CISO Tribune

Vendor comparison · 2 companies

Microsoft vs Splunk

Microsoft Defender offers threat prevention, detection and response capabilities. Splunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives. CISO Tribune files both under SIEM. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Microsoft
  • Splunk
Microsoft vs Splunk: Products, Customers and Funding Compared
MicrosoftMicrosoft Defender offers threat prevention, detection and response capabilities.microsoft.comSplunkSplunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives.splunk.com
What it sells
  • Microsoft Defender[1][11][12][23][25]Threat protection that prevents, detects and responds to attacks across devices, identities, applications, email, data, workloads and cloud environments.
  • Microsoft Sentinel[1][23]A cloud-native SIEM built for AI.
  • Microsoft Purview[1][14][23][24][25]Unified information protection, governance and compliance products.
  • Microsoft Entra[1][15][23][25]Identity and access products that verify every identity and access request across clouds, platforms and devices.
  • Microsoft Intune[1][16][23][25]Endpoint management products for device security and hybrid work.
  • Microsoft Defender Suite[12]Threat protection and detection and response across endpoints, identities, email and SaaS apps.
  • Microsoft Entra Suite[15]An extension to Microsoft 365 E3 or E5 for secure workforce use of apps and AI.
  • Microsoft Purview Suite[14]A suite that provides advanced data security and compliance capabilities.
  • Splunk Cloud Platform[12][22][23][24]A platform to collect, index, and visualize data in the cloud.
  • Splunk Enterprise[1][12][14][17][18][22][24]A platform to collect, index, and visualize data using an on-premises engine.
  • Splunk Enterprise Security[1][14][17][18]A Splunk solution for security operations.
  • Federated Search[15][19]A search layer across the data estate.
  • Splunk AI Assistant[19]A natural-language entry point to the search workflow.
  • Splunk Edge Processor[21]A processor that applies cryptographic functions to data as it flows on-premises.
  • Splunk AI Toolkit[20]Guided workflows to build and deploy models.
  • Splunk Log Observer Connect[22]An integration that links logs to Splunk Observability Cloud.
Categories
Headquarters
Redmond, United States[3]San Jose, United States[4]
Founded
1975[2]2003[3]
Ownership and funding
Public (NASDAQ: MSFT)[4][10][22]Owned by Cisco[2][15][16][25]
Named customers
  • Best Buy[5]
  • Danfoss[6]
  • Oregon State University[7]
Recent news
  • July 29, 2026Microsoft reported revenue of $90.0 billion for the quarter ended June 30, 2026, up 18% year over year.[8]
  • July 27, 2026Microsoft introduced Project Perception, an agentic security system that uses AI to turn signals into real-time protections.[21]
  • May 1, 2026Microsoft announced general availability of Microsoft 365 E7 and Microsoft Agent 365 on May 1, 2026.[28]
  • April 29, 2026Microsoft reported revenue of $82.9 billion for the quarter ended March 31, 2026, up 18% from a year earlier.[9]
  • December 22, 2025Microsoft announced the Defender Experts suite, an expert-led security offering for resellers and scale solution providers, generally available from January 1, 2026.[20]
  • September 15, 2026Cisco released Cisco AI POD for Splunk, which brings Splunk AI features to on-premises customers on Cisco infrastructure with NVIDIA computing.[10]
  • May 28, 2026Splunk reported that Cisco has completed its acquisition of Galileo, with plans to integrate Galileo technology into Splunk Observability.[25]
  • April 9, 2026Cisco agreed to buy AI observability startup Galileo Technologies to add its agent monitoring tools to the Splunk observability platform.[11]
  • February 18, 2026Splunk announced that its hosted AI models are generally available for Splunk Cloud Platform customers.[23]
  • January 16, 2026Splunk announced the release of Splunk Enterprise 10.2 and Splunk Cloud Platform 10.2.[24]
G2 and Gartner Peer Insights
  • G2: listed, seen November 10, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[16]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Microsoft sells security products for businesses of any size. Microsoft 365 Business Premium is aimed at small and medium-sized businesses, and Microsoft Defender is designed to protect individuals, businesses and enterprises. Microsoft refers to enterprise and government cloud customers, and Providence Care, a healthcare organization, uses Microsoft 365 E5 for healthcare security.From its own pages, Splunk sells mainly to organisations that want security, observability, and AI data on one platform. Splunk describes SOC teams that index authentication and firewall data for real-time detections. Splunk describes a healthcare organization that monitors logs from medical devices. Splunk offers material for CISOs and boards on priorities, budgeting, compliance, and success metrics. Splunk describes deployments on Splunk Enterprise and Splunk Cloud Platform.
Last verified
November 2, 2026October 10, 2026

Where they overlap

  • Microsoft and Splunk are both filed under SIEM.
  • Both are headquartered in the United States.

