App Review Entreprise Version Comparative - Sophos vs Checkpoint vs Eset vs Bitdefender (Hard Settings + EDR)

[Shadowra]

Content source

https://odysee.com/@Shadowra:f/Entreprise-Version---Sophos-vs-Checkpoint-vs-Eset-vs-Bitdefender-(Hard-Settings-+-EDR):e

Welcome to this comparison!
Today we're going to compare 4 enterprise versions of antivirus software: Sophos InterceptX, Checkpoint Harmony, ESET Protect + EDR and Bitdefender GravityZone with HyperDetect.

A few details:
- All the antivirus products have been configured to the maximum for this test, and the default test was carried out 1 month ago.
- I add the EDRs offered by the suppliers if they offer them (this is the case with Sophos, ESET and Bitdefender).
- I don't own the licences, I don't show the whole panel and I hide the owner.
- Many thanks to @kamiloxf for the licences

Spoiler: Sophos Intercept X

Sophos offers a very simple agent and a fairly simple yet comprehensive panel.
The software is easy to set up, so I set it to maximum.

On the Web, Sophos leaves 1 malware which is ConnectWise.
Nothing to say about the fake crack.

Malware Pack: remains 58 out of 122.
Sophos's behavioural protection is very average...
It will try to defend itself as best it can (it managed to block a few attacks) but during the test, not everything went as I expected.
During execution, ConnectWise activated and gave me a magnificent block (often used by "Microsoft Tech Support" crooks) and I had to restart the machine by force.
When I continued, the situation got worse... Sophos left a BATCH script that installed a Ransomware without reacting.
I have to stop the test.

Spoiler: Checkpoint Harmony

CheckPoint is evolving and offering a new interface that's more polished and elegant for my taste! It's still in BETA, but I'm activating it to check it out.
On the Web, CheckPoint lets through a malicious Google Chrome download, although the dropper is detected afterwards.
There's nothing to say about the fake crack detected either.

Malware Pack: Remains 26 out of 122

CheckPoint proves its performance by blocking all the traps I set for it.
The HTA file is blocked, so it cannot connect.
1 file remains in memory, detected by no antivirus.
Just 1 trace of infection is present at the end of the test.

Spoiler: ESET Protect

ESET offers an enterprise version based on Smart Security Premium. I'm integrating its EDR for the test.
Surprisingly for ESET, everything is configured on the agent! Few settings are available on the panel... It's a debatable choice, but let's move on.

On the Web, ESET blocks all links by blocking them at source.
On the fake crack, nothing to say, ESET blocks executions.

Malware Pack: remains 34 out of 122.

ESET has held on to executions, and is starting to react well to scripts.
When GuLoader tries to install itself, ESET prevents it from connecting, a good point!
On the other hand, the same script that killed Sophos passes through without reacting and installs the Ransomware... ESET is unable to stop it, nor to remedy this with its EDR.
Quite disappointing.

Spoiler: Bitdefender GravityZone with HyperDetect

Bitdefender has updated its GravityZone version and FINALLY has an excellent panel, which is very comprehensive, if not too comprehensive!
You can now configure everything: Engine aggressiveness, IDS aggressiveness, HyperDetect aggressiveness etc.
I also activated the Bitdefender Sandbox for the test.

On the Web, everything is blocked except Google Chrome, which installs itself.
On the fake crack: Bitdefender blocks all launches.

Malware Pack: remains 36 out of 122.

After an analysis that lasted over 1 hour, I can finally run the threats.
And I have to say I'm very surprised: Bitdefender makes a totally clean machine! No malware got through!
This is down to its proactive protection and HyperDetect, which correctly blocked the threats.
The detection of NPE is a false positive, it's the blocking of Microsoft telemetry.
I was very surprised!

 

[Bot]

Thank you for this comprehensive comparison of Sophos InterceptX, Checkpoint Harmony, ESET Protect + EDR, and Bitdefender GravityZone with HyperDetect. It's clear that each antivirus software has its strengths and weaknesses. Sophos seems to struggle with behavioral protection, while CheckPoint and ESET have proven their performance in blocking traps and reacting to scripts, respectively. Bitdefender's proactive protection and HyperDetect feature seem to be the most effective, blocking all threats in your test. It will be interesting to see how these software continue to evolve and improve their security measures.

 

[Artificial intelligence]

Welcome to this comparison!
Today we're going to compare 4 enterprise versions of antivirus software: Sophos InterceptX, Checkpoint Harmony, ESET Protect + EDR and Bitdefender GravityZone with HyperDetect.

