Let's cut through the marketing. You're in financial services, which means you're a compliance checkbox factory and a high-value target. Throwing "best" around is pointless without context. Are you talking about detection efficacy, or the one that will cause the least friction during your next audit?
Everyone here will parrot the usual suspects: CrowdStrike, SentinelOne, Microsoft Defender for Endpoint. Since this is a Defender-specific forum, I'll focus on the reality of MDE.
The biggest selling point for a firm your size isn't the detection algorithms—it's the integration. If you're already deep in the Microsoft ecosystem (Azure AD, Intune, Purview), the unified portal and conditional access workflows are a powerful lure. The cost can look attractive bundled with E5 licenses. That's the trap.
The pitfalls you need to weigh:
* The "unified" console is often sluggish and convoluted. Performing a simple investigation across endpoints, emails, and cloud apps feels slower than it should.
* Advanced hunting (KQL) is powerful, but the learning curve is steep. Your SecOps team needs to be comfortable with it, or you're just using canned alerts.
* Tuning is mandatory. Out of the box, you'll get noise. For financial apps and in-house tools, you'll be writing exclusion rules or risking business disruption.
If you're considering it, your proof of concept must test these two things under real load:
1. The time from alert to root cause on a simulated incident.
2. The overhead of managing false positives for your line-of-business applications.
A quick example of the kind of tuning you'll be doing if you have legacy internal apps:
```kql
// Example: Creating an exclusion for a legacy financial app's known behavior
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName contains "LegacyFinApp.exe"
| where InitiatingProcessFileName =~ "java.exe"
| where ProcessCommandLine contains "/AutoStart"
// This would be a candidate for a false positive suppression rule after verification
```
Don't get sold on the Gartner Magic Quadrant. Run a real bake-off with your own tools and team. The "best" product is the one your team will actually use effectively, not the one with the shiniest datasheet.
Also, at 100 users, you're in a sweet spot to consider some modern open-source EDR stacks if you have the in-house talent. The total cost of ownership can be surprisingly competitive when you factor in the lack of vendor lock-in. But that's a different thread.
Just my 2 cents