Where they differ, field by field

  • Microsoft's primary category is EDR and XDR; Splunk's is SIEM.
  • Microsoft is also filed under Workforce IAM and SSO and Endpoint management and application control. Splunk is also filed under SOAR and security automation and Security data lakes and pipelines.
  • Microsoft lists Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Microsoft Entra, Microsoft Intune and 3 more. Splunk lists Splunk Cloud Platform, Splunk Enterprise, Splunk Enterprise Security, Federated Search, Splunk AI Assistant and 3 more.
  • Microsoft is headquartered in Redmond, United States. Splunk is headquartered in San Jose, United States.
  • Microsoft was founded in 1975. Splunk was founded in 2003.
  • Microsoft is a public company listed on NASDAQ as MSFT. Splunk is owned by Cisco.
  • Microsoft publicly names Best Buy, Danfoss and Oregon State University. Splunk publicly names Carrefour, Intel, FINRA, Alaska Airlines and Honda of Alabama.

What it sells: Microsoft

What Microsoft Defender does[1][11][12][23][25]
Microsoft Defender is a threat protection solution designed to protect individuals, businesses and enterprises from malicious cyberthreats. Microsoft Defender coordinates protection across endpoints, identity, email, apps and cloud.
What Microsoft Purview does[1][14][23][24][25]
Microsoft Purview offers a unified approach to help organizations secure and govern data across their heterogenous data estate. Microsoft Purview covers on-premises, multicloud and SaaS environments, and structured and unstructured data. Microsoft Purview features are purchased through different licenses or on a pay-as-you-go basis.
What Microsoft Entra does[1][15][23][25]
Azure Active Directory (Azure AD) was renamed Microsoft Entra ID in 2023. Purchase starts with Microsoft Entra ID P1 or P2 license subscriptions, which can also be purchased as part of a Microsoft 365 E3 or E5 license.
What Microsoft Intune does[1][16][23][25]
Microsoft Intune offers advanced endpoint management and security capabilities available as standalone add-ons or as part of the Intune Suite. Microsoft Intune Plan 1 is the endpoint management solution included in most Microsoft 365 enterprise licenses. Plan 1 covers cross-platform device management, built-in security, mobile application management and endpoint analytics.
What Microsoft Defender Suite does[12]
Microsoft Defender Suite focuses on threat protection and detection and response across endpoints, identities, email and SaaS apps. The integrated security operations center (ISOC) is included in the Defender Suite.
What Microsoft Entra Suite does[15]
Microsoft Entra Suite extends Microsoft 365 E3 or E5 to enable secure workforce use of apps and AI with continuous, adaptive identity and network access controls across employees, apps and networks. Microsoft Entra Suite requires a subscription to Microsoft Entra ID P1 or a package that includes Microsoft Entra ID P1.

What it sells: Splunk

What Splunk Cloud Platform does[12][22][23][24]
Splunk Cloud Platform is described as a way to collect, index, and visualize data in the cloud. Splunk says data can be brought in with agents, Splunk-supported integrations, and developer add-ons.
What Splunk Enterprise Security does[1][14][17][18]
Splunk names Splunk Enterprise Security among its solutions that use pre-written macros. Splunk describes AI Assistant in Security as available to cloud customers of Splunk Enterprise Security.
What Federated Search does[15][19]
Federated Search is described as the unifying search layer across the data estate. It covers Splunk-managed locations and supported customer-managed stores such as Amazon S3 and Snowflake.
What Splunk AI Assistant does[19]
Splunk AI Assistant provides a natural-language entry point to the search workflow. With Agent Mode enabled, an analyst can describe the investigation to perform instead of constructing each search.

Questions about Microsoft and Splunk

What do Microsoft and Splunk sell?
Microsoft sells Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Microsoft Entra, Microsoft Intune and 3 more. Splunk sells Splunk Cloud Platform, Splunk Enterprise, Splunk Enterprise Security, Federated Search, Splunk AI Assistant and 3 more.
Are Microsoft and Splunk in the same category?
They share SIEM. Microsoft's primary category is EDR and XDR and Splunk's is SIEM.
Where are Microsoft and Splunk headquartered?
Microsoft is headquartered in Redmond, United States. Splunk is headquartered in San Jose, United States.
When were Microsoft and Splunk founded?
Microsoft was founded in 1975. Splunk was founded in 2003.
Who owns Microsoft and Splunk?
Microsoft is a public company listed on NASDAQ as MSFT. Splunk is owned by Cisco.
Which customers do Microsoft and Splunk name?
Microsoft publicly names Best Buy, Danfoss and Oregon State University. Splunk publicly names Carrefour, Intel, FINRA, Alaska Airlines and Honda of Alabama.
Who are Microsoft and Splunk sold to?
From its own pages, Microsoft sells security products for businesses of any size. From its own pages, Splunk sells mainly to organisations that want security, observability, and AI data on one platform.
What have Microsoft and Splunk announced recently?
July 29, 2026: Microsoft reported revenue of $90.0 billion for the quarter ended June 30, 2026, up 18% year over year. September 15, 2026: Cisco released Cisco AI POD for Splunk, which brings Splunk AI features to on-premises customers on Cisco infrastructure with NVIDIA computing.

