Endpoint protection
Asked as “endpoint protection platform”, and as “business antivirus and endpoint security tool”, on behalf of a mid-market B2B company. 52 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
25%
Contested · Microsoft Defender for Endpoint 23%
25Microsoft Defender for Cloud23Microsoft Defender for Endpoint12Bitdefender GravityZone40others
25% of first choices, contested.
Since October 2026↗new leaderNew leader since October 2026: Microsoft Defender for Cloud (25%) replaces Microsoft Defender for Endpoint (25% then, 23% now), 2 points clear, inside the 11-point floor.Microsoft Defender for Cloud leads at 25%, replacing Microsoft Defender for Endpoint, which led at 25% and stands at 23% now: 2 points clear, inside the floor, so the swap reads as unsettled.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Microsoft Defender for Cloud49%Clear leader▼−1Since October 2026: 50% → 49%, −1 point. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Defender for Cloud25%Contested↗new leaderNew leader since October 2026: Microsoft Defender for Cloud (25%) replaces Microsoft Defender for Endpoint (25% then, 23% now), 2 points clear, inside the 11-point floor.This pageEnterprise
Microsoft Defender for Endpoint53%Clear leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.Standing →
Microsoft Defender for Cloud49%Clear leader▼−1Since October 2026: 50% → 49%, −1 point. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Defender for Cloud25%Contested↗new leaderNew leader since October 2026: Microsoft Defender for Cloud (25%) replaces Microsoft Defender for Endpoint (25% then, 23% now), 2 points clear, inside the 11-point floor.This pageEnterpriseMicrosoft Defender for Endpoint53%Clear leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Microsoft Defender for Cloud25%0%16accepted challenger▲+8Since October 2026: 17% → 25%, +8 points. Inside the 11-point floor: within noise.17% → 25%
Microsoft Defender for Cloud25%0%16accepted challenger▲+8Since October 2026: 17% → 25%, +8 points. Inside the 11-point floor: within noise.17% → 25%02Microsoft Defender for Endpoint23%8%50accepted challenger▼−2Since October 2026: 25% → 23%, −2 points. Inside the 11-point floor: within noise.25% → 23%
Microsoft Defender for Endpoint23%8%50accepted challenger▼−2Since October 2026: 25% → 23%, −2 points. Inside the 11-point floor: within noise.25% → 23%03
Bitdefender GravityZone12%2%43accepted challenger▼−8Since October 2026: 20% → 12%, −8 points. Inside the 11-point floor: within noise.20% → 12%
Bitdefender GravityZone12%2%43accepted challenger▼−8Since October 2026: 20% → 12%, −8 points. Inside the 11-point floor: within noise.20% → 12%04
Sophos Intercept X12%12%50accepted challenger▲+7Since October 2026: 5% → 12%, +7 points. Inside the 11-point floor: within noise.5% → 12%
Sophos Intercept X12%12%50accepted challenger▲+7Since October 2026: 5% → 12%, +7 points. Inside the 11-point floor: within noise.5% → 12%05
SentinelOne Singularity10%0%24accepted challenger▲+5Since October 2026: 5% → 10%, +5 points. Inside the 11-point floor: within noise.5% → 10%
SentinelOne Singularity10%0%24accepted challenger▲+5Since October 2026: 5% → 10%, +5 points. Inside the 11-point floor: within noise.5% → 10%06
CrowdStrike Falcon10%33%48criticized challenger▼−2Since October 2026: 12% → 10%, −2 points. Inside the 11-point floor: within noise.12% → 10%
CrowdStrike Falcon10%33%48criticized challenger▼−2Since October 2026: 12% → 10%, −2 points. Inside the 11-point floor: within noise.12% → 10%07
ESET PROTECT2%9%23accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
ESET PROTECT2%9%23accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%Show the five products at 0%, ordered by negative rate
12
Kaspersky Endpoint Security0%42%12criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Kaspersky Endpoint Security0%42%12criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%10
SentinelOne Singularity Endpoint0%29%24criticized challenger▼−3Since October 2026: 3% → 0%, −3 points. Inside the 11-point floor: within noise.3% → 0%
SentinelOne Singularity Endpoint0%29%24criticized challenger▼−3Since October 2026: 3% → 0%, −3 points. Inside the 11-point floor: within noise.3% → 0%09
Palo Alto Networks Cortex XDR0%26%19criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Palo Alto Networks Cortex XDR0%26%19criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%11
Trend Micro Apex One0%13%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Trend Micro Apex One0%13%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%08