A few details:
- All the antivirus products have been configured to the maximum for this test, and the default test was carried out 1 month ago.
- I add the EDRs offered by the suppliers if they offer them (this is the case with Sophos, ESET and Bitdefender).
- I don't own the licences, I don't show the whole panel and I hide the owner.
- Many thanks to @kamiloxf for the licences

Spoiler: Sophos Intercept X

Sophos offers a very simple agent and a fairly simple yet comprehensive panel.
The software is easy to set up, so I set it to maximum.

On the Web, Sophos leaves 1 malware which is ConnectWise.
Nothing to say about the fake crack.

Malware Pack: remains 58 out of 122.
Sophos's behavioural protection is very average...
It will try to defend itself as best it can (it managed to block a few attacks) but during the test, not everything went as I expected.
During execution, ConnectWise activated and gave me a magnificent block (often used by "Microsoft Tech Support" crooks) and I had to restart the machine by force.
When I continued, the situation got worse... Sophos left a BATCH script that installed a Ransomware without reacting.
I have to stop the test.

Spoiler: Checkpoint Harmony

CheckPoint is evolving and offering a new interface that's more polished and elegant for my taste! It's still in BETA, but I'm activating it to check it out.
On the Web, CheckPoint lets through a malicious Google Chrome download, although the dropper is detected afterwards.
There's nothing to say about the fake crack detected either.

Malware Pack: Remains 26 out of 122

CheckPoint proves its performance by blocking all the traps I set for it.
The HTA file is blocked, so it cannot connect.
1 file remains in memory, detected by no antivirus.
Just 1 trace of infection is present at the end of the test.

Spoiler: ESET Protect

ESET offers an enterprise version based on Smart Security Premium. I'm integrating its EDR for the test.
Surprisingly for ESET, everything is configured on the agent! Few settings are available on the panel... It's a debatable choice, but let's move on.

On the Web, ESET blocks all links by blocking them at source.
On the fake crack, nothing to say, ESET blocks executions.

Malware Pack: remains 34 out of 122.

ESET has held on to executions, and is starting to react well to scripts.
When GuLoader tries to install itself, ESET prevents it from connecting, a good point!
On the other hand, the same script that killed Sophos passes through without reacting and installs the Ransomware... ESET is unable to stop it, nor to remedy this with its EDR.
Quite disappointing.

Spoiler: Bitdefender GravityZone with HyperDetect

Bitdefender has updated its GravityZone version and FINALLY has an excellent panel, which is very comprehensive, if not too comprehensive!
You can now configure everything: Engine aggressiveness, IDS aggressiveness, HyperDetect aggressiveness etc.
I also activated the Bitdefender Sandbox for the test.

On the Web, everything is blocked except Google Chrome, which installs itself.
On the fake crack: Bitdefender blocks all launches.

Malware Pack: remains 36 out of 122.

After an analysis that lasted over 1 hour, I can finally run the threats.
And I have to say I'm very surprised: Bitdefender makes a totally clean machine! No malware got through!
This is down to its proactive protection and HyperDetect, which correctly blocked the threats.
The detection of NPE is a false positive, it's the blocking of Microsoft telemetry.
I was very surprised!

First come, I'm watching

 

[Artificial intelligence]

Bitdefender is very good, you can try the consumer and business versions of Kaspersky.

*This is the first time I've seen a virus disguised as Kaspersky, ha ha ha .

 

[Lavamate]

I am surprised that ESET is not only bad with ransomware in the home version, but also in the business version.

However, I have to say that I recommended Eset to the whole family 9 years ago because it simply worked well and was trouble free. And even then, only one person had problems, and that was with some ransomware that had partially encrypted the hard drive. After that, of course, nobody wanted to use it any more Quite sad that they still havent got to grips with it.

@Shadowra , would you agree with my thesis that, based on the current tests and the contributions of other users here in the forum, it can be said with a high degree of certainty that Bitdefender is currently developing the best antivirus solution in and from the EU?

 

[Shadowra]

@Shadowra , would you agree with my thesis that, based on the current tests and the contributions of other users here in the forum, it can be said with a high degree of certainty that Bitdefender is currently developing the best antivirus solution in and from the EU?

yep

 

[simmerskool]

@Shadowra can you comment on the heaviness (lightness) of these 4? I have tried Bitdefender in the past but always backed away because it felt too heavy or unsmooth. Or is it the better the protection the clunkier they run??

