Endpoint protection for enterprise buyers
Asked as “endpoint protection platform”, and as “business antivirus and endpoint security tool”, on behalf of an enterprise B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
53%
Clear leader
53Microsoft Defender for Endpoint34CrowdStrike Falcon04Microsoft Defender09others
53% of first choices, clear leader.
Since October 2026▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.Microsoft Defender for Endpoint held the lead, +9 points on 44%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Microsoft Defender for Cloud49%Clear leader▼−1Since October 2026: 50% → 49%, −1 point. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Defender for Cloud25%Contested↗new leaderNew leader since October 2026: Microsoft Defender for Cloud (25%) replaces Microsoft Defender for Endpoint (25% then, 23% now), 2 points clear, inside the 11-point floor.Standing →Enterprise
Microsoft Defender for Endpoint53%Clear leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.This page
Microsoft Defender for Cloud49%Clear leader▼−1Since October 2026: 50% → 49%, −1 point. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Defender for Cloud25%Contested↗new leaderNew leader since October 2026: Microsoft Defender for Cloud (25%) replaces Microsoft Defender for Endpoint (25% then, 23% now), 2 points clear, inside the 11-point floor.Standing →EnterpriseMicrosoft Defender for Endpoint53%Clear leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Microsoft Defender for Endpoint53%3%64endorsed leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.44% → 53%
Microsoft Defender for Endpoint53%3%64endorsed leader▲+9Since October 2026: 44% → 53%, +9 points. Inside the 11-point floor: within noise.44% → 53%02
CrowdStrike Falcon34%15%61endorsed leader▼−1Since October 2026: 35% → 34%, −1 point. Inside the 11-point floor: within noise.35% → 34%
CrowdStrike Falcon34%15%61endorsed leader▼−1Since October 2026: 35% → 34%, −1 point. Inside the 11-point floor: within noise.35% → 34%03
SentinelOne Singularity2%5%39accepted challenger▼−5Since October 2026: 7% → 2%, −5 points. Inside the 11-point floor: within noise.7% → 2%
SentinelOne Singularity2%5%39accepted challenger▼−5Since October 2026: 7% → 2%, −5 points. Inside the 11-point floor: within noise.7% → 2%04
Bitdefender GravityZone2%20%25accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Bitdefender GravityZone2%20%25accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%05
CrowdStrike2%43%14criticized challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%
CrowdStrike2%43%14criticized challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%Show the seven products at 0%, ordered by negative rate
12
Symantec Endpoint Security0%56%16criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Symantec Endpoint Security0%56%16criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%11
Trellix Endpoint Security Suite0%39%23criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Trellix Endpoint Security Suite0%39%23criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%10
ESET PROTECT0%20%10accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
ESET PROTECT0%20%10accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%07
Sophos Intercept X0%14%43accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Sophos Intercept X0%14%43accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%09
Trend Micro Apex One0%11%19accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Trend Micro Apex One0%11%19accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%08
SentinelOne Singularity Endpoint0%7%28accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
SentinelOne Singularity Endpoint0%7%28accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%06
Palo Alto Networks Cortex XDR0%5%38accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Palo Alto Networks Cortex XDR0%5%38accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
Microsoft Defender for Cloud vs Microsoft Defender for EndpointMicrosoft Defender for Cloud vs Bitdefender GravityZoneMicrosoft Defender for Cloud vs Sophos Intercept X
