Endpoint Security — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Antivirus / NGAV Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsClamAV Free unlimited OSS self-hosted, 0$; Defender for Endpoint P1 $3/user/mo or included in M365 Business Premium $22/user/mo, 90-day trial, free tier none standalone; SentinelOne Complete $15/device/mo ($179.99/device/yr) min 100 endpoints billed annually; CrowdStrike Falcon Go $59.99/device/mo ($719.88/yr per device) min 5 devices, Pro $79.99/device/mo, Enterprise $99.99/device/mo, 15-day trial, overage storage $0.40/GB over 5GB/device, extra device pro-rata
Endpoint Detection & Response (EDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Free unlimited agents self-hosted, community support; Carbon Black Standard $36/device/mo annual ($432/yr) min 50, $50/device/mo month-to-month; SentinelOne EDR $60/device/mo annual, Complete $75/device/mo, DataSet 7-day free 16GB/day; CrowdStrike Insight $99/device/mo ($1,188/yr per device) billed annually, Insight XDR $99.99/device/mo, Premium adds $10/device/mo for 90-day retention, overage $99 per additional device
Device Full-Disk Encryption Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsBitLocker/FileVault Native Free with OS (Windows Pro/Enterprise, macOS included), no central compliance without MDM - free unlimited; Sophos Central $28/device/yr ($2.33/device/mo) included in Intercept X Advanced, standalone $22/yr; Symantec $50/device/yr ($4.17/mo) min 25 licenses, $38/yr at 500+, management server appliance $5,000 one-time optional, overage recovery portal free
MDM / Unified Endpoint Management (UEM)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFleetDM OSS Free unlimited self-hosted; Mosyle Free 30 devices forever, Business $1/device/mo ($12/yr), Fuse $1.80/device/mo ($21.60/yr); Intune $8/user/mo standalone or $4/device/mo device-only, included in M365 Business Premium $22/user/mo, free trial 30 days; Jamf Pro $4/device/mo ($48/yr) min 25, Jamf Now $2/device/mo, overage $0.12/device/day, onboarding free
Patch Management Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutomox Free 25 devices forever, Work $3/device/mo ($36/yr) after, Full $5/device/mo, API 10k calls/mo free then $0.02/call; ManageEngine Cloud Free 25 devices, $1.20/device/mo ($14.40/yr) min 75 devices, on-prem perpetual $1,095 for 100 devices; Ivanti $42/device/yr ($3.50/mo) min 100, patch content subscription $8k/yr, overage third-party patch catalog $2k/yr
Vulnerability Scanning - Endpoint Agent
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free unlimited self-hosted community; Tenable.io $2,500/yr for 100 assets ($2.08/asset/mo), Nessus Professional $3,990/yr per scanner 1 year; Rapid7 InsightVM $1.84/asset/mo min 100 ($184/mo), overage agent $1.84/mo; Qualys VMDR $20,000/yr for 100 assets ($16.67/asset/mo) min 64 assets, overage $195/asset/yr, 30-day trial, storage 1TB included
Device Control / USB / Peripheral Control
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative Intune/Jamf policies Free with MDM + USBGuard Free OSS unlimited devices; ManageEngine Device Control Plus Free 25 devices, then $795/yr for 50 devices ($1.33/device/mo); CrowdStrike Device Control Add-on $20/device/mo ($240/yr) requires Falcon Go/Pro base; Digital Guardian $40/device/mo ($480/yr) min 100 devices, PoC free, overage DLP add $10/device/mo
Application Control / Whitelisting
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWDAC/AppLocker Free with Windows Enterprise/Education, unlimited policies; Airlock Digital Free 25 endpoints forever, then $2.50/endpoint/mo ($30/yr) min 50; Carbon Black App Control $44/device/yr ($3.67/mo) min 100, App Control + EDR $60/device/mo ($720/yr), overage audit $500 per compliance report
Endpoint Firewall Policy Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative firewall Free unlimited rules; ManageEngine Firewall Analyzer Free 5 devices, $595/yr for 10 devices ($4.96/device/mo) trial 30 days; Palo Alto Cortex XDR FirewallMgmt included in Cortex $44/endpoint/mo, standalone firewall add-on $5/device/mo ($60/yr), log overage $0.25/GB over 100GB; Intune firewall policies free with Intune license
Web Content Filtering / DNS Protection for Endpoints
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsCloudflare Gateway Free 50 users forever 1M DNS queries/mo 24h logs, Teams $7/user/mo unlimited queries 30-day logs; OpenDNS Home Free 1 network; DNSFilter $0.90/device/mo ($10.80/yr) DNS filtering only, Roaming $1.80/device/mo min 25 ($270/yr); Zscaler ZIA Business $3.50/user/mo ($42/yr) min 100, Transformation $6.50/user/mo, overage $0.10/GB over 5GB/user, 10GB log retention included