 

[Miravi]

@Shadowra can you comment on the heaviness (lightness) of these 4? I have tried Bitdefender in the past but always backed away because it felt too heavy or unsmooth. Or is it the better the protection the clunkier they run??

I felt the same way for the most part. ESET's sense of lightness on my machine really helped seal the deal.

 

[Shadowra]

@Shadowra can you comment on the heaviness (lightness) of these 4? I have tried Bitdefender in the past but always backed away because it felt too heavy or unsmooth. Or is it the better the protection the clunkier they run??

Sohos is light except when it comes to
Checkpoint has fairly average consumption
Eset is very light
Bitdefender is a consumer, but no impact felt

 

[TuxTalk]

yep

They do, but for me the most bothering thing is, the stupid ( in my opinion ) dashboard they use, the weird update policy, and the bugs that never stop. I stopped using anything from them, even their vpn is not accurate. With all these kind of issues for me , Bitdefender is not trustworthy to use anymore, i am in a email / support battle with them for long and they intend to just close any open tickets without feedback to the customer.
They should really hire new more customer friendly people on customer support.

 

[Trident]

That’s actually the previous interface Check Point used
It’s not new. ZoneAlarm sort of resembles some parts of it like the scan. Great video, great products and great results with the exception of Sophos, which we all know isn’t all that good.

 

[Khushal]

That’s actually the previous interface Check Point used
It’s not new. ZoneAlarm sort of resembles some parts of it like the scan. Great video, great products and great results with the exception of Sophos, which we all know isn’t all that good.

I was expecting a bit more from sophos but anyways. Here's another sophos test.

 

[cartaphilus]

Welcome to this comparison!
Today we're going to compare 4 enterprise versions of antivirus software: Sophos InterceptX, Checkpoint Harmony, ESET Protect + EDR and Bitdefender GravityZone with HyperDetect.

A few details:
- All the antivirus products have been configured to the maximum for this test, and the default test was carried out 1 month ago.
- I add the EDRs offered by the suppliers if they offer them (this is the case with Sophos, ESET and Bitdefender).
- I don't own the licences, I don't show the whole panel and I hide the owner.
- Many thanks to @kamiloxf for the licences

Spoiler: Sophos Intercept X

Sophos offers a very simple agent and a fairly simple yet comprehensive panel.
The software is easy to set up, so I set it to maximum.

On the Web, Sophos leaves 1 malware which is ConnectWise.
Nothing to say about the fake crack.

Malware Pack: remains 58 out of 122.
Sophos's behavioural protection is very average...
It will try to defend itself as best it can (it managed to block a few attacks) but during the test, not everything went as I expected.
During execution, ConnectWise activated and gave me a magnificent block (often used by "Microsoft Tech Support" crooks) and I had to restart the machine by force.
When I continued, the situation got worse... Sophos left a BATCH script that installed a Ransomware without reacting.
I have to stop the test.

Spoiler: Checkpoint Harmony

CheckPoint is evolving and offering a new interface that's more polished and elegant for my taste! It's still in BETA, but I'm activating it to check it out.
On the Web, CheckPoint lets through a malicious Google Chrome download, although the dropper is detected afterwards.
There's nothing to say about the fake crack detected either.

Malware Pack: Remains 26 out of 122

CheckPoint proves its performance by blocking all the traps I set for it.
The HTA file is blocked, so it cannot connect.
1 file remains in memory, detected by no antivirus.
Just 1 trace of infection is present at the end of the test.

Spoiler: ESET Protect

ESET offers an enterprise version based on Smart Security Premium. I'm integrating its EDR for the test.
Surprisingly for ESET, everything is configured on the agent! Few settings are available on the panel... It's a debatable choice, but let's move on.

On the Web, ESET blocks all links by blocking them at source.
On the fake crack, nothing to say, ESET blocks executions.

Malware Pack: remains 34 out of 122.

ESET has held on to executions, and is starting to react well to scripts.
When GuLoader tries to install itself, ESET prevents it from connecting, a good point!
On the other hand, the same script that killed Sophos passes through without reacting and installs the Ransomware... ESET is unable to stop it, nor to remedy this with its EDR.
Quite disappointing.

Spoiler: Bitdefender GravityZone with HyperDetect

Bitdefender has updated its GravityZone version and FINALLY has an excellent panel, which is very comprehensive, if not too comprehensive!
You can now configure everything: Engine aggressiveness, IDS aggressiveness, HyperDetect aggressiveness etc.
I also activated the Bitdefender Sandbox for the test.

On the Web, everything is blocked except Google Chrome, which installs itself.
On the fake crack: Bitdefender blocks all launches.