Huntress Managed EDR0%0%16accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Huntress Managed EDR0%0%16accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs CrowdStrike FalconMicrosoft Defender for Cloud vs ESET PROTECTMicrosoft Defender for Endpoint vs Bitdefender GravityZoneMicrosoft Defender for Endpoint vs Sophos Intercept XMicrosoft Defender for Endpoint vs SentinelOne SingularityMicrosoft Defender for Endpoint vs CrowdStrike FalconMicrosoft Defender for Endpoint vs ESET PROTECTBitdefender GravityZone vs Sophos Intercept XBitdefender GravityZone vs SentinelOne SingularityBitdefender GravityZone vs CrowdStrike FalconBitdefender GravityZone vs ESET PROTECTSophos Intercept X vs SentinelOne SingularitySophos Intercept X vs CrowdStrike FalconSophos Intercept X vs ESET PROTECTSentinelOne Singularity vs CrowdStrike FalconSentinelOne Singularity vs ESET PROTECTCrowdStrike Falcon vs ESET PROTECT
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
010203040506070809101112Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Microsoft Defender for Cloud25%
Microsoft Defender for Cloud25%02Microsoft Defender for Endpoint23%
Microsoft Defender for Endpoint23%03Bitdefender GravityZone12%
Bitdefender GravityZone12%04Sophos Intercept X12%
Sophos Intercept X12%05SentinelOne Singularity10%
SentinelOne Singularity10%06CrowdStrike Falcon10%
CrowdStrike Falcon10%07ESET PROTECT2%
ESET PROTECT2%08Huntress Managed EDR0%
Huntress Managed EDR0%09Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%10SentinelOne Singularity Endpoint0%
SentinelOne Singularity Endpoint0%11Trend Micro Apex One0%
Trend Micro Apex One0%12Kaspersky Endpoint Security0%
Kaspersky Endpoint Security0%What they warned about
Two of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
CrowdStrike Falcon33%
16 of 48 labels negative · 11 of 14 models · 1 hard negative
“Avoid pricier options like CrowdStrike Falcon or SentinelOne unless you have a bigger budget” Grok 4.20, budget prompt
SentinelOne Singularity Endpoint29%
7 of 24 labels negative · 7 of 14 models · 1 hard negative
“Avoid pricier options like CrowdStrike Falcon or SentinelOne unless you have a bigger budget” Grok 4.20, budget prompt
Sophos Intercept X12%
6 of 50 labels negative · 6 of 14 models · 1 hard negative
“Both could allow arbitrary code execution” GLM 4.7 FlashX, negative prompt
Kaspersky Endpoint Security42%
5 of 12 labels negative · 5 of 14 models · 5 hard negative
“the U.S. Department of Commerce issued a final determination banning Kaspersky from providing antivirus and cybersecurity products in the United States” DeepSeek V4 Flash, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
75 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 871 links across 260 sites, every framing counted. Ranked by the number of answers carrying the site or page. 23 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Microsoft30 answers · 60 citations · 12 models
vendor site · G222 answers · 26 citations · 11 models
21 answers · 51 citations · 8 models
vendor site · Huntress20 answers · 30 citations · 11 models
vendor site · Deel18 answers · 19 citations · 8 models
16 answers · 16 citations · 8 models
vendor site · Guideflow14 answers · 14 citations · 8 models
vendor site · CrowdStrike13 answers · 14 citations · 9 models
13 answers · 13 citations · 7 models
12 answers · 17 citations · 9 models
vendor site · Cynet11 answers · 12 citations · 9 models
vendor site · Palo Alto Networks10 answers · 14 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
17 answers · 8 models
17 answers · 8 models
15 answers · 7 models
13 answers · 8 models
12 answers · 5 models
12 answers · 10 models
10 answers · 4 models
8 answers · 7 models
8 answers · 6 models
8 answers · 6 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best endpoint protection platform”, “endpoint protection platform”, “endpoint protection platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender microsoft.com Microsoft Defender for Cloud 25% | 25% | 659 | 18,100 | 3,525 | 145,358,109 company | $12,455 | 103 | |
| Microsoft Defender parent site Microsoft Defender for Endpoint 23% | 23% | 264 | 18,100 | 3,525 | ||||
| Bitdefender bitdefender.com Bitdefender GravityZone 12% | 12% | 115 | 90,500 | 3,261 | 649,861 company | 93 | ||
| Sophos sophos.com Sophos Intercept X 12% | 12% | 304 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| SentinelOne sentinelone.com SentinelOne Singularity 10% | 10% | 499 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 2 |
| CrowdStrike parent site CrowdStrike Falcon 10%, CrowdStrike Falcon Go 0%, CrowdStrike Falcon Insight XDR 0% | 10% | 201 | 74,000 | 5,130 | ||||
| ESET eset.com ESET PROTECT 2% | 2% | 111 | 18,100 | 1,812 | 637,959 company | $4,397 | 75 | 2 |
