Comparisec
Submit reviewFor vendors
EDR / XDRCybereason Defense Platform
AdequateAdequateStrongAdequate
4.2

VendorsEDR / XDRCybereason Defense Platform

Cybereason Defense Platform logo

Cybereason Defense Platform

Cybereason

Founded 2012·US·Private
4.2

Combined score

G2
4.2140
Gartner
4.3180

Security incident on recordFinancial difficulties reported 2024 — evaluate vendor stability before purchase

Editorial verdict

Cybereason's MalOp detection model, which groups related security events into attack story arcs rather than individual alerts, is a genuinely innovative approach that reduces analyst investigation time meaningfully. The platform has strong lateral movement detection and the visualisation of attack chains is among the best in the category.

The concern is organisational rather than technical. Cybereason faced significant financial difficulties in 2024, including layoffs and restructuring. G2 and Gartner reviews from 2024 and 2025 reflect reduced support quality and customer uncertainty. Buyers should research the current financial and ownership status before committing.

The verdict: Cybereason's MalOp technology is genuinely valuable but the vendor's financial trajectory makes it difficult to recommend for new deployments without specific assurance of stability. Organisations already deployed should monitor closely and have a migration path ready.

Last reviewed: May 2026

G2

4.2140 reviews

Gartner

4.3180 reviews

PeerSpot

7.880 reviews
Gartner MQ: Challenger

EDR / XDR assessment

PROTECTIONAdequate
Endpoint detection
4 / 5

Operation-centric detection — MalOp visualisation groups related alerts into coherent attack stories. Scored 4 because detection quality is strong but financial difficulties (2024) create uncertainty about ongoing investment in detection engineering.

Sources: G2 reviews, Gartner Peer Insights, financial reports 2024

Extended XDR coverage
3 / 5

Scored 3 because XDR capabilities extend to some cross-domain telemetry but breadth is less than enterprise XDR platforms.

Sources: Cybereason documentation

OPERATIONSAdequate
Automated response
3 / 5

Scored 3 because automated response capabilities are present but less documented and less mature than CrowdStrike or SentinelOne.

Sources: Cybereason documentation, G2 reviews

Deployment & management
3 / 5

Scored 3 because deployment and management complexity is at category average. Financial difficulties create risk of reduced investment in tooling.

Sources: G2 reviews, analyst reports

ANALYTICSStrong
Threat hunting UX
4 / 5

MalOp visualisation makes complex attack stories understandable — a genuine UX differentiator. Scored 4 because this operational-centric view aids analyst productivity for investigations.

Sources: G2 reviews, Cybereason MalOp documentation

TRUST & ECOSYSTEMAdequate
Ecosystem integrations
3 / 5

Scored 3 because integration ecosystem is narrower than enterprise EDR leaders and development pace has slowed given financial challenges.

Sources: Cybereason integration documentation, G2 reviews

Strongest: Endpoint detection

Watch out for: Ecosystem integrations

Strengths & limitations

Strengths

Operation-centric detection — groups alerts into attack stories
Strong lateral movement and adversary hunting
MalOp visualisation makes complex attacks understandable

Watch out for

Financial difficulties reported 2024 — company viability concern
Smaller market presence than top-tier vendors
Slower product innovation pace

Best for

SOC analysts preferring operation-centric attack visualisation — evaluate company financial stability carefully before committing.

Not suitable for: Buyers needing long-term vendor stability — financial difficulties 2024

Compliance coverage

SOC 2
HIPAA
NIST CSF
PCI-DSS
GDPR
ISO 27001
Essential Eight
AU Privacy Act
CMMC
NIS2
DORA
CIS Benchmarks

Switching intelligence

Switching from

Common migration paths based on review data

  • Traditional AV
  • Carbon Black

Also considering

Vendors typically shortlisted alongside

← Back to EDR / XDRCompare with other EDR / XDR vendors →

Quick facts

Pricing modelper endpoint/year
Pricing range$50-$100/endpoint/year est.
Free trialNo
Min seats50
Deployment time1-2 weeks
Complexity3 / 5
Pricing transparency2 / 5
AU presenceNo
IRAP assessedNo
Open sourceProprietary

Deployment

ModelsSaaS, On-premises
OS supportWindows, macOS, Linux
CloudAWS, Azure
SupportPhone, Email, Dedicated CSM
Data residencyUS, EU

Company

Cybereason

Founded 2012 · 500-800 employees · Private

HQ: US

$100M+ ARR est. (financial difficulties reported 2024)

Certifications

SOC 2 Type II, ISO 27001

Integrations

SplunkServiceNowOktaAzure ADPalo AltoFortinet