CyberIndexBeta

Product

Cloud endpoint management service that configures devices and delivers operating-system and application updates across Windows, macOS, Linux, iOS and Android. Microsoft Intune covers Linux, macOS, Windows and Windows Server. It is delivered as a hosted SaaS service. It is recorded as supporting air-gap operation, application patching, automated patch deployment and central management console. Its record also notes local patch repository, multi-tenant (msp) management, operating system patching and patch compliance reporting.

Current Version
Cloud service · no version
Market
EnterpriseGovernmentMid-MarketSMB
Licence
Paid
Price
USD 8 / monthly
Record Created
2026-10-04
Last Updated
2026-10-28

Vendor

Microsoft is the largest security vendor in this index by installed base, and almost none of that was bought deliberately: Microsoft Defender Antivirus is built into Windows and switched on by default, so it protects any machine whose owner has not installed something else. That changes how its results should be read — it is the baseline every other product in this index is implicitly compared against. The paid products are a different thing from the built-in one. Microsoft Defender for Endpoint adds detection and response, threat and vulnerability management and central policy to the same engine; Microsoft Defender for Business is the smaller-organisation edition; Microsoft Defender XDR correlates signals across endpoints, identity, email and cloud apps; and Microsoft Sentinel is the SIEM above them. Microsoft Defender for Individuals, included with Microsoft 365, is the consumer application. Microsoft enters the public test cycles regularly, and its results are among the most consistently available in this index — useful, because for many readers the real question is not which product is best in the abstract but whether a paid product beats the one already installed. Vendor page →

Country
United States
Headquarters
Redmond, United States
Year Established
1975
Customers
1.6M organisations
Users
1.4B devices protected
Revenue
$331.8B (2026)

Platforms

Linuxnative
macOSnative
Windowsnative
Windows Servernative

Target Market

Enterprise primaryGovernment secondaryMid-Market secondarySMB primary

Capabilities

Application Patchingkeynative
Operating System Patchingkeynative
Automated Patch Deploymentkeynative
Vulnerability-Based Prioritisationkeypartial
Patch Rollbackkeypartial
Phased / Ring Deploymentnative
Roaming Endpoint Patchingkeynative
Patch Compliance Reportingnative
Reboot Managementnative
Software Deploymentnative
Vulnerability ShieldingNot known
Central Management Consolenative
Air-Gap Operationkeypartial
Local Patch Repositorynative
Agentless PatchingkeyNot known
Multi-Tenant (MSP) Managementkeyoptional module

2 of 16 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummarySubscriptionnot statedmonthlyUSD 8

Versions

A cloud service: the vendor runs it, so there is no version for customers to install or upgrade.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

Common Criteria1 activeMicrosoft Intune
FedRAMPHigh1 activeF1209051525
OESIS Framework SupportSupported1 activeSupported

Change History

This record was created 2026-10-04. Everything below is what has changed since.

  • 2026-10-20Product updatedSold to: Enterpriseevidence
  • 2026-10-20Product updatedAlso sold to: Governmentevidence
  • 2026-10-20Product updatedAlso sold to: Enterpriseevidence
  • 2026-10-20Product updatedAlso sold to: Mid-Marketevidence
  • 2026-10-20Product updatedSold to: SMBevidence
  • 2026-10-12Certification addedCertified: FedRAMP (High)evidence
  • 2026-10-12Capability addedAir-Gap Operation: limitedevidence
  • 2026-10-08Pricing plan addedPrice: USD 8 monthlyevidence
  • 2026-10-06Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-10-06Capability addedMulti-Tenant (MSP) Management: optional moduleevidence
  • 2026-10-05Capability addedPatch Rollback: limitedevidence
  • 2026-10-05Capability addedVulnerability-Based Prioritisation: limitedevidence
  • 2026-10-05Capability addedLocal Patch Repository: built inevidence
  • 2026-10-05Capability addedAir-Gap Operation: built inevidence
  • 2026-10-05Capability addedReboot Management: built inevidence
  • 2026-10-05Capability addedPatch Compliance Reporting: built inevidence
  • 2026-10-05Capability addedRoaming Endpoint Patching: built inevidence
  • 2026-10-05Capability addedPatch Rollback: no longer recordedevidence
  • 2026-10-05Capability addedApplication Patching: built inevidence
  • 2026-10-05Capability addedPatch Rollback: built inevidence
  • 2026-10-05Capability addedPhased / Ring Deployment: built inevidence
  • 2026-10-05Capability addedAutomated Patch Deployment: built inevidence
  • 2026-10-05Capability addedOperating System Patching: built inevidence
  • 2026-10-04Platform addedRuns on Windows Serverevidence
  • 2026-10-04Platform addedRuns on Linuxevidence
  • 2026-10-04Platform addedRuns on macOSevidence
  • 2026-10-04Platform addedRuns on Windowsevidence
  • 2026-10-04Capability addedCentral Management Console: built inevidence
  • 2026-10-04Capability addedSoftware Deployment: built inevidence
  • 2026-10-04Certification addedCertified: Common Criteriaevidence
  • 2026-10-04Product createdNew product, listed in Patch Managementevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.