About Microsoft

Microsoft Defender offers threat prevention, detection and response capabilities. Microsoft Defender coordinates protection across endpoints, identity, email, apps and cloud. Security Copilot agents come ready to use in Microsoft Entra, Microsoft Intune, Microsoft Purview, Microsoft Defender and Microsoft Sentinel.[11][15][16][23]

Microsoft Defender is a threat protection solution designed to protect individuals, businesses and enterprises from malicious cyberthreats. Microsoft Defender has the purpose of preventing, detecting and responding to attacks across devices, identities, applications, email, data, workloads and cloud environments. XDR capabilities are included with eligible Microsoft plans and supported Defender products. Microsoft offers cloud security for hybrid and multicloud environments across the full application lifecycle, from code to runtime. Microsoft offers vulnerability management with continuous vulnerability assessment, risk-based prioritization and remediation. Microsoft offers email and collaboration security against phishing and advanced cyberthreats such as business email compromise.[1][11][12][17][26][27]

Microsoft Defender Suite focuses on threat protection and detection and response across endpoints, identities, email and SaaS apps. The integrated security operations center (ISOC) is included in the Defender Suite. Microsoft Defender Suite is offered on its own or as part of Microsoft 365 E5. Microsoft Defender for Endpoint licenses include protection for up to 5 devices per user license. Microsoft Defender for Office 365 protects against email-based threats and secures collaboration tools including Microsoft Teams, SharePoint and OneDrive. Microsoft offers expert-led services to help defend against threats, build cyber resilience and modernize security operations. Microsoft offers AI-powered threat hunting across endpoints, identities, emails, cloud apps and cloud workloads.[1][11][12][14][19]

Microsoft offers a cloud-native SIEM built for AI. The cloud-native SIEM from Microsoft includes a built-in data lake. Azure Active Directory (Azure AD) was renamed Microsoft Entra ID in 2023. To purchase Microsoft Entra, customers start with Microsoft Entra ID P1 or P2 license subscriptions, which can also be purchased as part of a Microsoft 365 E3 or E5 license. Microsoft Entra Suite extends Microsoft 365 E3 or E5 to enable secure workforce use of apps and AI with continuous, adaptive identity and network access controls across employees, apps and networks. Microsoft Entra Suite requires a subscription to Microsoft Entra ID P1 or a package that includes Microsoft Entra ID P1. Identity Governance enforces least privilege access and automates access lifecycles.[1][12][15][23]

Microsoft Intune offers advanced endpoint management and security capabilities available as standalone add-ons or as part of the Intune Suite. The advanced capabilities include Endpoint Privilege Management (EPM), Enterprise App Management (EAM), Advanced Analytics, Remote Help, Microsoft Cloud PKI, Microsoft Tunnel for Mobile Application Management (MAM), Firmware-over-the-Air (FOTA) updates and Specialized Device Management. Microsoft Intune Plan 1 is the endpoint management solution included in most Microsoft 365 enterprise licenses, covering cross-platform device management, built-in security, mobile application management and endpoint analytics. Select advanced Intune capabilities are now included in Microsoft 365 E3 and E5.[1][16]

Microsoft Purview offers a unified approach to help organizations secure and govern data across their heterogenous data estate. Microsoft Purview enables organizations to secure and govern a data estate across on-premises, multicloud and SaaS environments, and across structured and unstructured data. Microsoft offers data security to discover, classify and protect sensitive data across a data estate. Microsoft Purview features are purchased through different licenses or on a pay-as-you-go basis. Microsoft Purview Suite (formerly Microsoft E5 Compliance Suite) provides advanced data security and compliance capabilities. Microsoft 365 E5 includes Office apps, identity and endpoint protection, and all Microsoft Purview Suite capabilities.[1][13][14][24]

