this post was submitted on 15 Oct 2026
66 points (97.1% liked)
Linux
15221 readers
986 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Not really, Defender is quite popular as an EDR solution and a lot of companies love the pricing and logging of a modern EDR.
Defender with its timeline is also better than some of the alternatives I've seen in the field.
The pricing is garbage. The only benefit is the classic "unreasonable enterprise demands" (UED, that's my term for it): Rather than use multiple tools that are each best in class (and possibly cheaper or even free!) enterprises will always choose one product that does all the things. Even if it does those things poorly or even worst-in-class.
Example: VMWare. For ages, enterprises used VMWare for all their VMs because it could run/manage both Windows and Linux VMs from a single tool. Even though HyperV for Windows is vastly superior for Windows VMs and KVM is vastly superior for Linux VMs.
Aside: Yes, you can run Linux on HyperV and Windows on KVM but neither are ideal.
Windows Defender as an EDR is OK-ish for Windows but it'll never top CrowdStrike Falcon or SentinelOne Singularity for Linux. It probably won't be better than FOSS alternatives like Cilium Tetragon or even Falco (because of their flexibility/customizable nature).
Edit: I also have a pretty firm belief that putting Windows people in charge of managing Linux systems (of any kind) is always a bad idea. Yet the very nature of the product (Microsoft Defender) insists upon this.
EEE in full effect.