We just raised a $30M Series A: Read our story

Malwarebytes Competitors and Alternatives

Get our free report covering Microsoft, SentinelOne, CrowdStrike, and other competitors of Malwarebytes. Updated: November 2021.
553,954 professionals have used our research since 2012.

Read reviews of Malwarebytes competitors and alternatives

Mohammad Ali Khan
Director at Pacific Infotech UK ltd
Real User
Top 20
Automatic remediation and rollback help us minimize the number of technicians needed to support customers

Pros and Cons

  • "It has a one-click button that we can use to reverse all those dodgy changes made by the virus program and bring the system quickly back to what it was. That's one of the most important features."
  • "Another valuable feature is that if a machine is infected, one that may infect other computers within the network, we have the capability of segregating that machine in the network so that it remains connected to the internet but is cut off from the other machines in the network. That helps prevent spreading of the infection. That's a very unique feature, one I have not seen in the last 10 to 15 years from any other antivirus program. That's amazing."
  • "One of the areas which would benefit from being improved is the policies. There are still software programs where we need to manually program in the policies to tell the system, "This program is legitimate." Some level of AI-based automation in creating those policies would go a long way in improving the amount of time it takes to deploy the system."

What is our primary use case?

We are a managed services provider. We are not just using it for ourselves, but we are also supporting it and deploying it for a number of our customers.

The primary use case is that it's endpoint protection software and we use it to protect our end customers' endpoints, whether they are Apple or computers, laptops or servers.

SentinelOne is software as a service, but it has an agent that has to be installed on a computer or a server onsite.

How has it helped my organization?

Its Behavioral AI recognizes novel and fileless attacks and responds in real-time. What that means is that we have better confidence. For example, a number of users use USB drives which they bring from home. While we have a lot of customers where we have actually restricted the use of external USB drives, there are certain customers where we cannot restrict that use because of the way they run their businesses. The result, for them, is that there is a constant fear that at any given point in time, an infected USB from someone's home computer can actually infect the whole lot of computers within the corporate environment. But having SentinelOne means we have a certain level of peace of mind, so that even if something completely new tries to enter the network or the system via a USB drive, for example, it doesn't matter. The system will detect it and kill it. There is a level of protection which we never felt before using SentinelOne.

As a managed service provider, the most important thing is that the more secure a customer's network is, the less time our team will spend trying to fix issues. One of our customers is a prestigious hotel in London, and they were struggling, literally battling, with a virus that had infected their network of about 90 computers. Whatever we could have done, and all their previous IT company could have done, could not have eliminated that virus. Even if you completely formatted a computer, it kept coming back. The only way we were able to clean that whole network up and stabilize the environment was when we brought in SentinelOne. Before that it was Symantec, and Symantec couldn't do anything to control that infection. But SentinelOne brought in such stability, that since we introduced it into that network about one-and-a-half years back, not a single report has come in of any infection there.

Also, when we have to report on attacks to a customer, the customer always asks us for the root cause analysis. It is very important for us to understand the behavior and to find out where that infection came from and what it initially did so that we can look at that behavior and try to prevent it from happening again elsewhere. SentinelOne helps us in doing the root cause analysis and reporting back to our customers. It gives us insight into where a problem started and how it propagated into the system. Tracking the history of the virus' actions gives that insight, which is very important. Otherwise, there is no way to create a root cause analysis report for a security breach.

The automatic remediation and rollback in Protect mode, without human intervention, is already enabled on almost all of our computers. That helps us minimize the number of technicians we need to work on things. Automatic remediation is a policy which we enable when we deploy the system, which means that a lot of things happen automatically. And from our side, we only keep an eye on the dashboard. That means that we need fewer technicians to support the system. It provides support itself through that functionality.

Overall, SentinelOne has reduced our incident response time, absolutely. In our case, it's particularly true because we have remote teams working from remote offices. With SentinelOne, we don't need to send someone onsite because we can see a lot of things from a single pane of glass on the dashboard. And if there is a problem, we can do all the troubleshooting, and working on that incident, remotely. So it has definitely improved the way we have provided cybersecurity to our customers.

And it has reduced our mean time to repair by more than 60 percent. Previously, when we were using other solutions, we had to do a lot more work.

