The economics win the argument, the tuning takes the year
3.8/5overall, average of the five axes
Deployment effort3
Support quality3
Features vs promises4
Pricing transparency5
Return on investment4
What happened
If you are already on E5 the marginal cost is close to zero and that ends most procurement debates before they start. What the licensing conversation does not tell you is the tuning effort: out of the box we had a noisy alert queue for months, and getting to a signal we trusted took a dedicated engineer and a lot of custom detection rules. It is now our primary EDR and I would not swap it, but nobody should treat it as free.
Worked well
Bundled economics are hard to argue with. Deep Windows integration. Defender XDR correlation across identity and email is genuinely useful.
Did not
Alert tuning is a project, not a task. Non-Windows coverage is weaker. Portal changes name and layout more often than my team would like.
4 found this helpful