Endpoint Asset Inventory & Discovery
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT/FleetDM OSS Free unlimited assets self-hosted; Lansweeper Free 100 assets, Pro $1.20/asset/mo ($14.40/yr) min 500 assets $7,200/yr; PDQ Inventory Free 14-day trial, Enterprise $500/yr per admin unlimited devices; Tanium Asset $6/device/mo ($72/yr) min 1000 $72k/yr requires Tanium Core $10/device/mo, overage API 100k queries/mo included
FileVault / BitLocker Key Escrow & Recovery Portal
Moves money — charges, payouts to sellers, taxes, fraud checks. Highest-stakes integration: get it wrong and you break compliance or lose revenue.Pricing & free-tier limitsAD/iCloud native Free unlimited keys manual workflow; Mosyle Business $1/device/mo includes escrow free, Free tier 30 devices escrow free; Intune escrow free with Intune $8/user/mo or $4/device/mo device-only, Entra ID storage unlimited free; Sophos recovery portal $1,200/yr base + $4/device/mo, included in $28/yr encryption license, overage API calls free
Endpoint Logging & Telemetry Aggregation (SIEM Agent)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh/Osquery Free unlimited self-hosted; Elastic Security Agent Free up to 200MB/day free cloud 14-day retention, Standard $95/mo per 1GB/day ingest; Graylog Open Free 5GB/day self-hosted, Cloud $250/mo for 5GB/day 30-day retention; Splunk Cloud $135/GB/mo ($1,620/GB/yr) ingestion min 5GB, free 500MB/day trial, LogScale free 16GB/day 7-day retention $0.40/GB after
Endpoint Remote Wipe & Lock
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFind My Mac/Windows free unlimited with iCloud/MS account; Intune Wipe/Lock free with Intune $8/user/mo, selective wipe included; Mosyle wipe included in $1/device/mo Business; Absolute $4.50/device/mo ($54/yr) min 250 devices persistence module included, overage remote wipe API $0.05/action, freeze $0
Removable Media Encryption
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsVeraCrypt Free unlimited volumes self-hosted, audit community; BitLocker To Go free with Windows Pro/Enterprise; ESET FDE + Media $40/device/yr ($3.33/mo) includes removable; Symantec Media Encryption $30/device/yr ($2.50/mo) standalone, $50/yr bundled with FDE, overage USB policy audit $500 per report
Endpoint Compliance & Posture Assessment
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh + OpenSCAP Free unlimited checks; ManageEngine Device Compliance $4/device/yr ($0.33/mo) min 100; Intune compliance free with $8/user/mo, 500 compliance evaluations free/included, $0.01 per extra evaluation over 100k/mo; Tanium Comply $6/device/mo ($72/yr) requires Core $10/device/mo, CIS benchmarks $100/pack/yr, overage reports $2k/yr
Endpoint Isolation / Remote Quarantine & Containment
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsIntune network isolation free with Intune; SentinelOne isolation free with Singularity Complete $15/device/mo, RemoteOps add-on $8/device/mo ($96/yr); Carbon Black isolation included in Enterprise EDR $50/device/mo ($600/yr); CrowdStrike Contain included in Falcon Pro $79.99/device/mo and up, standalone containment $15/device/mo, overage forensic snapshot $5/snapshot over 100/mo
Secrets / Credential Management for Endpoints
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted unlimited secrets; HCP Vault $0.03/hr per cluster (~$21.90/mo) + $0.50 per 10k transactions; Doppler Free 5 users 100 secrets, Team $12/user/mo ($144/yr) unlimited secrets 30-day log; CyberArk Endpoint $45/device/mo ($540/yr) min 100 + $5k setup fee, overage API $0.10 per 1k calls over 100k/mo, free trial 30 days
Endpoint Certificate Management & SCEP
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsSmallstep OSS Free unlimited certs self-hosted, Let's Encrypt Free 90-day certs rate 50/domain/week; SCEPman Free 50 managed certs; EJBCA Cloud $199/mo for 250 certs ($0.80/cert/mo) overage $0.50/cert/mo; DigiCert Client Cert $4/device/yr ($0.33/mo) + platform $5,000/yr base, auto-renewal included, overage $1/cert replacement, free ACME trial
Extended Detection & Response (XDR) Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh + TheHive Free self-hosted unlimited; Defender XDR included in M365 E5 $57/user/mo ($684/yr), Defender XDR P2 add-on $5.20/user/mo; SentinelOne XDR $75/device/mo ($900/yr) annual min 100, overage $75/device; CrowdStrike Falcon Fusion XDR $129.99/device/mo ($1,559/yr), Complete XDR Managed $184.99/device/mo, data ingest 5GB/device included overage $0.60/GB, 30-day trial