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Defender for Cloud vs SentinelOne SingularityMicrosoft Defender for Cloud vs CrowdStrike FalconMicrosoft Defender for Cloud vs ESET PROTECTMicrosoft Defender for Endpoint vs Bitdefender GravityZoneMicrosoft Defender for Endpoint vs Sophos Intercept XMicrosoft Defender for Endpoint vs SentinelOne SingularityMicrosoft Defender for Endpoint vs CrowdStrike FalconMicrosoft Defender for Endpoint vs ESET PROTECTBitdefender GravityZone vs Sophos Intercept XBitdefender GravityZone vs SentinelOne SingularityBitdefender GravityZone vs CrowdStrike FalconBitdefender GravityZone vs ESET PROTECTSophos Intercept X vs SentinelOne SingularitySophos Intercept X vs CrowdStrike FalconSophos Intercept X vs ESET PROTECTSentinelOne Singularity vs CrowdStrike FalconSentinelOne Singularity vs ESET PROTECTCrowdStrike Falcon vs ESET PROTECT
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
010203040506070809101112Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative70%
Key
01Microsoft Defender for Endpoint53%
Microsoft Defender for Endpoint53%02CrowdStrike Falcon34%
CrowdStrike Falcon34%03SentinelOne Singularity2%
SentinelOne Singularity2%04Bitdefender GravityZone2%
Bitdefender GravityZone2%05CrowdStrike2%
CrowdStrike2%06Palo Alto Networks Cortex XDR0%
Palo Alto Networks Cortex XDR0%07Sophos Intercept X0%
Sophos Intercept X0%08SentinelOne Singularity Endpoint0%
SentinelOne Singularity Endpoint0%09Trend Micro Apex One0%
Trend Micro Apex One0%10ESET PROTECT0%
ESET PROTECT0%11Trellix Endpoint Security Suite0%
Trellix Endpoint Security Suite0%12Symantec Endpoint Security0%
Symantec Endpoint Security0%What they warned about
Seven of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Symantec Endpoint Security56%
9 of 16 labels negative · 8 of 14 models · 3 hard negative
“Symantec Endpoint Protection is widely viewed as a candidate to avoid or replace.” GLM 4.7 FlashX, negative prompt
Trellix Endpoint Security Suite39%
9 of 23 labels negative · 7 of 14 models · 3 hard negative
“noted for its lack of mobile coverage and unclear pricing, making it a poor fit for large, heterogeneous enterprises” Llama 4 Maverick, negative prompt
CrowdStrike Falcon15%
9 of 61 labels negative · 7 of 14 models
“the faulty sensor update that caused a global IT outage in July 2024 raised valid questions about update validation processes” Claude Haiku 4.5, negative prompt
Kaspersky Endpoint Security56%
5 of 9 labels negative · 5 of 14 models · 4 hard negative
“The U.S. Department of Commerce ... enacted a full prohibition on Kaspersky software sales and signature updates within the United States.” Gemini 3.5 Flash, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
72 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 854 links across 224 sites, every framing counted. Ranked by the number of answers carrying the site or page. 23 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Microsoft42 answers · 77 citations · 12 models
vendor site · G234 answers · 43 citations · 11 models
vendor site · CrowdStrike23 answers · 44 citations · 9 models
22 answers · 28 citations · 8 models
vendor site · Huntress17 answers · 21 citations · 7 models
vendor site · SentinelOne15 answers · 20 citations · 8 models
vendor site · Deel15 answers · 15 citations · 9 models
14 answers · 15 citations · 8 models
publisher (Gane)14 answers · 14 citations · 6 models
vendor site · Palo Alto Networks12 answers · 15 citations · 8 models
12 answers · 13 citations · 8 models
11 answers · 27 citations · 7 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
33 answers · 9 models
17 answers · 8 models
16 answers · 7 models
15 answers · 9 models
14 answers · 6 models
14 answers · 7 models
11 answers · 7 models
11 answers · 6 models
8 answers · 6 models
8 answers · 5 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best endpoint protection platform”, “endpoint protection platform”, “endpoint protection platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft Defender parent site Microsoft Defender for Endpoint 53%, Microsoft Defender XDR 0% | 53% | 264 | 18,100 | 3,525 | ||||
| CrowdStrike parent site CrowdStrike Falcon 34%, CrowdStrike Falcon Insight XDR 0% | 34% | 201 | 74,000 | 5,130 | ||||
| Microsoft parent site Microsoft Defender 4% | 4% | 52 | 2,240,000 | 403,136 | ||||
| SentinelOne sentinelone.com SentinelOne Singularity 2% | 2% | 499 | 33,100 | 1,675 | 446,702 company | $780 | 22 | 2 |
| Bitdefender bitdefender.com Bitdefender GravityZone 2% | 2% | 115 | 90,500 | 3,261 | 649,861 company | 93 | ||
| CrowdStrike crowdstrike.com | 2% | 302 | 74,000 | 5,130 | 715,209 | $13,967 | 119 | 5 |
| Huntress huntress.com Huntress Managed EDR 2% | 2% | 353 | 33,100 | 4,338 | 352,368 company | $15,522 | 120 | |
