Falcon vs Datto EDR: Which is a better fit?

Anshuman A

Security Engineer

Detailed analysis of processes, logon attempts, and great ability to sync with Splunk and Active Directory. Great dashboard to add to the best parts.

Andre A

Systems Administrator

Sometimes it is not update automatically, and I had some problems to remove the software, the key that is used to install/remove fails sometimes.

Andre A

BDM

Falcon is easy to use and easy to implement. It delivers the best containment and alerting rate in the market and gives good visibility from IT, IOT and Cloud.

When you are in a limited bandwidth with a higher number of PC’s this will cause too high bandwidth utilization and can interrupt your operation.

Knowing that our assets are secured and protected by highly skilled security staff 24/7 and that it is go to product for security makes me and the firm feel secure.

Diagnosing malware threats, attack vectors and root-cause was never easier.

The support team is very responsive and helps guide us through any issues we have. They also help clear up what is a rather complex, information filled portal.

Andre A

Systems Administrator

Another thing that you can miss, you cannot run a scan on your computer manually, to find viruses or other malicious files, it is supposed to be monitored all the time through the portal.

It's a good start and will be a great product in 12 months when the roadmap of features are released into production.

Still a new product to an extent and missing some niche features.

I like that Datto EDR is affordable and very effective when it comes to analytics.

EDR doesn't turn off when sent and received instructions from management software. EDR ignores exceptions in policies.

I like the ease of deployment and the reporting capabilities.

One server has needed to be rebuilt to restore functionality EDR messed with, even after spending hours manually deleting EDR. Second server needs to be rebuilt.

Good experience so far - Q4 feature integration should make it even better.

Alert-only policies still quarantined files automatically, even those explicitly excepted. EDR is suspected to be interfering with server operations without raising alerts.