5 ms·
Windows has Defender built in and most of those companies are presumably already using an SCCM like Software Center. If they upgrade from ancient versions of So
by WorldMaker 2y ago
Windows has Defender built in and most of those companies are presumably already using an SCCM like Software Center. If they upgrade from ancient versions of Software Center (because let's be honest if they are using CrowdStrike they are probably behind the times) to more recent versions of Intune it includes most of the exact same "fleet configuration" and "fleet anti-virus" tools (including ransomware prevention/quarantine) that CrowdStrike ever provided, only this time with stuff the Fortune 100 companies are likely already paying Microsoft for. They are trading one vendor for another, but the new vendor actually owns the Operating System and has a lot more reasons not to break it with bad update deployments.
It's not like Microsoft has spent the last few decades entirely ignoring these large scale infrastructure needs, they've just been competing with these bloatware vendors like CrowdStrike with significant marketing arms and incredible sunk cost inertia. (Given most of these companies already pay for things like Intune, it's a weirdly doubled sunk cost inertia, but still a sunk cost inertia.)
- xqt40 2y agoWhat does any of SCCM and Intune has to do with Crowdstrike? Intune is already outdated btw.
- WorldMaker 2y agoCrowdStrike included some basic SCCM/fleet management "compliance checkboxes". That is one of the reasons companies were paying for CrowdStrike is "fleet management" of AV. > Intune is already outdated btw. I do know that part of Microsoft loves to change brand names every quarter for fun and the "parent" organization has changed a few times from different parts of Office and Windows Server to now "Microsoft 365", but as far as I can tell (and I don't keep up with it) Intune is still the active brand name: https://en.wikipedia.org/wiki/Microsoft_Intune https://en.wikipedia.org/wiki/Microsoft_Intune It's because of the merger into Microsoft 365 that I feel confident that most big Enterprises are already paying for Intune even if they aren't using the most up-to-date version and don't know what compliance "checkboxes" it solves versus something like CrowdStrike.
- 0xBDB 2y agoThe Microsoft competitor to CrowdStrike is Microsoft Defender XDR (specifically Defender for Endpoint), an enterprise product that is pretty good (in my opinion) but not one that Microsoft just throws in as a sweetener with Office 365 or whatever. You will pay specifically for it. It also runs in the kernel, as most effective EDR does, so until eBPF for Windows is done you are taking the same chance with it as with CrowdStrike. It's just a matter of which company you trust more not to BSOD you.
- WorldMaker 2y ago> until eBPF for Windows is done Red Hat says CrowdStrike themselves have sent out eBPF files that have caused all sorts of kernel panics. Any sufficiently advanced kernel scripting language is still kernel-level code. I'm not sure eBPF is exactly the savior people are hoping for, though I do still think it remains something of a general improvement if Microsoft can actually get AV vendors and others to use eBPF rather than bespoke kernel drivers.
- 0xBDB 2y agoI'm pretty sure those were actual kernel modules, not eBPF. eBPF for their Linux agent is on their roadmap but not something they are actually doing yet. eBPF should be sandboxed and unable to crash the kernel. Could be I'm missing something, though.
- s4mw1se 2y agoThe price is no joke. Microsoft has a lot of really good security products locked behind a paywall that security vendors know they can beat. We were looking the price for sentinel the other day and holy shit it’s costly.
- moi2388 2y agoThere should be a law that you can’t offer security at a premium. It’s too important. Paying less to reduce security is a baffling business model.
- 2y ago