from USB: Removable media like USB drives can introduce malware into networks. This prevents untrusted and unsigned software from launching directly from USB devices, reducing exposure to risks.

Conclusion

Zero Trust features in endpoint security products can be highly effective in environments like kiosks, where interactions are limited and predictable. However, for workstations used in everyday operations, the administrative burden, performance degradation, and user disruptions it introduces often make it impractical. While a very strict Zero Trust approach could potentially block 100% of malware, it would also overwhelm users and administrators with excessive false positives and maintenance requirements, making it less practical for day-to-day use.

Organizations should carefully evaluate whether the increased security provided by Zero Trust justifies the impact on productivity and maintenance. Using a reliable product that can block most attacks with minimal false positives, as verified by independent evaluations by organizations like AV-Comparatives, even without applying Zero Trust features, is ultimately more cost-effective and flexible across different environments. Built-in Windows security features such as ASR rules, AppLocker, and Controlled Folder Access offer strong protection with less complexity, providing cost-effective, easier-to-manage alternatives that deliver robust security.

By taking a balanced approach, organizations can secure their endpoints effectively while minimizing the operational challenges associated with Zero Trust deployments.

AV-Comparatives provides a separate certification test for OT (Operational Technology) and ZT (Zero Trust) solutions (https://www.av-comparatives.org/av-comparatives-operational-technology-protection-certification-2026/). Vendors interested in this certification are encouraged to contact us.