Before the new Observatory for Endpoint Security arrives, a look back at what technology executives told ETR's 2025 feedback panel: legacy tools were hanging on, SIEM integration was a sore spot, and platforms were pulling ahead.
With a new Observatory for Endpoint Security on the way, we are revisiting the feedback panel that accompanied last year's study, a late-2025 conversation with technology executives from global enterprises and public institutions. The 2025 ETR Observatory for Endpoint Security surveyed 303 IT decision makers with direct utilization and evaluation knowledge of the tools they rated. The panel described a market in transition: McAfee and Symantec were still in the stack but losing ground, platforms were absorbing more of the budget, and practitioners wanted fewer consoles more than another best-of-breed point tool.
Legacy Tools Persisted, but Eroded: McAfee, Symantec, and Trellix remained in place at several enterprises, while Tanium, CrowdStrike, and Palo Alto Cortex filled gaps the legacy vendors could not close.
Platform Convergence Accelerated: Firms consolidated around Microsoft Defender, Palo Alto Networks, and CrowdStrike to simplify management and align security spend with enterprise agreements.
SIEM Integration Stayed Painful: Panelists called endpoint the single largest source of SIEM signals, and piping that data into tools like Splunk felt expensive and noisy.
Budgets Depended on Framing: Funding varied widely by sector, and leaders agreed that quantifying risk and reputational damage, not cost, was what unlocked investment.
One technology executive at a global financial services firm described McAfee and Symantec as "basically a mainstay in our endpoint stack," despite "a somewhat long and somewhat tortured history with those." The firm brought in Tanium as "an answer to emerging challenges and gaps that those legacy providers could not cover," and balanced Trellix, Symantec, and Cylance across regions and device types. Even Palo Alto Networks, the firm's broader cybersecurity leader, had not won the endpoint: "When it comes to endpoint, we were not that impressed."
Others were further along. A second panelist had moved deliberately from Symantec to Palo Alto's Cortex and XSIAM platforms, alongside Microsoft Defender and CrowdStrike's Complete MDR, though not without caveats: "CrowdStrike is a little slow on the Linux side of the world." A third had replaced Trellix with Microsoft Defender, Cisco Umbrella, and CrowdStrike.
The spending data matched that momentum. Tanium, Palo Alto Networks, and Microsoft Defender posted the top three Net Scores in the 2025 study, with Tanium showing the sharpest year-over-year jump of the group.
The 2025 ETR Observatory for Endpoint Security asked 303 IT decision makers with direct utilization and evaluation knowledge about next 12-month spending intentions for vendors in this area, overlaid with 2023 and 2024 Net Scores; the top three 2025 Net Scores (Tanium, Palo Alto Networks, Microsoft Defender) are shown, and full reports are available on the ETR Platform.
One executive said they felt "vindicated" hearing others move away from Symantec: "Our internal guidance is to maintain Trellix, and Symantec is kind of on the way out. We're not actively decommissioning, but it's basically marked for divestiture."
Microsoft Defender, once dismissed as a basic utility, had grown into a formidable enterprise player, and ETR survey data showed Microsoft as the most frequently prioritized platform in hypothetical rebuild scenarios. "We're on an EA, so we're paying for it and we might as well use it, for something as low level and low value as antivirus," said one. Another was blunter: "You bundle enough stuff together, people eventually feel forced to use it." A third pointed to familiarity: "It's the same interface, so it's easier."
Defender also led every endpoint tool in the study on ease of implementation.
The 2025 ETR Observatory for Endpoint Security also asked users of each tool about agreement rates around ten individual product dimensions; this figure shows user perceptions around ease of implementation for each endpoint security tool.
CrowdStrike sustained its reputation for innovation despite a tumultuous year. More than a quarter of respondents named it the most innovative endpoint security vendor, well ahead of Microsoft and Palo Alto Networks. One panelist moving from QRadar to Cortex still gave CrowdStrike the edge on deployment: "The agents are lightweight, and it's quicker."
ETR surveyed users about the most innovative endpoint security offering, derived from a survey of 303 IT decision makers with direct utilization and evaluation knowledge of the specific tools listed.
Palo Alto's endpoint story came in two phases. Its first offering, Traps, "wasn't quite impressive," one IT lead explained. Cortex was where Palo Alto "really stepped up to what their expectation of the modern detection capabilities in endpoint is," putting it "much closer to what CrowdStrike and Sentinel offerings are." Hyperscalers were blurring the lines further. "Google acquired Mandiant and Wiz," one executive noted. "That's just evidence of how much resources hyperscalers are willing to throw now into this aspect."
The costliest friction sat between endpoint and SIEM. "The biggest producer of data or signals into SIEM is actually coming from endpoint," one executive said, warning of a "flood of signals" of limited value. "We now realize that we might have to shift gears and realign our stack away from this legacy, whether it's going to be around CrowdStrike or maybe even SentinelOne." Splunk remained the firm's SIEM of record, but it "still kind of leaves us a little bit dissatisfied."
For many, the answer was fewer panes of glass. One leader rebuilding security controls after a corporate spinoff wanted "a security dashboard that integrates all of my security tools, and creates a real-time alerting system." Another cautioned against chasing best-of-breed at the expense of practicality, framing cybersecurity investment as "pretty much about uptime and system resiliency."
Funding depended heavily on sector. In education, security dollars were hard to secure, and one leader said it came down to presentation: "How can you present the risk that can quantify the amount of losses that people have faced, especially in your industry?" At a financial institution, the math was simpler: "Even with our current spend, one breach blows that out of the water." Reputational exposure and rising cyber insurance costs added pressure, though the real hurdle was elsewhere: "It's really explaining why the solution is unique or novel and needed."
This panel set a clear baseline: legacy vendors in managed decline, Defender winning on convenience, CrowdStrike winning on innovation, and Tanium and Palo Alto carrying the strongest spending momentum. The new Observatory for Endpoint Security will show which of those positions held.