The five vendors a Chicago-area small or mid-market business will realistically be choosing among are SentinelOne, CrowdStrike Falcon, Microsoft Defender for Endpoint, Sophos Intercept X, and Huntress. Four of those are endpoint detection and response platforms you can buy head to head. Huntress is different, and worth understanding as a managed detection layer that runs its own agent and a 24/7 security operations center, often alongside Microsoft Defender Antivirus rather than in place of a full EDR platform.
The choice matters less than one question underneath it: who looks at the alert at two in the morning. A deployed EDR with nobody watching it is a log file.
RJ2 Technologies partners with SentinelOne and Huntress, among others, and runs an EDR product backed by a 24/7 security operations center. We are telling you that up front so you can weigh the rest of this accordingly. The other platforms on this list are good products, and each of them is the right answer for some companies.
What is EDR, and how is it different from antivirus?
Traditional antivirus matches files against known-bad signatures. EDR watches process behavior, records what happened in a timeline, and can isolate a machine from the network and roll back changes after the fact. The practical difference is that antivirus answers “was this file bad” and EDR answers “what did this process do, what did it touch, and what else on the network is now involved.”
That second question is what a cyber insurance carrier and a client security questionnaire are actually asking about. Insurance applications increasingly ask two separate questions: is EDR deployed on all endpoints, and is it monitored 24/7. Those are different answers and companies routinely conflate them.
How do the major EDR vendors actually compare?
SentinelOne Singularity. The agent makes its own decisions on the endpoint using static and behavioral models, which means it still protects a laptop that is offline or off the corporate network. Its Storyline feature auto-correlates related process activity into a single incident, which cuts triage time meaningfully. Its rollback feature can revert ransomware encryption, and the honest caveat is that rollback depends on Windows Volume Shadow Copy Service, so it is a Windows capability, it is not a backup, and it fails when the shadow copies are gone. Sold in tiers, with Vigilance as the add-on managed response service. Strong fit for mixed environments with laptops that leave the building.
CrowdStrike Falcon. Widely regarded as the strongest threat intelligence and threat hunting in the category, with the OverWatch team and Falcon Complete as the fully managed tier. The sensor is genuinely light. The tradeoff is that Falcon leans on cloud analytics, so the richest detection depends on connectivity, and the low tiers meant for small business come with short telemetry retention. It is also worth acknowledging plainly that on July 19, 2024 a faulty Falcon content update crashed roughly 8.5 million Windows machines worldwide. That is a real event, it was handled and remediated, and it is a reason to ask any vendor how staged rollout of content updates works now. It is not a reason to write off a strong product.
Microsoft Defender for Endpoint. The one most companies already own and do not use. Defender for Business is included with Microsoft 365 Business Premium, capped at 300 users, and covers next-generation protection, EDR, automated investigation and vulnerability management. Defender for Endpoint Plan 2, which comes with E5 or the E5 Security add-on, adds deeper hunting across raw telemetry, threat analytics and tighter integration with the rest of the Microsoft stack. Feature boundaries between those two have moved more than once, so confirm current terms with your licensing partner rather than trusting a blog post, including this one. Defender’s real weakness is not detection quality, which is strong. It is that it ships unconfigured, nobody tunes it, and there is no SOC behind it unless you buy or hire one.
Sophos Intercept X. Good ransomware behavior detection with CryptoGuard, file rollback, and a single console in Sophos Central. Its best argument is if you already run Sophos XGS firewalls, because Security Heartbeat lets a compromised endpoint get isolated by the firewall automatically. Sophos MDR is a mature managed service and, unlike some, it will manage telemetry from third-party tools too. If your network gear is Sophos, this deserves a serious look. If it is not, the integration argument mostly disappears.
Huntress. Not a like-for-like competitor to the four above, and pretending it is does everyone a disservice. Huntress runs a lightweight agent focused on persistence mechanisms, footholds and post-exploitation behavior, backs it with a 24/7 human SOC, and in many deployments manages Microsoft Defender Antivirus policy underneath rather than replacing the prevention engine. It has since added identity threat detection for Microsoft 365, security awareness training and a SIEM product. Its value is the SOC and the low false-positive discipline, not the raw feature matrix. It is commonly layered on top of another endpoint product, which is exactly how it should be evaluated.
Worth knowing exist, and sometimes the right call: Bitdefender GravityZone, ESET, Trend Micro Vision One, Palo Alto Cortex XDR for larger environments, and Blackpoint Cyber or Arctic Wolf on the managed detection side.
What should actually drive the decision?
Six questions, in rough order of how much they matter.
- Who responds, and how fast? In-house SOC, vendor MDR, or your MSP. Get the response commitment in writing. “24/7 monitoring” with no defined action means someone will see it eventually.
