KAE5-74 Source: Frost & Sullivan

Frost Radar : Endpoint Security, 2025

A Benchmarking System to Spark Companies to Action - Innovation That Fuels New Deal Flow and Growth Pipelines

KAE5-74 April 2025

© 2025 Frost & Sullivan. All rights reserved. This document contains highly confidential information and is the sole property of Frost & Sullivan. No part of it may be circulated, quoted, copied, or otherwise reproduced without the written approval of Frost & Sullivan.

Authored by: Ozgun Pelit Contributor: Jarad Carleton

KAE5-74 Source: Frost & Sullivan

Strategic Imperative

• The average organization manages thousands of endpoints that have access to its corporate network. These endpoints are the most vulnerable and exploited part of any network.

• Endpoint security includes host-based software products that secure computing devices, such as laptops, desktops, tablets, servers, and smartphones, from malware, cyberattacks, and unwanted applications. Internet of things devices are endpoints that also require securing.

• Endpoint security consists of an endpoint protection platform (EPP) and endpoint detection and response (EDR). EPP is a software suite that includes antivirus, intrusion prevention, anti-malware, and other features; EDR is an advanced tool that detects threats, contains the incident, investigates with forensic and proactive hunting tools, and provides immediate response and remediation. Modern endpoint security combines EPP and EDR functions for superior performance.

• With limited resources to investigate detection alerts, organizations are more inclined to focus on protection, attack surface reduction, and identifying misconfiguration. Proprietary rollback capabilities of ransomware detection and response solutions will reduce the risk of ransomware attacks.

• Detection, auto-investigation, and setting and updating of security policies using AI is paramount for organizations facing resource challenges. AI offers the potential to substantially reduce the time to containment. Vendors are greatly improving threat detection capabilities by scanning exponentially more alerts using AI. In addition, generative AI offers multilingual communication and interface.

• To reduce overhead, technologies that enable scaling of effective policy management are paramount. This includes machine learning capabilities and automation to scale policy management across tens of thousands of nodes across hybrid and multicloud environments. To enable security teams to effectively manage device access policies, firewalls, and controls, vendors offer one centralized and integrated platform.

Frost Radar : Endpoint Security, 20252

KAE5-74 Source: Frost & Sullivan

Growth Environment

Frost Radar : Endpoint Security, 20253

• In 2024, enterprise spending on endpoint security solutions was projected to exceed $12.9 billion globally. Frost & Sullivan projects spending to reach $22.3 billion by 2028, achieving a compound annual growth rate of 14.7%.

• Digital transformation, remote working, internet of things devices, and bring-your-own-device (BYOD) practices are all factors driving the need for endpoint protection solutions and more extensive use of cloud-hosted consoles. BYOD requires regulation: each new device creates a potential threat to overall endpoint security, making it vital to register all devices on the network. Organizations can then regulate consistent endpoint security across all connected devices and maintain necessary security updates and patches.

• While enterprises experience a qualified cybersecurity staff shortage and reduced budgets, they face more sophisticated and multivectored attacks. Effective endpoint security reduces business risk and allows an organization to grow. Vendors providing automated tools, including unified management and integrated platforms, assist organizations with limited cybersecurity personnel.

• AI is an emerging technology that is enabling attackers to deploy more dangerous attacks. Security vendors can also leverage the technology to combat the influx in attacks. Organizations increasingly leverage ML and AI, including generative AI, to strengthen their security posture and reduce administrative overhead owing to a lack of security expertise to keep up with the fast-evolving security threats.

KAE5-74 Source: Frost & Sullivan

Growth Environment (continued)

Frost Radar : Endpoint Security, 20254

• While many vendors already utilize AI technology in their products to a certain extent, widespread integration remains a work in progress. The symbiotic benefits of AI and cybersecurity go beyond just natural language processing (NLP) and generative AI, offering a broader scope, such as data contextualization, automated workflows, dynamic threat visualizations, and custom reports.

• An increase in connected devices creates a need for user and asset management features, taking into consideration device and account type and operating system in the business environment. Security solutions must constantly adapt to keep up.

• The restraint on market growth is vendors not investing to meet customers' performance and scalability needs. Vulnerabilities increase with the number of applications on each device. Various applications could be noncompliant with an organization’s security policies and are missing or have outdated OS patches. Endpoint security vendors must constantly push automatic updates and patches to organizational devices, which is difficult with the increase in zero-day attacks.

KAE5-74 Source: Frost & Sullivan

Frost Radar : Endpoint Security

Frost Radar : Endpoint Security, 20255

KAE5-74 Source: Frost & Sullivan

Frost Radar Competitive Environment

Frost Radar : Endpoint Security, 20256

• Endpoint security is a saturated, mature, highly competitive, and crowded market with more than 40 vendors competing. Established endpoint security vendors continue to dominate the market and compete for a larger market share.

• In 2024, the top 5 vendors had a cumulative market share of 52%, up from 46.8% for 2023’s estimation and reversing a declining trend observed in the market since 2019. Microsoft, CrowdStrike, and Trellix lead the endpoint market by revenue.

