GravityZone
Endpoint protection, detection and response platform.
Logging & Monitoring
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Addresses 1182 stories in our coverage in the last 90 days 10 products that provide it
What it is
Agents on endpoints and servers that record activity, detect malicious behaviour and let responders isolate a machine in one click. XDR adds signals from email, identity and cloud.
How to value it
Antivirus alone misses the tools attackers actually use, which are often legitimate admin software. EDR is what lets you see and stop an intrusion before encryption, and cyber insurers commonly ask for it. Its value depends on someone watching the alerts, which is why it is often bought together with managed detection and response.
Questions to ask a vendor
- 1What independent test results can you show, for example MITRE ATT&CK Evaluations?
- 2Can we isolate a machine and collect evidence remotely?
- 3What is the performance impact, and how are agent updates rolled out safely?
- 4Who responds to alerts outside office hours?
For your risk register
- Risk
- Ransomware or intruder activity on endpoints goes undetected until impact.
- Control
- EDR on all endpoints and servers with alert handling around the clock.
- Owner
- Security operations lead.
- Measure
- Endpoint coverage and median time to contain.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Falcon Insight XDR
Endpoint detection and response with extended detection across other security tools.
Elastic Security
SIEM and endpoint security built on Elasticsearch, with open detection rules.
ESET PROTECT
Endpoint protection platform with detection and response add-ons.
Huntress Managed EDR
Endpoint detection and response monitored around the clock by Huntress analysts.
Microsoft Defender for Endpoint
Endpoint detection and response for Windows, macOS, Linux and mobile devices.
Cortex XDR
Endpoint detection and response with extended detection across network, cloud and identity.
Singularity Endpoint
Endpoint protection and detection with automated response and rollback.
Sophos Endpoint
Endpoint protection with Intercept X anti-ransomware technology and EDR.
WithSecure Elements XDR
Endpoint detection and response with extended detection, on the Elements cloud platform.
Recent stories it addresses
3260 stories in total- 13 Nov 2026Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks
Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.
- 13 Nov 2026Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell
Unpatched Check Point gateways were wiped after exploitation of PHP2Shell and privilege escalation flaws.
- 13 Nov 2026Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks
StingyBasilisk group uses Windows named pipes and SMB to spread malware in isolated government networks.
- 13 Nov 2026US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist
US freezes $2.7B in crypto stolen by North Korean hackers from Binance.
- 13 Nov 2026Check Point warns of zero-day flaw exploited for root access
Check Point warns of zero-day flaw exploited for root access.
- 13 Nov 2026Hackers Use 4,837 Stolen GitHub Accounts to Target 61,764 Repositories
Hackers used 4,837 stolen GitHub accounts to target 61,764 repositories in the wfx-loot campaign.
- 13 Nov 2026New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections
New Windows zero-day 'SignDrop' allows local attackers to gain SYSTEM privileges by abusing CLFS.
- 13 Nov 2026Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Nightmare Eclipse drops Windows zero-day exploit 'SignDrop' abusing CLFS and Windows Defender.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.