| Comodo Dragon Platform | 2% | |||||||
| Malwarebytes Endpoint Protection malware.news | 2% | 2 | ||||||
| Sophos Endpoint with Sophos MDR | 2% |
Google's top ten for the three searches hold 21 sites; 3 of them are among the sites the models cited here (crowdstrike.com, cynet.com, g2.com). The first result for “best endpoint protection platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best endpoint protection platform for a mid-market B2B company?”Paraphrase“Which business antivirus and endpoint security tool would you recommend to a mid-sized B2B company?”Comparative“What are the top endpoint protection platforms and how do they differ?”Budget-constrained“What is the best endpoint protection platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating an endpoint protection platform. What should we look at?”Negative“Which endpoint protection platforms should I avoid or be cautious about?”
Claude Haiku 4.5no first choiceBitdefender GravityZoneChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: Cisco Secure Endpoint, CrowdStrike Falcon, ESET PROTECT, Microsoft Defender for Endpoint, Sophos Intercept X
Three alternatives
ESET PROTECT, Microsoft Defender for Cloud, Sophos Intercept XFour alternatives
Bitdefender GravityZone, ESET PROTECT, Malwarebytes for Business, Sophos Intercept XGPT-5.4 miniMicrosoft Defender for EndpointMicrosoft Defender for CloudChangedno first choiceBitdefender GravityZoneagainst: CrowdStrike Falcon Gono first choiceagainst: Ivanti CSA 4.6
Two alternatives
CrowdStrike Falcon, SentinelOne Singularity EndpointThree alternatives
Bitdefender GravityZone, CrowdStrike Falcon, CrowdStrike Falcon GoSeven alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneOne alternative
Microsoft Defender for CloudGemini 3.5 FlashSentinelOne SingularitySentinelOne SingularityHeldCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for CloudCrowdStrike Falconagainst: CrowdStrike Falcon, Kaspersky Endpoint Security, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint
Three alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Sophos Intercept X with MDRThree alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Sophos Intercept XFour alternatives
Bitdefender GravityZone, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XFour alternatives
Bitdefender GravityZone, CrowdStrike Falcon Go, ESET PROTECT, Huntress Managed EDRTwo alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityPerplexity SonarSophos Intercept Xagainst: CrowdStrike FalconMicrosoft Defender for CloudChangedMicrosoft Defender for EndpointMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike, Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Symantec Endpoint Security, Trellix Endpoint Security Suite
Four alternatives
Bitdefender GravityZone, Huntress Managed EDR, Microsoft Defender for Endpoint, SentinelOne SingularityFour alternatives
Bitdefender GravityZone, CrowdStrike Falcon, SentinelOne Singularity Endpoint, Sophos Endpoint plus MDRSeven alternatives
Bitdefender GravityZone, CrowdStrike Falcon, ESET PROTECT, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneThree alternatives
Bitdefender GravityZone Small Business Security, Huntress Managed EDR, Sophos Intercept XGrok 4.20CrowdStrike FalconSophos Intercept XChangedagainst: CrowdStrike FalconCrowdStrike Falcon, SentinelOne SingularityMicrosoft Defender for Endpointagainst: CrowdStrike Falcon, SentinelOne Singularity Endpointno first choiceagainst: AVG, Avast Business, Kaspersky Endpoint Security, McAfee Endpoint Security, Norton, Palo Alto Networks Cortex XDR, Symantec Endpoint Security
Four alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, Trend Vision OneThree alternatives
Microsoft Defender for Endpoint, Sophos Intercept X, Symantec Endpoint SecurityFive alternatives
Bitdefender GravityZone, ESET PROTECT, Sophos Intercept X, ThreatDown, Webroot Business Endpoint ProtectionMistral SmallCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for CloudChangedCrowdStrike FalconESET PROTECT, Sophos Intercept Xno first choiceagainst: Avast Business, CrowdStrike Falcon, Microsoft Defender, Palo Alto Networks Cortex XDR, Sophos Intercept X
Two alternatives
Bitdefender GravityZone, Sophos Intercept XFour alternatives
Bitdefender GravityZone, ESET PROTECT, Kaspersky Endpoint Security, Sophos Intercept XSeven alternatives
Bitdefender GravityZone, ESET PROTECT, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro Apex OneThree alternatives
