GravityZone
Endpoint protection, detection and response platform.
Logging & Monitoring
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Addresses 847 stories in our coverage in the last 90 days 10 products that provide it
What it is
Agents on endpoints and servers that record activity, detect malicious behaviour and let responders isolate a machine in one click. XDR adds signals from email, identity and cloud.
How to value it
Antivirus alone misses the tools attackers actually use, which are often legitimate admin software. EDR is what lets you see and stop an intrusion before encryption, and cyber insurers commonly ask for it. Its value depends on someone watching the alerts, which is why it is often bought together with managed detection and response.
Questions to ask a vendor
- 1What independent test results can you show, for example MITRE ATT&CK Evaluations?
- 2Can we isolate a machine and collect evidence remotely?
- 3What is the performance impact, and how are agent updates rolled out safely?
- 4Who responds to alerts outside office hours?
For your risk register
- Risk
- Ransomware or intruder activity on endpoints goes undetected until impact.
- Control
- EDR on all endpoints and servers with alert handling around the clock.
- Owner
- Security operations lead.
- Measure
- Endpoint coverage and median time to contain.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Falcon Insight XDR
Endpoint detection and response with extended detection across other security tools.
Elastic Security
SIEM and endpoint security built on Elasticsearch, with open detection rules.
ESET PROTECT
Endpoint protection platform with detection and response add-ons.
Huntress Managed EDR
Endpoint detection and response monitored around the clock by Huntress analysts.
Microsoft Defender for Endpoint
Endpoint detection and response for Windows, macOS, Linux and mobile devices.
Cortex XDR
Endpoint detection and response with extended detection across network, cloud and identity.
Singularity Endpoint
Endpoint protection and detection with automated response and rollback.
Sophos Endpoint
Endpoint protection with Intercept X anti-ransomware technology and EDR.
WithSecure Elements XDR
Endpoint detection and response with extended detection, on the Elements cloud platform.
Recent stories it addresses
2644 stories in total- 17 Oct 2026Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli ad firm Discover-Tech used for Candiru spyware zero-click attacks against Al Jazeera.
- 16 Oct 2026Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Fake AI tools like Claude and ChatGPT are being used in phishing attacks against enterprise employees.
- 16 Oct 2026Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
OpenBSD root exploit chains 37-year-old bug with kernel flaw, bypassing protections.
- 16 Oct 2026Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials
Claude Code Desktop flaw allowed malicious HTML to steal developer credentials and private keys.
- 16 Oct 2026Prolific Chinese espionage group exploits BeyondTrust zero-day
Chinese espionage group Armory Castle exploits BeyondTrust zero-day.
- 16 Oct 2026Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers tampered with AOMEI Backupper update servers to deliver a backdoor.
- 16 Oct 2026Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
Forescout discovers new ROMULUS malware platform used in ClickFix attacks, linked to Vice Society.
- 16 Oct 2026CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA warns of critical BeyondTrust Remote Support vulnerability CVE-2026-102764, urging immediate patching.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.