Endpoint Security Narrows to Two as Most Rivals Lose Momentum

ETR Observatory for Endpoint Protection Tools  

This is a summary of the full report. Use the request form at the bottom of the article to download the complete findings.

Key Takeaways

• CrowdStrike leads the 2026 study with the highest Net Score (54%, up from 46%), Net Usage (53%), three-year retention (61%), and most votes for most-innovative (35%) and rebuild (29%) selections.

• Microsoft Defender sees the widest user base and leads four of ten product measures, including ecosystem integration (92%) and ease of implementation (85%), though Net Score fell 7 ppts y/y to 41%.

• Several leading endpoint vendors see year-over-year declines in Net Scores, led by SentinelOne (18%, down from 38%) and Palo Alto Networks (39%, down from 52%)

• Among feature priorities, Advanced Threat Protection leads the field at 59%, up from 44% last year, followed by Ease of Management (45%) and Automated Response (33%, up from 24%)

• Sophos (4%) and Broadcom (8%) anchor the low end of the vendor’s Net Score, while Check Point posts the field's largest year-over-year Net Usage gain to 33% from 15%, on a somewhat more limited base.

Executive Summary 

The 2026 ETR Observatory for Endpoint Protection Tools surveyed 300 IT decision makers in August 2026 on spending intentions and product perceptions across the endpoint security market. The respondent base skews upmarket, with 58% of respondents from Large organizations, and includes 37 Fortune 500 and 59 Global 2000 members. North America represents 73% of respondents, followed by EMEA at 18%, APAC at 8%, and LatAm at 1%. Top industries include Services/Consulting (20%), IT/TelCo (16%), and Financials/Insurance (13%).

CrowdStrike holds the highest Net Score (54%) and Net Usage (53%) in the 2026 study and is the only vendor in the top five to raise its Net Score y/y. Microsoft Defender, Palo Alto Networks, Fortinet, and Cisco round out the upper tier, each with softer spending intent than in 2025. CrowdStrike also widens its lead in strategic mindshare, taking 35% of most-innovative selections (up from 27%) and 29% of rebuild-from-scratch votes (up from 23%), ahead of Microsoft at 25%. SentinelOne posts the sharpest Net Score decline among continuing vendors, while Check Point Software shows the largest Net Usage improvement.

Introduction

Endpoint protection has moved well beyond signature-based antivirus. Today's platforms pair next-generation prevention with Endpoint Detection and Response (EDR), extend telemetry across identity, cloud, and network sources through Extended Detection and Response (XDR), and increasingly automate investigation and containment. Because laptops, servers, and cloud workloads remain primary targets for ransomware and credential-based attacks, the endpoint agent has become the anchor for broader security platforms, and vendors are using that footprint to pull in adjacent capabilities such as security analytics, exposure management, and managed detection and response (MDR). The vendor field is consolidating as well, reflected in this study by Carbon Black and Symantec now reported together under Broadcom and by Cylance now tracked under Arctic Wolf. In this Observatory, ETR examines spending intent, usage, and product perceptions across 12 endpoint vendors as the market consolidates. This report covers the 12 vendors meeting the N≥15 inclusion threshold for discussion, listed below. Carbon Black and Symantec, reported separately in 2025, now appear as a single Broadcom entry, and Arctic Wolf replaces the prior Cylance (Arctic Wolf) listing.

The Observatory Report

The ETR Observatory is a structured survey designed to track vendor-level momentum and product perception across key enterprise technology markets. Unlike the ETR Technology Spending Intentions Survey (TSIS), which measures macro-level spending intentions across thousands of respondents, the Observatory focuses on a defined subsector and solicits product-specific responses from practitioners who actively use or evaluate the tools. Net Score reflects estimated spending intent, calculated as the sum of respondents who are Adopting plus those planning to Increase spend, minus those planning to Decrease spend or Replace the product. Net Usage measures the expected direction of usage over the next 12 months relative to the prior 12, as the share reporting increasing usage minus those reporting decreasing usage.

Conclusion – CrowdStrike Pulls Away as the Endpoint Field Concentrates

The 2026 Endpoint Protection Observatory shows a market further concentrating around two platforms, CrowdStrike and Microsoft Defender. CrowdStrike improved its Net Score, Net Usage, three-year retention outlook, and mindshare in the same cycle while most rivals saw spending intent soften, and Microsoft Defender remains the most widely deployed tool in the study with the strongest marks on integration and ease of implementation. Meanwhile, notable vendors in the field including Palo Alto Networks and SentinelOne present more nuanced and mixed outlooks, with data showing lower spending intent but rising usage. At the low end, Sophos and Broadcom carry the weakest Net Scores and the highest churn signals.

To dive deeper into the ETR Observatory's insights and uncover the full competitive landscape, use the form below to check out the complete data set.

About ETR

Enterprise Technology Research (ETR), a Futurum company, is an enterprise technology market research firm that delivers actionable, transparent, and unbiased insights to institutional investors and a trusted community of technology leaders, empowering them to make smarter, faster decisions. ETR’s proprietary approach is grounded in their vision to reinvent technology market research so that business leaders can strategically position their organizations to outperform the competition. In fact, no other firm harnesses the same scale and makeup of their vetted community to quickly deliver the unbiased data and analysis that financial organizations need to achieve better outcomes.

We use our core surveys to collect data and insights directly from the ETR Community. Use this data and insights to navigate the complex enterprise technology landscape and our proprietary visualizations and models to mine insights and unearth predictors of enterprise technology performance.

Beyond our core surveys, we also offer custom market research surveys. These can be commissioned with a targeted group and are guided by our expert content team to determine the best audience, topics, and questions. Additionally, the target group cannot only be based on their organization size, sector, and title, but also on our proprietary research around a firm’s spending intentions and technology stack.

Methodology
If you’re interested in the process behind the data, you’ll find it in the methodology section on our website.