Choosing endpoint protection with recovery in mind

If your priority is surviving an attack that gets past the front door, three product capabilities matter more than the headline detection rate: seeing what happened, rolling back damage on a device, and having someone watching around the clock. This page compares 17 tracked products on exactly those.

Last reviewed 10 October 2026.

What each capability does for recovery

Endpoint detection and response (EDR) records what happens on a computer, so that after an incident you can tell which machines were touched and what the attacker did. The CISA guide names EDR, alongside application allowlisting, as a way to make sure only authorised software runs, and it lists reviewing EDR and antivirus logs as part of the response. Without that record, you are guessing.

Ransomware rollback reverses file changes on an endpoint when a protection product detects an encryption attack in progress. It is a safety net for individual devices, not a replacement for backups, and it generally depends on the protection agent still running when the attack begins.

24/7 managed response means a vendor team watches alerts and takes action outside office hours. Attackers frequently strike in the early hours or at weekends, and a small office is usually asleep at the time. If you cannot staff a night shift, this is the capability that fills the gap, usually as a service called managed detection and response.

What the data shows

Of the 17 products in the Endpoint Index set, 13 include ransomware rollback, 8 include EDR and 3 include 24/7 managed response. Only 6 combine rollback and EDR in the plan the database tracks. The products with rollback are Bitdefender GravityZone Business Security, ESET PROTECT Core, Bitdefender GravityZone Business Security Premium, Acronis Cyber Protect, Webroot Business Endpoint Protection, ThreatDown Elite, ThreatDown Advanced, Sophos Endpoint, SentinelOne Singularity Control, Cynet, SentinelOne Singularity Complete, WatchGuard Endpoint Security 360 and Trend Micro Worry-Free Services Advanced. That is a pattern worth knowing: the capabilities are scattered across the market, and a buyer who wants all three has to read the plan details, not the product family name.

The table below lists each product's SMB Fit Score from Endpoint Index, the three capabilities, whether you can buy online without talking to sales, and the minimum number of seats. Scores come from a published formula that weighs independent lab results, price transparency, ease of use for small teams and feature coverage, so a product can score low simply because it has little public lab evidence. Read the score as one input, not a verdict.

How to read the table for your own situation

Start with whether you have anyone who can respond at night. If you do not, the "24/7 managed" column is the first filter. Next, check the minimum seats: some managed offerings have a minimum purchase that rules out the smallest offices when bought directly, though an IT provider may be able to supply them differently. The table shows the vendor's standard direct minimum, so ask your provider before you rule a product out.

Then look at rollback. If your staff work mainly on a few laptops with a lot of local files, rollback is more valuable than if everything lives in a cloud drive with its own version history. And finally, look at device control, which limits what can be plugged in. It matters because removable drives are a way for malware to cross from one machine to another, and the NCSC advises disconnecting backup drives for the same reason.

One caution on the "included" label. It means the feature is part of the plan Endpoint Index tracked. Some vendors sell tiers, and the next tier up may add the feature. Always confirm against the exact plan on your quote. The Endpoint Index list of EDR options for small business is a useful place to compare, and each product page links to the vendor's own source.

Where lab testing fits in

This page is about recovery features, which labs mostly do not measure. Independent labs such as AV-TEST and AV-Comparatives test how well products block malware and how often they raise false alarms, which is a different question from what happens after a miss. Use lab results to shortlist, then use the table here to see whether a shortlisted product helps you recover. A product with excellent protection scores and no detection or response capability may leave you blind after an incident; a product with strong response features and little public lab evidence leaves you relying on the vendor's word for the blocking side. Neither is automatically the right pick. The point is to know which trade-off you are making, and to write it down so the next person understands the choice.

Questions for any vendor

1. Does rollback work offline, and what happens if the agent is disabled by the attacker?
2. Who responds to an alert at 3 a.m., and what are they allowed to do without calling me?
3. Can I export logs and keep them for as long as the CISA guide suggests, a year where possible?
4. Does your product protect the backup agent and my backup data from tampering?
5. What is the exact plan on this quote, and which features are add-ons?

None of these questions require technical expertise, and a vendor that struggles to answer them in writing is telling you something.

How we compiled this page

Methodology: every cell in the table was copied from a product record in the Endpoint Index dataset, where each capability is marked included, add-on or absent, with a source and a check date of 2 October 2026. Nothing else was mixed in. For what the capabilities are for, we leaned on CISA's ransomware guide (EDR and allowlisting) and the NCSC's device guidance (updates and isolation). Product plans change, so read this as a snapshot and confirm the plan on your quote.

Previous: Reporting