Acronis Cyber Protect, Huntress Managed EDR, Microsoft Defender for EndpointDeepSeek V4 FlashMicrosoft Defender for EndpointMicrosoft Defender for Endpoint, SentinelOne SingularityChangedagainst: Avast Business, Check Point Harmony Endpoint, CrowdStrike Falcon, Norton or McAfee SMB tiersCrowdStrike Falconagainst: Bitdefender GravityZone, Trellix Endpoint Security SuiteMicrosoft Defender for Cloudagainst: SentinelOne Singularity EndpointMicrosoft Defender for Endpointagainst: Palo Alto Networks Cortex XDRagainst: CrowdStrike Falcon, Kaspersky Endpoint Security
Three alternatives
CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XThree alternatives
Bitdefender GravityZone, ESET PROTECT, Sophos Intercept XFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Bitdefender GravityZone, Huntress Managed EDRThree alternatives
Bitdefender GravityZone, CrowdStrike, SentinelOne Singularity EndpointLlama 4 MaverickSentinelOne SingularityMicrosoft Defender for EndpointChangedno first choiceComodo Dragon Platformno first choiceagainst: CrowdStrike Falcon, Defender ATP, Kaspersky Endpoint Security, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Micro Apex One
Three alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for EndpointFour alternatives
Bitdefender GravityZone, CrowdStrike Falcon Go, SentinelOne Singularity Endpoint, Sophos Intercept XTwo alternatives
Huntress Managed EDR, Microsoft Defender for EndpointQwen 3.7 FlashSophos Intercept Xagainst: CrowdStrike FalconSophos Intercept XHeldagainst: CrowdStrike Falcon, SentinelOne Singularity EndpointCrowdStrikeBitdefender GravityZoneagainst: CrowdStrikeMicrosoft Defender for Endpointagainst: Cisco Secure Endpoint, Fortinet FortiEDR, K7 Computing, NetSecurity ThreatResponder, Rapid7 InsightIDR, VMware Carbon Black
Two alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointTwo alternatives
Bitdefender GravityZone, Microsoft Defender for CloudTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointThree alternatives
Microsoft Defender for Endpoint, Sophos Intercept X, VIPREFive alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Cynet 360, SentinelOne Singularity Endpoint, Sophos Intercept XKimi K2SentinelOne Singularityagainst: CrowdStrike FalconBitdefender GravityZone, Microsoft Defender for EndpointChangedagainst: CrowdStrike FalconCrowdStrike FalconMicrosoft Defender for Cloudno first choiceagainst: AVG, Avast Business, Cisco Secure Endpoint, CrowdStrike Falcon, ESET PROTECT, Fortinet FortiEDR, G DATA, Malwarebytes ThreatDown, Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept X, Trellix Endpoint Security Suite, VIPRE, WatchGuard, WithSecure
One alternative
Microsoft Defender for EndpointOne alternative
SentinelOne SingularityFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Huntress Managed EDR, WazuhGLM 4.7 FlashXSophos Intercept XMicrosoft Defender for CloudChangedCrowdStrike Falcon Endpoint, SentinelOne SingularityMalwarebytes Endpoint Protection, Microsoft Defender for Cloudno first choiceagainst: BeyondTrust Remote Support, CrowdStrike Falcon, Ivanti Endpoint Manager Mobile, Palo Alto Networks Cortex XDR, Sophos Intercept X, Symantec Endpoint Security, Trend Micro Apex One, Webroot SecureAnywhere Endpoint Protection, Withsecure Atlant / Client Security
Three alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne SingularityThree alternatives
ESET Endpoint Security, Kaspersky Endpoint Security, Sophos Intercept XFive alternatives
Bitdefender GravityZone, ESET PROTECT, Microsoft Defender for Endpoint, Sophos Intercept X, Trend Micro Apex OneThree alternatives
Avast Business, Built-in Windows Defender, Huntress Managed EDRMiniMax M2.5CrowdStrike Falcon, Microsoft Defender for CloudCrowdStrike FalconChangedCrowdStrike FalconBitdefender GravityZone, Microsoft Defenderno first choiceagainst: Cybereason NGAV, K7 On-Premises Enterprise Security Advanced, NetSecurity ThreatResponder, Rapid7 InsightIDR, SenseOn Platform with EPP
Three alternatives
Bitdefender GravityZone, Palo Alto Networks Cortex XDR, Sophos Intercept XFour alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Micro Worry-Free ServicesFour alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept X, Trend Micro Apex OneThree alternatives
Avira, Sophos Home, Webroot Business Endpoint ProtectionGPT-6 LunaSophos Endpoint with Sophos MDRMicrosoft Defender for EndpointChangedno first choiceMicrosoft Defender for Cloudno first choiceagainst: CrowdStrike, Kaspersky Endpoint Security
Two alternatives
CrowdStrike Falcon, Microsoft Defender for EndpointOne alternative
CrowdStrike FalconSeven alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Vision OneTwo alternatives