Data Loss Prevention (DLP) for Endpoints
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenDLP Free self-hosted limited policies; Purview DLP included in M365 E5 $57/user/mo, E5 Compliance add-on $10/user/mo, free trial 90 days storage 100GB included overage $0.20/GB; Safetica Essentials $2.50/endpoint/mo ($30/yr) min 50 $1,500/yr; Symantec DLP Endpoint $72/user/yr ($6/mo) min 100 $7,200/yr, Discover add-on $20k/yr, overage incident storage $0.30/GB/mo
Endpoint Threat Intelligence Feed & IOC Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX/MISP Feodo Free unlimited IOCs community feeds; Anomali Community Free up to 5 feeds; Recorded Future Express $2,500/mo ($30k/yr) for 50 users; CrowdStrike Intel Standard $20k/yr flat org + $30/endpoint/yr, Premium $40k/yr + $45/endpoint/yr; Mandiant Advantage $35k/yr base + $75k/yr Enterprise, $6/endpoint/mo for 1000 endpoints $72k/yr extra, API 100k queries/mo included then $0.001/query
Endpoint Forensics & Incident Response Toolkit
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor Free unlimited agents self-hosted; KAPE Community free, Commercial $1,795/yr ($149/mo) per analyst; Magnet Axiom Cyber $3,995/yr per analyst ($333/mo) includes 1 yr updates; EnCase Endpoint Investigator $3,995/yr per investigator ($333/mo), FTK bundle $4,500/yr, endpoint agent $35/endpoint/yr ($2.92/mo), overage collections $250 per collection over 100/mo
Endpoint Identity / Zero Trust Agent (ZTNA)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsCloudflare Zero Trust Free 50 users forever 24h logs 1M requests; Teams Standard $7/user/mo unlimited, Enterprise $14/user/mo; Tailscale Free 3 users 100 devices unlimited traffic, Personal Pro $6/user/mo (min $18/mo), Teams $8/user/mo; Zscaler ZPA Business $3.20/user/mo min 100 users ($320/mo), Transformation $6.25/user/mo, overage traffic $0.08/GB after 10GB/user included
Endpoint Sandboxing / Malware Analysis Detonation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCuckoo OSS Free self-hosted unlimited samples, Any.Run Community Free 60 sec detonation 3/day; Joe Sandbox Cloud Basic $199/mo ($2,388/yr) 100 analyses/mo, Pro $699/mo 500; CrowdStrike Sandbox included in Falcon Pro+ $79.99/device/mo, standalone $30/device/mo ($360/yr) 1k detonations/mo; Palo Alto WildFire $3,500/yr base 5k submissions, $7k/yr 50k subs, $14k/yr 200k subs, overage $0.20/submission, free trial 1k submissions
Endpoint Anti-Exploit / Exploit Guard / Memory Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWindows Exploit Protection free with Windows 10/11; Malwarebytes EDR including anti-exploit $45/device/yr ($3.75/mo) min 10 (450/yr), free 14-day trial; Microsoft Defender Exploit Guard free with Defender P1/P2; CrowdStrike Exploit protection included in Go $59.99/device/mo, add-on module $20/device/mo ($240/yr) advanced memory scanning, overage exploit event logging $0.15/event over 10k/mo
Secure Boot & TPM Attestation Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative UEFI/TPM free unlimited with hardware; Intune TPM attestation free with Intune $8/user/mo, compliance logs free; ManageEngine audit free 25 devices, then $1/device/mo; Eclypsium $3.50/device/mo ($42/yr) min 500 $21k/yr base platform $42k/yr, supply chain $5/device/mo, overage firmware scan $0.10/device/scan after 10k/mo
Endpoint Network Access Control (NAC) Agent & Posture
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsPacketFence + FreeRADIUS Free unlimited self-hosted; Portnox Cloud NAC $2.50/device/mo ($30/yr) min 100 $3k/yr, free 30-day trial; Cisco AnyConnect $4/user/mo + ISE licensing $7/endpoint/mo, base appliance $40k one-time; Aruba ClearPass $9,995 base 25k license block + $15/endpoint/yr ($1.25/mo) min 100, overage guest auth $0.05/auth after 100k/mo
Endpoint Configuration Management & Drift Detection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAnsible/Chef OSS Free unlimited nodes self-hosted; Puppet Free 10 nodes, Enterprise $35/node/yr ($2.92/mo) min 100 $3.5k/yr; Intune DSC free with Intune $8/user/mo, autopilot free; Tanium Enforce $6/device/mo ($72/yr) min 1000 $72k/yr requires Tanium Core $10/device/mo, overage drift remediation $0.50/drift over 10k/mo
