Technologies explained

Unified detection and response across endpoints, identities, email and cloud apps.

• Defender for Endpoint (EDR, attack surface reduction)
• Defender for Office 365 (phishing, Safe Links and Attachments)
• Defender for Identity (on-premises AD threats)
• Defender for Cloud Apps
• Incidents, advanced hunting with KQL and automated investigation

Best for: Stopping attacks that cross email, identity and devices.

Data security, governance and compliance: classify, label and protect information wherever it goes.

• Sensitivity labels and encryption
• Data loss prevention
• eDiscovery and audit
• Insider risk management
• Data security posture management for AI

Best for: Protecting sensitive data before and after Copilot rollout.

Enterprise endpoint security: next-generation antivirus, EDR and attack surface reduction.

• Endpoint detection and response with live response
• Attack surface reduction rules
• Vulnerability management
• Automated investigation and remediation
• Device isolation and onboarding through Intune

Best for: Protecting laptops and servers from ransomware and hands-on attackers.

Cloud-delivered endpoint protection and EDR platform with a lightweight agent.

• Next-generation antivirus and EDR
• Prevention and response policies
• Host groups and sensor update policies
• Threat hunting and real-time response

Best for: Endpoint protection in organisations that standardise on Falcon.

Traditional and next-generation antivirus suites still common in small and mid-sized environments.

• Central management consoles
• Policy-based scanning and exclusions
• Device control and web filtering
• Migration planning to Defender or EDR

Best for: Managing mixed estates and planning AV consolidation.

Zero Trust access that replaces broad VPN access with per-app, device-aware access.

• Per-application access policies
• Device posture checks
• Agent-based secure access
• Integration with identity providers

Best for: Giving staff secure access to internal apps without a full VPN.