Malware Pack: remains 36 out of 122.

After an analysis that lasted over 1 hour, I can finally run the threats.
And I have to say I'm very surprised: Bitdefender makes a totally clean machine! No malware got through!
This is down to its proactive protection and HyperDetect, which correctly blocked the threats.
The detection of NPE is a false positive, it's the blocking of Microsoft telemetry.
I was very surprised!

NOOOO ESET let one file through! NOW I have to rebuild my whole architecture!!! Years and Years of planning and designing the perfect secure network and now this?!!!! /probably someone out there.


But honestly, I am glad that Bitdefender Gravity Hyperdetect did it's thing. I am still kind of upset with Harmony, for the amount of resources it uses one would expect a perfect result but something always seems to get past it. Oh well.

I would understand a crack getting past the EDR since the AI patterns are trained more towards enterprise solutions and attack vectors, not many enterprise partners use cracked software . But for an ransomware to get through yeah that's no bueno.

Great test! And thank you!

 

[cartaphilus]

One thing I forgot to add: Why was ESET tested in Balanced configuration and not Aggressive? Also PUP was disabled. I know that Bitdefender had it maxed out.

 

[Trident]

I am still kind of upset with Harmony, for the amount of resources it uses one would expect a perfect result but something always seems to get past it. Oh well

A bit exaggerated. On many @Shadowra tests, specially the ones that were performed with my configurations and rules, nothing could get past it.

The amount of resources it consumes is in line with most of the EDRs and the job it does, and can further be reduced if one wants it reduced.

Harmony on this test also has the highest pre-execution protection, 26 remaining vs 58, 36, 34. Harmony is in a different cluster of its own.

That for that.

 

[cartaphilus]

A bit exaggerated. On many @Shadowra tests, specially the ones that were performed with my configurations and rules, nothing could get past it.

The amount of resources it consumes is in line with most of the EDRs and the job it does, and can further be reduced if one wants it reduced.

Harmony on this test also has the highest pre-execution protection, 26 remaining vs 58, 36, 34. Harmony is in a different cluster of its own.

That for that.

Don't get me wrong, I love it. But I do find it heavier on the RAM/Resource (it has MANY processes running) and it tends to be a bit more sensitive regarding false positives and a bit of a pain to exclude the item once falsely detected (but that's personal opinion).

For example Harmony stopped Denuvo Antipiracy decryptor software which is perfectly fine from the science/tech point of view, I understand why it blocked it* but it was the only EDR that blocked it. It also shows off Harmony's deep AI links and reasoning in terms of what it seems to think what even a signed software be doing when it's executed considering that some of the function might appear malicious.

*DENUVO is basically a very deep hooking rootkit that defends itself with amazing ferocity as it should.

 

[Trident]

Don't get me wrong, I love it. But I do find it heavier on the RAM/Resource (it has MANY processes running) and it tends to be a bit more sensitive regarding false positives and a bit of a pain to exclude the item once falsely detected (but that's personal opinion).

For example Harmony stopped Denuvo Antipiracy decryptor software which is perfectly fine from the science/tech point of view, I understand why it blocked it* but it was the only EDR that blocked it. It also shows off Harmony's deep AI links and reasoning in terms of what it seems to be malicious even though the software was signed.

*DENUVO is basically a very deep hooking rootkit that defends itself with amazing ferocity as it should.

They reduced now the resource consumption in 88.70, make sure you’re running that. Yes, for harmony digital signatures don’t matter. If it looks malicious, it is malicious. We’ve seen what trusting digital signatures leads to — it’s not pretty.

That’s one of the trade offs when you deal with business-oriented companies like Check Point, Trend Micro and so on — they execute protection in a way that’s suitable for businesses and may not always tickle the home users fancy.

 

[cartaphilus]

They reduced now the resource consumption in 88.70, make sure you’re running that. Yes, for harmony digital signatures don’t matter. If it looks malicious, it is malicious. We’ve seen what trusting digital signatures leads to — it’s not pretty.

oh COOL yeah running the latest recommended version which I think it's .6.

 

[Trident]

oh COOL yeah running the latest recommended version which I think it's .6.

88.70 was a big upgrade and took long time to be released, a lot of delays but finally, loads of cleanup and optimisations were done. Try it.

 

[Trident]

Btw I abstain from commenting on Harmony, because I remember the explosive drama that happened last time, because of which, I stopped posting anything here whatsoever. So won’t comment on this thread anymore or on any Harmony-related topics.