| Palo Alto Networks parent site Palo Alto Networks Cortex XDR 0% | 0% | 251 | 40,500 | 1,088 | ||||
| Sophos sophos.com Sophos Intercept X 0% | 0% | 304 | 18,100 | 2,046 | 186,716 company | $1,427 | 65 | |
| SentinelOne parent site SentinelOne Singularity Endpoint 0% | 0% | 80 | 33,100 | 1,675 |
Google's top ten for the three searches hold 21 sites; 3 of them are among the sites the models cited here (crowdstrike.com, g2.com, sentinelone.com). The first result for “best endpoint protection platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best endpoint protection platform for an enterprise B2B company?”Paraphrase“Which business antivirus and endpoint security tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade endpoint protection platforms and how do they differ?”Budget-constrained“What is the best endpoint protection platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an endpoint protection platform. What should we look at?”Negative“Which endpoint protection platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceagainst: Kaspersky Endpoint SecurityCrowdStrike FalconChangedCrowdStrike, SentinelOne Singularity EndpointHuntress Managed EDR, Microsoft Defender for Endpointno first choiceagainst: Cisco Secure Endpoint, CrowdStrike Falcon, Symantec Endpoint Security, Trellix Endpoint Security Suite, VMware Carbon Black
Four alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, SentinelOne Singularity Endpoint, Sophos Intercept XThree alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Sophos Intercept XOne alternative
SentinelOne Singularity EndpointGPT-5.4 miniCrowdStrikeMicrosoft Defender for EndpointChangedno first choiceMicrosoft Defender for Endpointagainst: SentinelOne Singularityno first choiceagainst: CrowdStrike
Three alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity EndpointOne alternative
CrowdStrike FalconFive alternatives
CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Trend Micro Apex OneOne alternative
CrowdStrike FalconGemini 3.5 FlashCrowdStrike FalconCrowdStrike FalconHeldCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for Endpoint, SentinelOne Singularityno first choiceagainst: Carbon Black, Kaspersky Endpoint Security, Legacy Symantec Endpoint Protection, Malwarebytes ThreatDown, Microsoft Defender for Endpoint, Sophos Intercept X, Symantec Endpoint Security, Traditional McAfee ePO, Webroot Business Endpoint Protection
Three alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne SingularityThree alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XOne alternative
CrowdStrike FalconPerplexity SonarCrowdStrike Falconagainst: Symantec Endpoint Security, Trellix Endpoint Security SuiteMicrosoft Defender for EndpointChangedCrowdStrike Falconagainst: Symantec Endpoint Security, Trellix Endpoint Security SuiteMicrosoft Defender for Endpointagainst: CrowdStrike Falconno first choiceagainst: Huntress Managed EDR, Malwarebytes ThreatDown, ThreatDown
Four alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XFour alternatives
Bitdefender GravityZone, CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XFive alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XOne alternative
Huntress Managed EDRGrok 4.20CrowdStrike FalconCrowdStrike FalconHeldCrowdStrike Falcon, Microsoft Defender for EndpointMicrosoft Defender for Endpointagainst: CrowdStrike Falcon, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Trend Vision Oneno first choiceagainst: CrowdStrike Falconagainst: Bitdefender GravityZone, Check Point Harmony Endpoint, Cisco Secure Endpoint, CrowdStrike, Cybereason, Elastic, Fortinet, Kaspersky Endpoint Security, Microsoft, Sophos Intercept X, Trellix Endpoint Security Suite
Three alternatives
Microsoft Defender for Endpoint, Sophos Intercept X, Trend Vision OneFour alternatives
ESET Endpoint Security, Microsoft Defender for Endpoint, SentinelOne Singularity, Sophos Intercept XThree alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointMistral SmallMicrosoft Defender for EndpointMicrosoft Defender for EndpointHeldCrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne SingularityMicrosoft Defender for Endpointagainst: CrowdStrike, SentinelOne Singularity Endpoint, Trellix Endpoint Security Suiteno first choiceagainst: Bitdefender GravityZone, CrowdStrike Falcon, Kaspersky Endpoint Security, Sophos Intercept X, Trellix Endpoint Security Suite
Three alternatives
CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XThree alternatives