Privileged Access Management for Endpoints (PAM / Least Privilege)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsWindows LAPS Free unlimited with AD/Entra; Delinea Cloud Privilege Manager $32/user/yr ($2.67/mo) + $40/endpoint/yr ($3.33/mo) min 100 endpoints $4k/yr, free trial 30 days; CyberArk EPM $45/device/mo ($540/yr) min 100 + $5k setup fee + $99/mo SaaS base; BeyondTrust PM $55/endpoint/yr ($4.58/mo) min 250 $13,750/yr + platform $10k/yr, overage session recording $0.50/GB
OS Hardening & CIS Benchmark Enforcement Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenSCAP/LYNIS Free OSS unlimited; CIS-CAT Lite free 1 scan/month non-commercial, Pro $2,500/yr org up to 500 endpoints ($208/mo) $5/endpoint at scale, CIS Build Kits $600 each; ManageEngine VMP $7/device/yr ($0.58/mo) min 100 $700/yr; Tanium Comply $6/device/mo ($72/yr) plus Tanium Core $10/device/mo $16/device/mo combo $192/yr min 1000 $192k/yr, overage benchmark packs $100/pack/yr
Endpoint Deception / Honeypot & Decoy Technology
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenCanary/CanaryTokens Free unlimited self-hosted tokens; Thinkst Canary Personal free 1 Canary, Business $7,500/yr for 10 Canaries ($62.50/Canary/mo), 50 Canaries $18,000/yr; SentinelOne Hologram $15/endpoint/mo ($180/yr) 50 min $9k/yr needs Singularity base; CrowdStrike Deception $20/endpoint/mo ($240/yr) add-on requires Falcon Pro, decoy VM $100/decoy/mo over 10 included
Endpoint BIOS / Firmware Security & Attestation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCHIPSEC/fwupd/LVFS Free OSS unlimited firmware scans; HP Wolf Pro Security $36/device/yr ($3/mo) includes firmware assurance; Eclypsium $3.50/device/mo ($42/yr) min 500 as earlier, Enterprise $5/device/mo; Absolute $4.50/device/mo ($54/yr) persistence + firmware attestation min 500 $27k/yr, overage firmware recovery $10/device per event, free trial 50 devices
Endpoint Threat Hunting Platform & Query Language
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor + Osquery + Sigma Free unlimited hunts self-hosted; Elastic Security $95/mo per 1GB/day ingest + $35/endpoint/mo Defend included, hunting free with Kibana; CrowdStrike Falcon OverWatch managed hunting included in Complete $184.99/device/mo stand, Threat Hunting API $45/device/mo add-on, overage query $0.10 per 10k events; Cortex XDR Pro $75/endpoint/mo ($900/yr), overage XQL $0.50 per 100 queries over 10k/mo
Endpoint Data Classification & Tagging (for DLP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenDLP Discovery Free self-hosted limited classifiers; Microsoft Purview Information Protection included in M365 E5 $57/user/mo or E5 Information Protection add-on $5/user/mo, auto-labeling $2/user/mo extra, 100GB label storage free; Spirion $2.75/endpoint/mo ($33/yr) min 200 $6,600/yr; Symantec ICT + DLP $9/user/mo ($108/yr) min 100 + $20k platform fee, overage classification scans $0.03/GB over 1TB
Endpoint Incident Ticketing & ITSM Integration
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsWazuh/TheHive/GLPI/osTicket Free unlimited self-hosted tickets; Jira Service Management Free up to 3 agents unlimited tickets, Standard $20/agent/mo ($240/yr) min 5, Premium $35/agent/mo; ServiceNow SecOps $180/user/mo ($2,160/yr) min 20 users $43k/yr plus platform $40k/yr, custom integration $5k setup, overage automation runs $0.50/run over 10k/mo
Endpoint Behavioral Analytics (UEBA) & Anomaly Detection
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsWazuh UEBA/Apache Spot Free self-hosted unlimited events; Exabeam Fusion $30,000/yr for 500 users ($5/user/mo) 90-day retention, Essentials $15k/yr 200 users; Microsoft Sentinel UEBA free with Sentinel $2.68/GB ingest, Defender UEBA included with E5; Splunk UBA $15k/yr base + $3/device/mo ($36/yr) min 500 devices $18k/yr + Splunk Cloud ingest $135/GB/mo, free trial 30 days
Endpoint Security Orchestration / SOAR Agent & Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShuffle SOAR Community Free self-hosted unlimited playbooks 1,000 runs/mo, Cloud $500/mo 10k runs; Tines Free Community 100k events/mo, Story $600/mo 250k events; Cortex XSOAR Community free 2 users 1 month trial then $40k/yr Starter + $8k/yr per analyst; Splunk SOAR $45k/yr base Cloud $75k/yr, Falcon Fusion workflow automation included in Falcon Complete $184.99/device/mo, standalone Fusion $25/device/mo ($300/yr), overage automation minutes $0.10/min over 10k
How this enterprise endpoint security checklist works.
Each requirement below is something a enterprise endpoint security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.