Bitdefender GravityZone, Huntress Managed EDRMuse Glimmer 30BMicrosoft Defender for EndpointBitdefender GravityZone, Microsoft Defender for CloudChangedCrowdStrike Falcon Insight XDRMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike Falcon, Microsoft, Sophos Intercept X
Three alternatives
CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XTwo alternatives
CrowdStrike Falcon, SentinelOne SingularityFour alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Micro Vision One Endpoint SecurityFive alternatives
Bitdefender GravityZone, Bitdefender Ultimate Small Business Security, Huntress Managed EDR, Malwarebytes for Business, Sophos Intercept XBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:29 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:01 | yes | 2 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:44 | no | 0 | 15 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 11:14 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:00 | yes | 5 | 11 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:19 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 13:12 | yes | 21 | 31 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:28 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 14:46 | no | 0 | 26 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:15 | yes | 15 | 25 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:17 | yes | 25 | 123 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:56 | yes | 10 | 65 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 17:57 | yes | 3 | 22 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:54 | yes | 14 | 23 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:15 | yes | 9 | 7 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 18:47 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:43 | yes | 6 | 21 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 19:07 | yes | 10 | 3 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:40 | yes | 5 | 9 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:33 | yes | 5 | 4 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:26 | yes | 25 | 28 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:06 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 16:35 | yes | 10 | 30 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 14:24 | yes | 14 | 27 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:44 | yes | 15 | 17 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:32 | no | 0 | 13 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:55 | yes | 3 | 16 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 19:35 | yes | 15 | 24 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 19:23 | yes | 9 | 6 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 15:57 | yes | 4 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:53 | yes | 8 | 19 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 18:34 | yes | 10 | 6 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:53 | yes | 5 | 17 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:40 | yes | 9 | 9 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:05 | yes | 24 | 64 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:50 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 15:38 | yes | 10 | 33 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:47 | yes | 13 | 41 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 14:53 | yes | 17 | 32 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 16:48 | yes | 15 | 27 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 16:47 | yes | 7 | 32 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 11:55 | yes | 15 | 24 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 19:14 | yes | 18 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:15 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:14 | yes | 10 | 21 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 12:45 | yes | 10 | 3 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:01 | yes | 10 | 13 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 18:15 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 12:56 | yes | 25 | 23 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:27 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:30 | yes | 24 | 75 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:51 | yes | 15 | 23 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 12:16 | yes | 25 | 138 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 19:37 | yes | 5 | 25 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 12:24 | yes | 3 | 11 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 15:15 | yes | 14 | 24 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:48 | no | 0 | 7 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:59 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 