CrowdStrike Falcon Insight XDR, ESET Endpoint Security, Kaspersky Endpoint SecurityFive alternatives
ESET PROTECT, Palo Alto Networks Cortex XDR, Sophos Intercept X, Symantec Endpoint Security, Trend Micro Apex OneDeepSeek V4 FlashCrowdStrike FalconCrowdStrike FalconHeldno first choiceagainst: ESET PROTECTMicrosoft Defender for Endpointno first choiceagainst: Sophos Intercept Xagainst: Datto EDR, ESET PROTECT, Malwarebytes for Business, Sophos Intercept X, Symantec Endpoint Security, Trend Micro Apex One
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityFive alternatives
ESET Endpoint Security, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XSix alternatives
Bitdefender GravityZone, CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Bitdefender GravityZone, CrowdStrike FalconLlama 4 MaverickMicrosoft Defender for EndpointMicrosoft Defender for EndpointHeldno first choiceMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike Falcon, Trellix Endpoint Security Suite, Trend Micro Apex One
Three alternatives
CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept XTwo alternatives
CrowdStrike Falcon, Sophos Intercept XQwen 3.7 FlashCrowdStrike FalconMicrosoft Defender for EndpointChangedCrowdStrike Falcon, Microsoft Defender for Endpointagainst: Trellix Endpoint Security SuiteMicrosoft Defender for Endpointno first choiceagainst: AVG, Avast Business, Carbon Black, Cylance, McAfee, Microsoft Defender Home Edition, Robocorp, Symantec Endpoint Security
Two alternatives
Palo Alto Networks Cortex XDR, Trend Vision OneTwo alternatives
CrowdStrike Falcon, SentinelOne SingularityTwo alternatives
Palo Alto Networks Cortex XDR, SentinelOne SingularityTwo alternatives
CrowdStrike Falcon, SentinelOne Singularity EndpointKimi K2CrowdStrike Falcon, Microsoft Defender for EndpointCrowdStrike FalconChangedCrowdStrike Falcon, Microsoft Defender XDR, Microsoft Defender for EndpointMicrosoft Defender for Endpointagainst: CrowdStrike FalconMicrosoft Defenderagainst: Palo Alto Networks Cortex XDRagainst: Bitdefender GravityZone, CrowdStrike Falcon, Kaspersky Endpoint Security, Microsoft Defender for Endpoint, Symantec Endpoint Security, Trellix Endpoint Security Suite
Four alternatives
Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trend Micro Apex OneFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept XTwo alternatives
Palo Alto Networks Cortex XDR, SentinelOne SingularityTwo alternatives
Bitdefender GravityZone, SentinelOne SingularityTwo alternatives
CrowdStrike Falcon, SentinelOne Singularity EndpointGLM 4.7 FlashXCrowdStrike FalconMicrosoft Defender for EndpointChangedCrowdStrike FalconMicrosoft Defender for Endpointno first choiceagainst: Sophos Intercept X, Symantec Endpoint Security
Three alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity, Symantec Endpoint SecurityTwo alternatives
CrowdStrike Falcon, SentinelOne SingularityEight alternatives
Bitdefender GravityZone, Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, SentinelOne Singularity, Sophos Intercept X, Trellix Endpoint Security Suite, Trend Micro Apex One, WithSecure Elements XDRThree alternatives
Bitdefender GravityZone, CrowdStrike Falcon, SentinelOne SingularityMiniMax M2.5CrowdStrike Falcon, Microsoft Defender for EndpointCrowdStrike FalconChangedCrowdStrikeBitdefender GravityZone, Microsoft Defender for Endpointno first choiceagainst: Bitdefender GravityZone, CrowdStrike
One alternative
Sophos Intercept XTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointFive alternatives
Microsoft, Palo Alto Networks Cortex XDR, SentinelOne Singularity Endpoint, Sophos Intercept X, Trend Micro Apex OneGPT-6 LunaCrowdStrike FalconCrowdStrike FalconHeldCrowdStrike Falcon, SentinelOne SingularityMicrosoft Defender for Endpointno first choiceagainst: CrowdStrike Falcon, Kaspersky endpoint products, SEP, SentinelOne Singularity Endpoint, Symantec EDR S550 hardware appliance
Two alternatives
Microsoft Defender for Endpoint, SentinelOne SingularityTwo alternatives
Microsoft Defender for Endpoint, SentinelOne Singularity EndpointFour alternatives
Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, Sophos Intercept X, TrendAI Vision OneOne alternative
CrowdStrike FalconMuse Glimmer 30BMicrosoft Defender for EndpointMicrosoft Defender for EndpointHeldCrowdStrike, MicrosoftMicrosoft Defenderagainst: CrowdStrikeno first choiceagainst: Bitdefender GravityZone, CrowdStrike, Cybereason, Fortinet, Symantec Endpoint Security, WithSecure