• SentinelOne has grown rapidly in the last few years and leads on the Frost RadarTM Growth and Innovation Indexes. The vendor's Singularity platform aims to help customers consolidate multiple security functions. This includes endpoint protection, EDR, network discovery, advanced incident response tools, vulnerability management, cloud workload security, and identity security.

• CrowdStrike is a leader on the Frost RadarTM Growth Index and a strong performer on the Innovation Index, with its above-industry-average growth rate and one of the largest market shares in endpoint security.

• Microsoft leads the endpoint security market with an estimated 16.5% share of global revenues. Microsoft’s Windows OS has versions for small, medium, and large enterprises, each with built-in endpoint security—Microsoft Defender for Endpoint.

• Sophos, Trellix, and Check Point are strong performers, leveraging their broad security portfolios to generate multiple revenue streams and consolidated platform approaches.

• Acronis and ESET are well established in the SMB segment and pull most of their endpoint revenue from there.

KAE5-74 Source: Frost & Sullivan

Frost Radar : Companies to Action

Frost Radar : Endpoint Security, 20257

KAE5-74 Source: Frost & Sullivan

INNOVATION

Check Point

• Check Point’s Harmony suite covers all aspects of endpoint security, reducing complexity. The consolidated platform includes capabilities that differentiate the vendor, such as access control with VPN, sandboxing and CDR, browser security, GenAI security, and zero-day phishing protection.

• Building on its consolidation approach and broader Check Point portfolio, with more than 60 AI engines, the vendor’s ThreatCloud AI correlates all endpoint data with data telemetry from other solutions it offers. As part of this, Check Point’s Co-Pilot AI is integrated into the management portal, providing security operation suggestions, troubleshooting, and reducing admin workloads.

• Check Point’s newly introduced, browser-based DLP capabilities allow customers to block sensitive data sharing when using GenAI tools with granular control options.

Frost Radar : Endpoint Security, 20258

KAE5-74 Source: Frost & Sullivan

GROWTH

Check Point (continued)

• Complemented by the acquisition of SSE provider Perimeter 81, Check Point is fully integrating its SASE solution with its endpoint security offering. Supporting its consolidation and platform approach, the strategy will enable customers to streamline capabilities around zero phishing, password reuse, ZTNA, and SaaS security, significantly enhancing Check Point’s growth pipeline.

• Check Point follows a targeted and mixed growth strategy that consists of cross-selling and upselling to existing customers, organizations in regulated industries, large enterprises, and MSSPs. Harmony Endpoint and XDR/XPR are primarily aimed at medium-sized organizations and large enterprises, with a focus on those transitioning to hybrid work models.

Frost Radar : Endpoint Security, 20259

KAE5-74 Source: Frost & Sullivan

FROST PERSPECTIVE

Check Point (continued)

• A large majority of Check Point’s customers are large enterprises with 2,500 or more employees. It cross-sells endpoint security to its base of network security customers.

• As with all endpoint security vendors, Check Point manages key relationships with its channel partners and MSSPs. The vendor’s recent MSSP portal will address the financial and operational challenges of this important segment, boosting growth and customer satisfaction.

Frost Radar : Endpoint Security, 202510

KAE5-74 Source: Frost & Sullivan

Best Practices & Growth Opportunities

Frost Radar : Endpoint Security, 202511

KAE5-74 Source: Frost & Sullivan

Best Practices

Frost Radar : Endpoint Security, 202512

Streamlined processes, consolidation, and automation of common analyst workflows are improving the mean time to investigate. Best practices include solutions that go beyond EPP/EDR into XDR with capabilities to integrate SOC experience with unified alert management and unified asset inventory.

1 Automated response and rollback capabilities against ransomware attacks are a key functionality that vendors offer. These capabilities allow organizations to quickly recover from ransomware attacks by restoring systems to a preinfected state without manual intervention. This process typically involves backing up data and system configurations, enabling a seamless restoration of affected systems. By automating the rollback, businesses can minimize downtime and reduce ransomware’s impact on operations.

2 Many organizations struggle to keep pace with the complexity of cyber threats and require highly skilled security analysts to detect attacks and trace how adversaries gained access. For a comprehensive view on threat hunting and investigations, analyzing telemetry from various security layers, including endpoint, network, email, and identity security, on an ongoing basis is crucial.

3

KAE5-74 Source: Frost & Sullivan

Growth Opportunities

Frost Radar : Endpoint Security, 202513

While AI has introduced new risks and challenges, endpoint security vendors can leverage AI technology using enhanced detection capabilities and automated responses to combat cyber criminals. It is important for customers to choose a security vendor with differentiating AI capabilities, but to be cautious of those that are grandiose about their capabilities.

1 Implementing an effective MTD strategy that complements endpoint security is essential for organizations of all sizes. If implementation is not done correctly, an organization could experience a catastrophic cybersecurity incident that would harm customer experience, operations, and revenue.

2 A defensive plan including prevention technology and a response method for a potential attack is an effective strategy for detecting and mitigating zero-day attacks. Organizations must prepare for attacks because vulnerabilities are present in every environment. Worst-case scenario preparedness allows security teams to mitigate a security event if an attack penetrates a network.