The solution's automation has also increased analyst productivity. The effect is significant in the sense that the amount of time our analysts used to spend on security has been reduced. These days, they only have a look at the dashboard which is open on one of the screens in our office. They just keep an eye on that and as long as it shows everything is green, they don't even bother drilling down and looking at other stuff. It's only when they see an alarm coming up that they jump in and look at it. That was never the case before. Before, they were remotely accessing computers and working on them and trying to fix issues. That has become a thing of the past since we started using SentinelOne.

What is most valuable?

It's artificial intelligence-based software. The best part is the fact that it doesn't necessarily rely on definitions, like other software. For example, Symantec, AVG, Avast, and Kaspersky, traditional antivirus software, rely on virus definitions. So every now and then, if there is a virus infection, they will compile a new set of virus definitions and push it to the local agent so it will know that this virus exists and that it should keep an eye out for it. 

These traditional software solutions have small levels of functionality that may help them to identify if there are any dodgy activities within the computer. They would then try to mitigate those, but only to a very limited extent. With SentinelOne, that's not the case because it basically has its own intelligence to identify any dodgy behavior within the system. As soon as SentinelOne detects anything which is not right, it will start tracing the changes being made. And because it's centrally controlled, it will give the controller team an early indication that there is something wrong and that we need to fix it. Not only that, but it will block it and keep track of it for mitigation.

We also use the solution’s ActiveEDR technology. Because it's an agent-based system, it is monitoring internally. It's not that the central system is doing it. It's keeping an eye on the functioning of the endpoint itself. If the endpoint is functioning properly, it will sit behind the scenes and not do anything at all. As soon as it sees any malicious activity within the system, that's where it's triggered. The artificial intelligence part of the agent is able to differentiate what activity can be considered malicious and what activity can be considered normal. And that's big. It's something that cannot happen without that kind of intelligence in place.

It has a one-click button that we can use to reverse all those dodgy changes made by a virus program and bring the system quickly back to what it was. That's one of the most important features.

Another valuable feature is that if a machine is infected, one that may infect other computers within the network, we have the capability of segregating that machine so that it remains connected to the internet but is cut off from the other machines in the network. That helps prevent spreading of the infection. That's a very unique feature, one I have not seen in the last 10 to 15 years from any other antivirus program. That's amazing.

We have used it on Mac and we have used it on Windows. We have seen a good level of protection, because since installing it for those of our customers who have taken it, not a single report of a breach has come out. I feel very strongly that the system is quite capable.

What needs improvement?

One of the areas which would benefit from being improved is the policies. There are still software programs where we need to manually program in the policies to tell the system, "This program is legitimate." Some level of AI-based automation in creating those policies would go a long way in improving the amount of time it takes to deploy the system. 

There is also a bit of room for improvement in the way SentinelOne is deployed. Right now we push it, but a lot of the time the pushing doesn't work. So we have to log in to each computer and do a manual install. That area would help in making the product stronger.

For how long have I used the solution?

We have been using SentinelOne for about two-and-a-half years.

What do I think about the stability of the solution?

It's very stable. I have not seen it crash, nor have I seen any other problems.

How are customer service and technical support?

I have not used their technical support. My engineers have used it, and their feedback about the support has been good so far. I don't think they have had complaints.

How was the initial setup?

The initial setup is straightforward. But when deploying it to 100 or 200 or 300 machines, pushing it is easier than logging on to each machine and doing it manually. But sometimes, pushing doesn't work and doing it manually takes a little bit more time. But that's a one-off exercise.

We don't have much of an implementation strategy for the solution. As an MSP, there are a lot more things going on, day-to-day, than just dealing with SentinelOne. But for deployment, I get my boys to log on to a customer's systems, do the push, and then whatever does not work through push deployment, they install manually.

For maintenance of SentinelOne, we only have two engineers who look at it on a day-to-day basis. We don't need any more than that. In terms of deployment, it depends on the size of the deployment. If it's a 100-user deployment, we would have a team of three or four who would do it over a few days' time.

What was our ROI?

The return for us is that it has reduced the manpower we require.

What's my experience with pricing, setup cost, and licensing?

Pricing is a bit of a pain point. That's where we have not been able to convince all of our customers to use SentinelOne. The pricing is still on the higher side. It's almost double the price, if not more, of a normal antivirus, such as NOD32, Kaspersky, or Symantec.

I understand that these are not similar products, but for a customer who has a certain amount of money to pay for an antivirus, they can only spend so much. That's where it becomes hard to convince them to pay double the price for endpoint security.

That is the only feature of this product which causes us to step back and not be able to deploy it for absolutely every customer we have. We would love to, but obviously if the customer doesn't have the budget to pay for it, there is not much we can do.