Two alternatives
CrowdStrike Falcon, SentinelOne SingularityTwo alternatives
CrowdStrike Falcon, SentinelOne Singularity EndpointOne alternative
SentinelOne Singularity EndpointThree alternatives
Bitdefender GravityZone, ESET PROTECT, Microsoft Defender for CloudBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:15 | no | 0 | 5 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:27 | yes | 3 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:36 | yes | 8 | 19 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 10:20 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:38 | yes | 14 | 14 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 17:11 | yes | 5 | 3 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 15:46 | yes | 23 | 33 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:45 | yes | 6 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:29 | yes | 5 | 18 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:30 | yes | 10 | 44 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:54 | yes | 20 | 76 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 09:01 | yes | 9 | 83 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 16:38 | yes | 3 | 18 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 19:12 | yes | 15 | 22 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:26 | yes | 10 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:02 | yes | 2 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 13:32 | no | 0 | 14 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 17:26 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:21 | yes | 5 | 8 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 19:28 | yes | 5 | 7 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:45 | yes | 25 | 31 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:53 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:49 | yes | 5 | 14 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:25 | yes | 25 | 30 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:19 | yes | 19 | 26 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:07 | no | 0 | 12 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:05 | yes | 3 | 15 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:56 | yes | 15 | 17 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:08 | yes | 9 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:27 | yes | 8 | 20 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:24 | yes | 11 | 23 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 11:55 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:31 | yes | 5 | 17 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:21 | yes | 10 | 15 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:19 | yes | 24 | 61 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:25 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 08:42 | no | 0 | 37 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:28 | yes | 15 | 49 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:42 | yes | 20 | 96 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 08:42 | yes | 10 | 29 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 09:20 | yes | 8 | 60 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:59 | yes | 14 | 30 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:43 | yes | 18 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:27 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 16:45 | no | 0 | 17 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 11:43 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:50 | yes | 9 | 9 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:44 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:21 | yes | 23 | 32 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:09 | yes | 10 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:27 | no | 0 | 27 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:34 | yes | 16 | 34 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 14:09 | yes | 24 | 116 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 13:06 | yes | 12 | 39 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:28 | yes | 2 | 10 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:03 | yes | 13 | 27 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:07 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:27 | yes | 4 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:29 | no | 0 | 26 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 09:45 | yes | 10 | 