- How long is telemetry retained, in days? This is the number people skip and regret. Retention on entry tiers commonly runs 7 to 30 days, and after an incident that is the difference between reconstructing what happened and guessing. Ask for the number, then ask what extending it costs.
- Does it protect offline? Matters for a sales team that lives on airplanes and Metra, less for a company where everyone is on the same LAN.
- What runs on your Macs, your Linux servers, and your virtual desktops? Coverage is uneven across vendors and the gap is always found after purchase.
- What is the licensing minimum? Some enterprise-tier products have seat minimums that quietly rule them out at 40 users.
- Does rollback do what you think? Rollback is a Windows feature for most vendors, it depends on shadow copies, and it is not a substitute for tested, immutable backups.
Where each one is the wrong pick
Being even-handed means saying this part out loud.
- SentinelOne is the wrong pick if you need rollback on macOS or Linux and are counting on it, or if nobody is going to tune the policies.
- CrowdStrike is the wrong pick at the low end if you buy an entry tier for the brand name and get a retention window too short to investigate with.
- Microsoft Defender is the wrong pick if you are buying it to save money and have no plan for who configures it and who watches it. It is the right pick surprisingly often when you do.
- Sophos is the wrong pick if your firewalls are Fortinet or Cisco, because you paid for integration you cannot use.
- Huntress is the wrong pick as your only endpoint control if you also need full prevention policy management, device control and a deep hunting console.
What does this look like for a small or mid-market business in the Chicago area?
The two common shapes in the Chicago suburbs look like this.
A 120-person manufacturer in the northwest suburbs has 90 office endpoints, a handful of servers, and shop floor machines running embedded Windows versions that will not take a modern agent and cannot be touched without voiding an equipment support contract. Those machines get network segmentation and monitoring instead of an agent, and that decision gets documented. The office fleet gets EDR with a managed response commitment, because there is one internal IT person and he is not awake at 2am. Nobody is.
A 45-person accounting or law firm in downtown Chicago has all laptops, no servers, everything in Microsoft 365, and the pressure is a client security questionnaire or an insurance renewal. That firm frequently already owns Defender for Business inside Business Premium, has never configured it, and is being quoted a second product. Sometimes the right advice is to turn on and tune what they already bought, then add a managed detection layer on top of it. That advice is worth less revenue and it is still the right advice.
The pattern under both: the tool matters less than the operating discipline around it. Agent coverage verified against the actual asset inventory rather than assumed. Alerts routed to a human with authority to isolate a machine. An isolation action that someone has actually practiced.
RJ2 Technologies has run IT and security for Chicago-area businesses from the northwest suburbs since 1998, and is headquartered in Deer Park, Illinois. More on how endpoint protection sits inside the wider program is on our cyber security services page, and the vertical-specific requirements, including what manufacturers and professional services firms get asked to prove, are in Cybersecurity for Regulated Industries.
FAQ
What is the difference between EDR and antivirus?
Antivirus matches files against known-bad signatures. EDR watches process behavior, keeps a timeline of what happened, and can isolate an endpoint and roll back changes. EDR answers what a process did, not just whether a file was known to be bad.
Which EDR vendor is best for a small business?
There is no single best. If you already own Microsoft 365 Business Premium you already own Defender for Business, and configuring it well often beats buying a second product badly. If you need strong offline protection and rollback, SentinelOne is a common pick. If your firewalls are Sophos, Intercept X gets you automatic isolation. The deciding factor is usually who monitors it, not which engine detects better.
Is Huntress an EDR, or something else?
Huntress runs its own agent and a 24/7 security operations center, and in many deployments it manages Microsoft Defender Antivirus underneath rather than replacing the prevention engine. Treat it as a managed detection layer, most often deployed alongside another endpoint product rather than instead of one.
Does cyber insurance require EDR?
Most carriers now ask whether EDR is deployed across all endpoints and whether it is monitored around the clock, as two separate questions. Deployed and monitored are different answers, and answering the second one incorrectly on an application is a problem you do not want at claim time.
Can EDR undo a ransomware attack?
Partially, on Windows, sometimes. Rollback features in SentinelOne and Sophos can revert encrypted files using Volume Shadow Copy Service, which works when the attacker has not deleted the shadow copies, and often they have. Rollback is a useful backstop. It is not a backup and it should never be your recovery plan.
What does EDR cost per endpoint?
It varies widely by tier, seat count, contract length and whether managed response is included, and any published per-seat number is close to meaningless without knowing retention, coverage and response commitments. Ask any vendor or MSP to quote the retention window in days and the response commitment in writing alongside the price.