SentinelOne v. MS Defender

Is SentinelOne Better than Microsoft Defender for Small Businesses?

Next generation antimalware, or endpoint threat protection, is available for small businesses. We’ve reviewed two of the market leaders. Which one will be best for you: SentinelOne V MS Defender?

What is next generation antimalware?

Malware is designed to commandeer your computer with malicious intent. It’s a blanket term that spans any kind of software designed to disrupt your computer, leak data, get access to private information or hold a user to ransom – depriving them of access to information until they pay.

560,000 new malwares are detected every day. However, there is a next generation of AI-powered endpoint threat protection to better secure your devices against these attacks.

Next generation antimalware, which combines next generation antivirus with EDR (Endpoint Detection & Response), goes beyond traditional antivirus software to not only remove known malware but also to detect malware it doesn’t yet know about. It also helps with recovery during and after an attack. It can also carry out forensic analysis to find the source of the breach and aid with preventing future incidents.

How does next generation antivirus work?

Until now, antivirus software has always been one step behind the bad actor because it relies on the vendor identifying the malware, creating an antidote (virus signature) and releasing an update. Once the update has been applied, your endpoint threat protection will intervene and block attacks from those known viruses.

Next gen Antivirus uses AI and other techniques to monitor patterns and behaviours to identify suspicious files on a device before they wreak havoc. This kind of analysis has proven to prevent malware attacks before they take hold and does not rely on having signatures of known viruses to protect your device.

What is EDR?

EDR (Endpoint Detection & Response) collects data from endpoints (laptop, servers, etc) and uses AI to build up a picture of whether a breach is occurring and how to remedy it, as well as helping to identify where an attack originated. This prevents malware from spreading across the network and includes automated responses like isolating infected devices.

Microsoft Defender for Business Vs SentinelOne.

Both MS Defender for Business and SentinelOne include next gen antivirus and EDR.

SentinelOne is fast becoming a market leader and there are very good independent reports about the effectiveness of its performance. It works in three ways:

1. Detects the malware by identifying and diagnosing suspicious behaviour and prevents it from spreading.
2. Helps you to recover from any disruption by restoring your system to its original state before the attack.
3. Performs forensics to figure out how, where and when the malware got in.

Microsoft now offers two levels of EDR-driven endpoint security; an enterprise version and a version for small businesses called Microsoft Defender for Business. And it’s great news for companies who have purchased Microsoft 365 Business Premium licenses because it comes included in the price.

As you might imagine, SentinelOne, including extra functionality, is the more expensive product. At the time of writing, If you purchase Defender for Business standalone, a monthly subscription is just under one third of SentinelOne’s price, and it will secure up to five devices.

The Microsoft Defender price is certainly favourable but is it as good as SentinelOne?

Having used and evaluated each of these products, we believe Microsoft Defender for Business is equally capable of handling endpoint security for small businesses as SentinelOne. In our opinion, SentinelOne outperforms Microsoft Defender for Business in one major way: its ability to recover the protected device to a point in time prior to the attack. Also, the depth of forensics is greater in SentinelOne. That said, Microsoft Defender for Business’s forensic performance is still very good, for example, it can still tell you how the malware attack happened.

More importantly, Microsoft Defender is part of Microsoft’s ecosystem of security products which work together to take a more holistic approach to security, helping you to protect identities, data, applications and devices across on-premises, cloud and mobile. 

Three reasons why we recommend Microsoft Defender for Business  to our clients:

1. It’s great value for money.
2. It has ample functionality for our fully managed client base of small to medium sized businesses.
3. It is part of the wider Microsoft ecosystem and works side-by-side with Microsoft’s other security services.

If you’d like to know more about keeping your business secure, get in touch with us at [email protected]. We’d be happy to hear your feedback or discuss your security concerns.