If they can somehow bring the prices down, that would massively help in bringing this to a lot more customers.

Which other solutions did I evaluate?

We looked into other solutions, but not as deeply as we went into SentinelOne. Because we liked SentinelOne so much, we just stopped there. And we already had experience with the likes of Malwarebytes, Symantec, and AVG. This was a far superior product.

I haven't had a chance to take a deeper dive into Carbon Black, but that is something I have been told is comparable to SentinelOne.

One of the things which attracted me to SentinelOne was the fact that it is the only product which is tied to the SonicWall platform, and we use the SonicWall platform a lot. A lot of our customers have SonicWall firewalls. Having a combination of SonicWall and SentinelOne provides an end-to-end security arrangement with products that are integrated with each other.

What other advice do I have?

Go for it. It's an absolutely brilliant product. But understand what it is before starting to deploy. Unless you understand the product, you will not know how to use it to the best of its best capabilities.

The solution's Behavioral AI works with and without a network connection, providing the internal protection. But having that network connection is important because it will then be able to report it to the central dashboard. While it will do what it has to do locally, it's helpful when the agent reports back to the central dashboard so that the IT Admin can take action. It is important that the systems remain connected to the internet.

But overall, the Behavioral AI is amazing. It's something very new in the market. The way SentinelOne works and the way it is set up, I haven't been more impressed by any other product. It is a step forward in security.

We have 400 to 500 endpoints using SentinelOne at the moment, and all those customers are happy. We are happy that they're using it, because it helps us secure their network better than what they had before. We have it on laptops which have been given to home users, on computers in offices, on servers in computer rooms. They all have SentinelOne and we are happy with the level of protection that it offers.

Moving forward, with every customer whose antivirus is coming up for renewal in our portfolio, we are recommending getting rid of Symantec and other products and taking on SentinelOne.

It's very effective and it's improving by the day. In the last two-and-a half years I have seen that the way it detects and the way it mitigates threats are constantly improving. It's a very effective solution.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: Partner
MikeCarr
Director of IT at Clune Construction
Real User
Reduced the amount of time we spend investigating false positives

Pros and Cons

  • "The biggest feature is that it hides everything from your operating system that's running in-memory from anything to try to run against it. That's the most unique thing that's on the market. There's nothing else out there that's quite like that. That's a big selling point and why we went with it. It does exactly what the design does. If you can't find it, you can't execute against it."
  • "Automating reports needs improvement. I would like to have better reporting capabilities within it or automated reporting to be a little bit more dynamic. That's something I know they're working on. We literally are in the process. We started the process a week and a half ago of going to their latest version, so I've not seen their latest one up and running yet."

What is our primary use case?

Morphisec is deployed to our desktops and servers, and we're running a server for it. We're switching to their cloud server and then it will be managed through that.

When I started at my company five years ago, they did not have a lot of protection in place. I ran across Morphisec at a technology show that I was at, got to really speaking with them and understanding the technology. I felt that this would be one cheaper way to help block anything from actually running in memory or execute against anything we had running in-memory on our endpoints.

How has it helped my organization?

We're not only using Microsoft Defender we also use Sophos. Morphisec plays well with Sophos also, which was another selling feature, because we wanted to make sure we had a traditional anti-malware and antivirus platforms also.

Prior to me starting with using it, we had infections and machines that were taken down. We have not had one machine that has been taken down due to malware now in almost four and a half years. That's huge. We have 600 machines right now that we don't have routine infections because nothing can execute.

It has definitely affected our team's productivity. 

Morphisec has reduced the amount of time we spend investigating false positives. It doesn't allow anything false to execute against anything. So if something does get triggered to an alert, it was definitely a problem that was resolved and isolated immediately. We have Morphisec as a base layer and we have Sophos as a secondary layer. Between those three tools or those three levels of security, nothing is getting run on those machines.

It has also reduced my team's workload. They're not rebuilding machines and reformatting and remediating problems as nearly what we were when we first started. We were dealing with a ton of infections. The company was much smaller then. We were 300 employees and we're at 600 now. I don't have anything to quantify that because we have grown so much and we don't have the problems as I did a couple of months ago before we put that in place.

Morphisec helps us to save money on our security stack. First and foremost it helps by preventing infections which prevents my technicians from having to re-image machines or remediate the problem itself. That rate right off the bat is savings. I cannot quantify that because I don't have a number compared from four and a half years ago to now.

What is most valuable?

