Before evaluating any product, answer one question: who is going to watch it?
If the answer is "nobody 24/7," you are not buying endpoint detection and response — you're buying managed detection and response, and the product decision becomes secondary to the service decision. Industry estimates put roughly 65% of organizations under 1,000 employees without round-the-clock coverage. An unwatched console detects nothing, however good the sensor.
Assuming you've settled that, here's how to evaluate the technology.
What EDR actually does
It records what happens on your endpoints — process launches, network connections, file changes, credential use — and looks for patterns that indicate an attack. When it finds one, it alerts, and usually it can isolate the machine from the network on command.
That last capability is the one that matters most in practice. The ability to contain a host in seconds, remotely, at 3am, is what converts a detection into a non-incident.
The five questions that actually differentiate products
1. What does it cover? Windows, macOS and Linux parity varies enormously, and vendor marketing rarely leads with the gaps. If you have a Mac-heavy fleet or Linux servers, test on those specifically. Also ask what it can't run on — network appliances, VPN concentrators and firewalls can't take an agent, and those are exactly where attackers have been living. Mandiant documented an implant sitting on one such device for roughly 400 days.
2. Can it contain, and who is allowed to? Ask whether network isolation is one click or a workflow, whether it works when the machine is off your network, and — if you're buying a managed service — whether the provider will contain on your behalf or only notify you. Get the answer in writing. "We'll call you" at 3am on a Sunday is a different product from "we'll isolate it."
3. What does it cost when you're actually using it? Base licence, then the modules. Published list prices run roughly $60 to $185 per device per year depending on tier (verified against vendor pricing pages and third-party contract trackers in 2026), but real contracts are heavily negotiated, and add-on modules routinely add 50–200%. Ask specifically about true-up terms — several vendors only adjust upward.
4. How noisy is it in your environment? Not in the demo. Run a pilot on a representative slice of your estate for at least two weeks and count the alerts a human has to make a decision about. This number determines whether the tool gets used or ignored, and it varies more by environment than by vendor.
5. Where does your telemetry go? EDR ships detailed endpoint activity to a vendor cloud. If data residency matters to you — GDPR, sovereignty requirements, a sensitive sector — ask which regions are available. This is a genuine advantage for self-hosted open-source options and for vendors headquartered in your jurisdiction.
What evidence to trust
In descending order:
Independent evaluations, read raw. MITRE's ATT&CK Evaluations are the best public evidence available. Read the actual results, not the press release — MITRE explicitly does not rank vendors, and several vendors claim to have "won."
One caveat that matters in 2026: only eleven vendors participated in the 2025 round, published in December. Microsoft, Palo Alto Networks and SentinelOne all declined, citing the resource demands. Absence of data isn't evidence of weakness, but it does mean you can't check their current claims independently — which shifts the burden onto your own pilot.
Independent malware testing from AV-Comparatives and AV-TEST, which also measure false positives — a metric vendors rarely volunteer.
Analyst positioning, useful for market structure, less useful for whether a product fits you.
Practitioner consensus from people running it at your scale.
Vendor claims, last. Any "100% detection" figure was produced under a configuration you will not replicate.
The operational reality nobody puts in the datasheet
Security agents are themselves operational risk. In July 2024 a faulty CrowdStrike content update crashed roughly 8.5 million Windows machines worldwide, on Microsoft's estimate. Not an attack — a bad file. It's the reason staged deployment rings, N-1 update policies and documented recovery runbooks are now standard expectations regardless of vendor. Ask any vendor how content updates are staged and what your rollback options are.
Coverage gaps are the recurring failure. The post-mortem finding is almost never "we had no EDR." It's "we had EDR everywhere except that one server." Whatever you buy, the deployment completeness matters more than the product choice.
See minimum viable security for where EDR sits in the wider order of operations.
Tuning is a job. Budget roughly a quarter to a full person per major console you operate, or consolidate onto a platform and accept the concentration risk that comes with it.
The open-source position, honestly
Wazuh offers free endpoint monitoring with file integrity checking and vulnerability detection. osquery with Fleet gives you excellent visibility. Velociraptor is genuinely outstanding for forensics and hunting at scale, and it's free.
These are real tools that real teams run. But the honest framing: they provide visibility, not prevention, and they cost you engineering time instead of licence fees. Below roughly one full-time equivalent of security engineering, a bundled commercial product usually wins on total cost — and Microsoft Defender for Business, included in Microsoft 365 Business Premium at around $3 per user per month, is a legitimately strong baseline that many small organizations already own without realising.
A decision shortcut
Under 100 staff, no security team: Microsoft 365 Business Premium if you're already on Microsoft, plus a managed detection service. Huntress publishes around $8 per endpoint per month, which is the cheapest credible 24/7 coverage available.
100–1,000 staff, one or two security people: a mainstream EDR plus MDR, with containment authority granted to the provider in writing.
Over 1,000, with a security team: run the pilot properly, measure alert volume and false positives in your own environment, and weigh platform consolidation against concentration risk. Both directions carry real cost.
Sovereignty-constrained or air-gapped: self-hosted open source is the serious option, and you'll need the staff.
What we won't tell you
Which product is best. That question doesn't have a general answer, and anyone giving you one — including a comparison site — is either guessing or being paid.
What we will say is that no product is secure, results depend entirely on coverage, configuration and whether a human acts on the alerts, and the marginal value of switching EDR is almost always lower than the marginal value of operating the one you have properly.
What to do next: Before you shortlist anything, write down who will respond to an alert at 3am on a Sunday. If you can't name them, start with the MDR buying guide instead.
Related: Security tool directory · What MDR actually costs · Minimum viable security · Open-source security stack
Sources: MITRE ATT&CK Evaluations — 2025 Enterprise round, published Dec 2025, including the list of participating and non-participating vendors. AV-Comparatives and AV-TEST — independent detection and false-positive testing. Vendor pricing pages and third-party contract trackers, verified 2026. Mandiant M-Trends 2026 — edge-device dwell time. Microsoft — July 2024 CrowdStrike outage impact estimate.