14:07 | no | 0 | 16 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 18:58 | yes | 10 | 10 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:32 | yes | 5 | 17 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 14:59 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 08:48 | yes | 24 | 35 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 15:51 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 19:43 | yes | 5 | 24 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:19 | yes | 5 | 86 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 11:40 | yes | 14 | 69 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:49 | no | 0 | 11 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 12:32 | yes | 3 | 14 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:35 | yes | 14 | 18 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:57 | yes | 36 | 12 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:50 | yes | 4 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:36 | yes | 3 | 19 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 12:28 | yes | 10 | 5 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:43 | yes | 20 | 17 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 14:22 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:42 | yes | 25 | 26 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:47 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:32 | yes | 23 | 53 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:34 | yes | 23 | 90 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 18:28 | yes | 24 | 41 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:57 | yes | 17 | 40 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:50 | yes | 4 | 24 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 13:54 | yes | 23 | 36 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Acronis read as Acronis Cyber Protect
Avast Business Security read as Avast Business
Bitdefender read as Bitdefender GravityZone
Bitdefender GravityZone Business Security read as Bitdefender GravityZone
Bitdefender GravityZone Business Security Premium read as Bitdefender GravityZone
Bitdefender GravityZone Small Business read as Bitdefender GravityZone Small Business Security
Broadcom Symantec Endpoint Security read as Symantec Endpoint Security
CISCO read as Cisco Secure Endpoint
Check Point read as Check Point Harmony Endpoint
Cynet read as Cynet 360
ESET read as ESET PROTECT
ESET Protect Entry read as ESET PROTECT
Huntress read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Security
Malwarebytes read as Malwarebytes ThreatDown
Malwarebytes (Enterprise) read as Malwarebytes ThreatDown
Microsoft Defender for Business / Defender for Endpoint read as Microsoft Defender for Endpoint
Microsoft Defender for Business/Endpoint read as Microsoft Defender for Endpoint
Palo Alto read as Palo Alto Networks Cortex XDR
Palo Alto Cortex read as Palo Alto Networks Cortex XDR
Palo Alto Networks read as Palo Alto Networks Cortex XDR
Palo Alto Networks (Cortex XDR) read as Palo Alto Networks Cortex XDR
SentinelOne read as SentinelOne Singularity Endpoint
Sophos read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Endpoint / Intercept X read as Sophos Intercept X
Sophos Intercept X Endpoint read as Sophos Intercept X
Symantec read as Symantec Endpoint Security
Symantec Endpoint Protection read as Symantec Endpoint Security
Trellix read as Trellix Endpoint Security Suite
Trellix (McAfee + FireEye) read as Trellix Endpoint Security Suite
Trellix (formerly FireEye/McAfee) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee Enterprise) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee) read as Trellix Endpoint Security Suite
Trend Micro read as Trend Micro Apex One
Trend Micro (Trend Vision One) read as Trend Micro Apex One
Webroot (OpenText Core Endpoint Protection) read as Webroot Business Endpoint Protection
Unresolved, counted raw
Avast Ultimate Business Security
Built-in Windows Defender
Cisco Secure Endpoints
Comodo Advanced Endpoint Protection
Comodo Dragon Platform
CrowdStrike Falcon Endpoint (Falcon Insight XDR)
Cybereason NGAV
Defender ATP
IBM QRadar EDR
Ivanti CSA 4.6
K7
K7 Computing
K7 On-Premises Enterprise Security Advanced
NetSecurity
Norton or McAfee SMB tiers
SenseOn Platform with EPP
Sophos Endpoint plus MDR
Sophos Endpoint with Sophos MDR
Sophos Home
ThreatDown Endpoint Protection for Business
Trend Micro Vision One Endpoint Security
TrendMicro
Vipre Endpoint Security
Webroot SecureAnywhere Endpoint Protection
Withsecure Atlant / Client Security
Discontinued, still offered
No shut-down product was recommended here.