9 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:08 | yes | 5 | 14 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:49 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:35 | yes | 25 | 42 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:07 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:45 | no | 0 | 30 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:56 | yes | 23 | 44 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:58 | yes | 14 | 23 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 15:56 | no | 0 | 37 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:57 | yes | 3 | 20 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 10:19 | yes | 15 | 22 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:38 | yes | 20 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:38 | yes | 4 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:59 | yes | 7 | 23 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 12:32 | yes | 10 | 5 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:55 | yes | 22 | 20 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:44 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 19:23 | yes | 24 | 61 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:45 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:19 | no | 0 | 32 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:23 | yes | 24 | 44 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 14:57 | yes | 25 | 31 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:35 | yes | 22 | 61 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 16:29 | yes | 5 | 21 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:01 | yes | 23 | 36 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Acronis read as Acronis Cyber Protect
Bitdefender read as Bitdefender GravityZone
Bitdefender (GravityZone) read as Bitdefender GravityZone
Bitdefender GravityZone Business Security Premium read as Bitdefender GravityZone
Broadcom read as Symantec Endpoint Security
Broadcom (Symantec) read as Symantec Endpoint Security
Broadcom Symantec read as Symantec Endpoint Security
Broadcom Symantec Endpoint Protection read as Symantec Endpoint Security
Broadcom Symantec Endpoint Security read as Symantec Endpoint Security
Broadcom Symantec Endpoint Security Complete (SESC) read as Symantec Endpoint Security
Check Point read as Check Point Harmony Endpoint
Cisco read as Cisco Secure Endpoint
CrowdStrike Falcon Endpoint Protection Platform read as CrowdStrike Falcon
Cynet read as Cynet 360
ESET read as ESET PROTECT
Huntress read as Huntress Managed EDR
Kaspersky read as Kaspersky Endpoint Security
Kaspersky Endpoint Security for Business read as Kaspersky Endpoint Security
Malwarebytes (Enterprise Tier) read as Malwarebytes ThreatDown
Palo Alto (Cortex XDR) read as Palo Alto Networks Cortex XDR
Palo Alto Networks read as Palo Alto Networks Cortex XDR
SOPHOS read as Sophos Intercept X
SentinelOne read as SentinelOne Singularity Endpoint
Sophos read as Sophos Intercept X
Sophos (Intercept X/Endpoint) read as Sophos Intercept X
Sophos Endpoint read as Sophos Intercept X
Sophos Endpoint (Intercept X) read as Sophos Intercept X
Sophos Endpoint / Intercept X read as Sophos Intercept X
Symantec read as Symantec Endpoint Security
Symantec Endpoint Protection read as Symantec Endpoint Security
Symantec Endpoint Protection (Broadcom) read as Symantec Endpoint Security
Symantec Endpoint Security Complete read as Symantec Endpoint Security
Trellix read as Trellix Endpoint Security Suite
Trellix (Formerly McAfee + VMware) read as Trellix Endpoint Security Suite
Trellix (McAfee Enterprise) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee Enterprise) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee MVX) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee) read as Trellix Endpoint Security Suite
Trellix (formerly McAfee/FireEye) read as Trellix Endpoint Security Suite
Trend Micro read as Trend Micro Apex One
Trend Micro (Trend Vision One) read as Trend Micro Apex One
Webroot (OpenText) read as Webroot Business Endpoint Protection
Unresolved, counted raw
Broadcom (Symantec) Endpoint Security
Cylance (Now Part of BlackBerry Cyber Security Suite)
Kaspersky endpoint products
Legacy Symantec Endpoint Protection
Microsoft Defender Home Edition
SEP
Symantec EDR S550 hardware appliance
Traditional McAfee ePO
VMware Carbon Black Cloud
Discontinued, still offered
No shut-down product was recommended here.