The biggest feature is that it hides everything from your operating system that's running in-memory from anything to try to run against it. That's the most unique thing that's on the market. There's nothing else out there that's quite like that. That's a big selling point and why we went with it. It does exactly what the design does. If you can't find it, you can't execute against it.

What needs improvement?

Automating reports needs improvement. I would like to have better reporting capabilities within it or automated reporting to be a little bit more dynamic. That's something I know they're working on. We literally are in the process. We started the process a week and a half ago of going to their latest version, so I've not seen their latest one up and running yet.

For how long have I used the solution?

I have been using Morphisec for about four and a half years. We're a couple of releases behind, but we're in the process of doing a cloud migration right now.

What do I think about the stability of the solution?

The stability is great. We don't have problems with it. We have not had a problem with it where it's gone down, not functioned or anything else in the four and a half years we've been using it.

What do I think about the scalability of the solution?

We have not encountered any issues with scalability. We've been able to put it on whatever server we wanted with however many endpoints. We've grown from 300 to 600 since we started that process and there was no hiccup with adding additional machines or anything else.

There are about 600 users using it right now. We are a construction company. So, the roles are from admin, accounting, HR, IT, project management, field staff, supervisors, and superintendents. It's installed everywhere possible that we can as far as an endpoint.

There are two people on the infrastructure team who deal with it.

We do have plans to increase usage.

How are customer service and technical support?

The support has been very nice. We've had zero issues. They're very helpful. They're easy to get ahold of any time we've had questions. Their deployment team is the same way.

Which solution did I use previously and why did I switch?

Previously Malwarebytes was in place. I would not put it in the same category as this at all. Morphisec is a unique tool, one of the most unique ones on the market.

I had seen the demonstration. I was really impressed with what it did. My systems manager went through multiple demos, scenarios, and everything, and it really helped us out. Our rep made us 100% comfortable with the platform. So, that was really the selling part right there.

How was the initial setup?

The initial setup was pretty straightforward. I had my systems manager at the time just work with them and get it loaded up with no major issues.

The initial deployment was about two and a half to three weeks because we were going across multiple machines and servers.

Our strategy was to protect our endpoints right away, which we were able to create a deployment for that to get that up and running and work on what servers we could because we could not do every server. That's a very invasive process and it took us a little bit of time to get that worked out.

What about the implementation team?

We worked with Morphisec. 

What was our ROI?

I have seen ROI. The way I gauge that is the lack of tickets, the lack of machines not having to be imaged, the lack of the employees' time, which we could try to break down an hourly salary of around $40,000 a year. If they have to spend two days working on a machine versus what it costs me for that license, there is no comparison.

What's my experience with pricing, setup cost, and licensing?

It is an inexpensive platform. It gives us good threat protection prevention. The cost per user is significantly less than most of the other competitive products on the market.

We are still using a separate tool. I know for our 600 or I think we're actually licensed for up to 700 users, it runs me 23 or $24,000 a year. When you're talking to that many users plus servers being protected, that's well worth the investment for that dollar amount.

There are no additional charges to the standard license.

It's very straightforward. It's basically a flat-rate model. It is a scalable model. Contract-wise, it was simple. It was a one-page document and done.

What other advice do I have?

We have not delved into deterministic attack prevention. It has those tools in there. We have not delved into that because between that tool and our other tool, we really don't have any infections happening.

My advice would be to sit there and get a demo of it, understand it. I've actually spoken on their behalf before because I was a satisfied customer. It's a product that just works. You put it in place and you could forget it at that point. It protects against the unknowns.

Some of the other things were that they found stuff in a tool called CCleaner. They found a virus that was embedded in their code that they were submitting out themselves. As far as finding things and stopping things that are unknown, that's the biggest takeaway you can get from it.

They were thinking outside the box when they developed it, to put a tool like this in place that blocks the unknown, blocks things, executing against anything in-memory. 

I would rate Morphisec a ten out of ten. 

Which deployment model are you using for this solution?

Public Cloud
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate
MH
Managing Director at FORESEC
Real User
Top 5
Fair price and useful for protection, but should have the ability to recover data from the last normal copy

Pros and Cons

  • "We have just started to implement it. It is useful for protection from malware and ransomware."
  • "Auto recovery is the most important feature that we would need from this solution. For decryption, similar to Malwarebytes, there should be something to be able to recover the data up to the last normal status. Its ability to recover data to the last normal copy must not exceed 5 to 10 minutes."