3

KAE5-74 Source: Frost & Sullivan

Frost Radar Analytics

Frost Radar : Endpoint Security, 202514

KAE5-74 Source: Frost & Sullivan

Frost RadarTM: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform

Frost Radar : Endpoint Security, 202515

Growth Index

Growth Index (GI) is a measure of a company’s growth performance and track record, along with its ability to develop and execute a fully aligned growth strategy and vision; a robust growth pipeline system; and effective market, competitor, and end-user focused sales and marketing strategies.

GI1

GI2

GI3

GI4

GI5

MARKET SHARE (PREVIOUS 3 YEARS) This is a comparison of a company’s market share relative to its competitors in a given market space for the previous 3 years.

SALES AND MARKETING This is a measure of the effectiveness of a company’s sales and marketing efforts in helping it drive demand and achieve its growth objectives.

VISION AND STRATEGY This is an assessment of how well a company’s growth strategy is aligned with its vision. Are the investments that a company is making in new products and markets consistent with the stated vision?

GROWTH PIPELINETM This is an evaluation of the strength and leverage of a company’s growth pipeline system to continuously capture, analyze, and prioritize its universe of growth opportunities.

REVENUE GROWTH (PREVIOUS 3 YEARS) This is a look at a compan s revenue growth rate for the previous 3 years in the market/industry/category that forms the context for the given Frost RadarTM.

KAE5-74 Source: Frost & Sullivan

Frost RadarTM: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform (continued)

Frost Radar : Endpoint Security, 202516

Innovation Index

Innovation Index (II) is a measure of a company’s ability to develop products/ services/ solutions (with a clear understanding of disruptive megatrends) that are globally applicable, are able to evolve and expand to serve multiple markets and are aligned to customers’ changing needs.

II1

II2

II3

II4

II5

INNOVATION SCALABILITY This determines whether an organization’s innovations are globally scalable and applicable in both developing and mature markets, and also in adjacent and non- adjacent industry verticals.

CUSTOMER ALIGNMENT This evaluates the applicability of a company’s products/services/solutions to current and potential customers, as well as how its innovation strategy is influenced by evolving customer needs.

MEGATRENDS LEVERAGE This is an assessment of a company’s proactive leverage of evolving, long-term opportunities and new business models, as the foundation of its innovation pipeline. An explanation of megatrends can be found here.

PRODUCT PORTFOLIO This is a measure of a company’s product portfolio, focusing on the relative contribution of new products to its annual revenue.

RESEARCH AND DEVELOPMENT This is a measure of the efficacy of a company’s R&D strategy, as determined by the size of its R&D investment and how it feeds the innovation pipeline.

https://protect.checkpoint.com/v2/___https://ww2.frost.com/research/visionary-innovation/___.YzJlOmNwYWxsOmM6bzo1NDQzMDZkZTU3MDRkZWQ5MTBiZDY0Yzg4N2RlZmI0ZDo2OmM0YTQ6MTM2NDA4MWY3YTFmMzU3OGE5NTNjYTMxOTQ4YWQ3YTM0MmVhMjI3NGU3YWZjMzE3NTcyMjdlNjc5ODdkMjU4NTpwOlQ6Tg

KAE5-74 Source: Frost & Sullivan

Legal Disclaimer

Frost & Sullivan is not responsible for any incorrect information supplied by companies or users. Quantitative market information is based primarily on interviews and therefore is subject to fluctuation. Frost & Sullivan research services are limited publications containing valuable market information provided to a select group of customers. Customers acknowledge, when ordering or downloading, that Frost & Sullivan research services are for internal use and not for general publication or disclosure to third parties. No part of this research service may be given, lent, resold, or disclosed to noncustomers without written permission. Furthermore, no part may be reproduced, stored in a retrieval system, or transmitted in any form or by any means—electronic, mechanical, photocopying, recording, or otherwise—without the permission of the publisher.

For information regarding permission, write to: permission@frost.com

Frost Radar : Endpoint Security, 2025

© 2025 Frost & Sullivan. All rights reserved. This document contains highly confidential information and is the sole property of Frost & Sullivan. No part of it may be circulated, quoted, copied, or otherwise reproduced without the written approval of Frost & Sullivan.

17

Slide 1: Frost Radar™: Endpoint Security, 2025 Slide 2: Strategic Imperative Slide 3: Growth Environment Slide 4: Growth Environment (continued) Slide 5: Frost Radar™: Endpoint Security Slide 6: Frost Radar™ Competitive Environment Slide 7: Frost Radar™: Companies to Action Slide 8: Check Point Slide 9: Check Point (continued) Slide 10: Check Point (continued) Slide 11: Best Practices & Growth Opportunities Slide 12: Best Practices Slide 13: Growth Opportunities Slide 14: Frost Radar™ Analytics Slide 15: Frost RadarTM: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform Slide 16: Frost RadarTM: Benchmarking Future Growth Potential 2 Major Indices, 10 Analytical Ingredients, 1 Platform (continued) Slide 17: Legal Disclaimer