What is our primary use case?

We are using it for protection. We had a request from one of our customers, and we just started to implement it. We don't have any great idea about it. We are in the process of implementing it for the first time.

We are using its latest version. It is on-prem. The problem with going for a cloud version is that most of our customers prefer to work with on-prem solutions. So, we need all the features to be available on-prem as well as on the cloud.

What is most valuable?

We have just started to implement it. It is useful for protection from malware and ransomware. We are not exactly sure about zero-day, but we are trying to see if it will be effective for everyday antivirus purposes.

What needs improvement?

Auto recovery is the most important feature that we would need from this solution. For decryption, similar to Malwarebytes, there should be something to be able to recover the data up to the last normal status. Its ability to recover data to the last normal copy must not exceed 5 to 10 minutes.

For how long have I used the solution?

We just started to use it.

What do I think about the stability of the solution?

We need to test its functionality in heavy environments.

How are customer service and technical support?

Their support could be faster through the phone. The support through chat is very unuseful. It takes a lot of time and effort and but does not help in any way. We provide the first line of support to customers, so it is not a big issue for us.

Which solution did I use previously and why did I switch?

We work on most of the protection products, such as Kaspersky, Malwarebytes. We normally use a lot of them. We had a request from one of our customers, so we started to implement Microsoft Defender for Endpoint.

How was the initial setup?

Its initial setup is straightforward. The solution itself doesn't take more than 15 to 20 minutes, but the configuration duration depends on the environment, such as the number of policies, users, etc. It will vary according to the environment in which you are doing the implementation.

What about the implementation team?

We implement it ourselves. Currently, we have only one customer of this solution.

What's my experience with pricing, setup cost, and licensing?

Its price is fair. It has approximately the same price as the other products such as Kaspersky. It is much cheaper than Malwarebytes.

What other advice do I have?

I would rate Microsoft Defender for Endpoint a seven out of 10.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
AMMAR DHABAAN
Acting Manager of Information Technology Department at kAMARAN iNDUSTRY & iNVESTMENT cO
Real User
Efficient solution with good performance

Pros and Cons

  • "Endpoint Security is efficient and easy to use. It doesn't slow the performance of your personal computer."
  • "Kaspersky could be improved by better malware protection. They have to take advantage of Malwarebytes and integrate the same engine inside Kaspersky. I use Malwarebytes as well because Kaspersky doesn't always detect malware."

What is our primary use case?

My primary use case is for threat protection. 

What is most valuable?

Endpoint Security is efficient and easy to use. It doesn't slow the performance of your personal computer. 

What needs improvement?

Kaspersky could be improved by better malware protection. They have to take advantage of Malwarebytes and integrate the same engine inside Kaspersky. I use Malwarebytes as well because Kaspersky doesn't always detect malware. 

For how long have I used the solution?

I have been using this solution for five or six years. 

What do I think about the stability of the solution?

This solution is stable and the performance is good. There isn't much maintenance required, so you can manage by yourself, especially if you have experience in technical support, security, and Kaspersky. I think Kaspersky should have some type of free training to gain more traction in the market. 

What do I think about the scalability of the solution?

There are around 500 people in my organization using Kaspersky. 

How are customer service and support?

I have never contacted technical support. As an IT professional, I have handled everything myself. 

Which solution did I use previously and why did I switch?

I use Malwarebytes because it's the best malware product. 

In the past, I have also used McAfee, Trend Micro, and Norton. We shifted to Kaspersky when it was introduced to the market. Both the companies I work for use Kaspersky. 

How was the initial setup?

Kaspersky is very easy to install. It took about five minutes. Endpoint Security has an SaaS version for Windows, a software upgrade service. Installation is easy and the documentation Kaspersky provides is very good. 

What about the implementation team?

I implemented this solution myself. 

What's my experience with pricing, setup cost, and licensing?

I prefer paying for a yearly license because it has some discounts. One of the companies I work for pays for the Business Select license, for 100 users. 

What other advice do I have?

I rate Kaspersky a nine out of ten. Many products tend to be a bit weak. For example, sometimes when you use the Windows operating system, it works for six months, then you have to reinstall it again or restore an image and then start working with it. It's not like Linux. Kaspersky is the best, one of the top three in the world, and I would definitely recommend it to others who are considering implementation. 

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Get our free report covering Microsoft, SentinelOne, CrowdStrike, and other competitors of Malwarebytes. Updated: November 2021.
553,954 professionals have used our research since 2012.