Microsoft 365 Business Premium is a solution for small and medium-sized businesses. Microsoft 365 Business Premium includes Microsoft Defender for Business, Microsoft Defender for Office 365 Plan 1, Microsoft Entra ID Plan 1, Microsoft Intune Plan 1 and Microsoft Purview, along with Outlook, Word, Excel, PowerPoint, Teams, SharePoint, Clipchamp and Copilot Chat. Microsoft points organizations with more than 300 users to its enterprise offerings. Ford Motor Company uses Microsoft Security solutions to protect its data and operations. Providence Care uses Microsoft 365 E5 for healthcare security. Auckland Transport uses Microsoft Security Copilot for citywide cybersecurity. KPMG deployed Microsoft Defender for Cloud and Microsoft Purview for sensitive data that might be exfiltrated or overshared by AI apps.[1][12][13][14][15][17][18][25][26]

Microsoft on the record

Sources

Microsoft full record

  1. [1]Cloud Security Solutions | Microsoft SecurityMicrosoft · undated page, accessed September 27, 2026 · Tier A
  2. [2]AboutMicrosoft · news.microsoft.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Msft 20240630Microsoft Corporation via SEC EDGAR · sec.gov · undated page, accessed September 27, 2026 · Tier A
  4. [4]7c96b326 33bc 4b84 8abb 7afd7a517ea3Microsoft Corporation · microsoft.gcs-web.com · undated page, accessed September 27, 2026 · Tier A
  5. [5]25053 best buy microsoft sentinelMicrosoft · microsoft.com · published August 25, 2025 · Tier A
  6. [6]22786 danfoss microsoft sentinelMicrosoft · microsoft.com · published March 7, 2025 · Tier A
  7. [7]1747330384796486050 oregon state university microsoft security copilot higher education en united statesMicrosoft · microsoft.com · published March 14, 2024 · Tier A
  8. [8]Microsoft cloud and ai strength fuels fourth quarter results 4Microsoft · news.microsoft.com · published July 29, 2026 · Tier A
  9. [9]Microsoft cloud and ai strength fuels third quarter resultsMicrosoft · news.microsoft.com · published April 29, 2026 · Tier A
  10. [10]Microsoft 365 Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 26, 2026 · Tier C
  11. [11]Microsoft Defender—Cybersecurity Solutions | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  12. [12]Microsoft Defender Suite | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  13. [13]Microsoft Purview Suite | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  14. [14]Microsoft Purview Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  15. [15]Microsoft Entra Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  16. [16]Microsoft Intune Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  17. [17]Cybersecurity for small and medium business | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  18. [18]Security Copilot agents in Microsoft 365 E5 | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  19. [19]Microsoft Defender Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
  20. [20]December 2025 announcements - Partner Center announcementsMicrosoft Learn · published December 22, 2025 · Tier A
  21. [21]Rethinking security for the age of AIThe Official Microsoft Blog · published July 27, 2026 · Tier A
  22. [22]Microsoft Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed November 3, 2026 · Tier C
  23. [23]Microsoft 365 Security Enterprise Plans| Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
  24. [24]Microsoft Purview: Data Security and Governance | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
  25. [25]CybersecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
  26. [26]Microsoft Defender Suite for Microsoft 365 Business Premium | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
  27. [27]Microsoft Mobile Phone Authenticator | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
  28. [28]Leading Frontier Firm transformation with Microsoft 365 E7: The partner opportunityMicrosoft · published May 1, 2026 · Tier A

Splunk full record

  1. [1]ProductsSplunk · splunk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Cisco completes acquisition of splunkCisco · newsroom.cisco.com · published March 18, 2024 · Tier A
  3. [3]Get the most out of splunk infrastructure monitoring and splunk itsiSplunk · splunk.com · published November 17, 2020 · Tier A
  4. [4]Contact usSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  5. [5]CarrefourSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  6. [6]IntelSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  7. [7]FinraSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  8. [8]Alaska airlinesSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  9. [9]HondaSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  10. [10]Cisco delivers trusted ai at scale through new splunk advancementsCisco · newsroom.cisco.com · published September 15, 2026 · Tier A
  11. [11]Cisco buys galileo strengthen splunks agentic monitoring capabilitiesSiliconANGLE · siliconangle.com · published April 9, 2026 · Tier B
  12. [12]Get Data In | Platform (last updated lastModifiedISO)Splunk · undated page, accessed October 28, 2026 · Tier A
  13. [13]Analytics Story: Warzone RAT | Splunk Security ContentSplunk · published May 13, 2026 · Tier A
  14. [14]Analytics Story: Trickbot | Splunk Security ContentSplunk · published May 13, 2026 · Tier A
  15. [15]Splunk | Data Platform for Security, Observability & AISplunk · undated page, accessed October 28, 2026 · Tier A
  16. [16]Splunk Enterprise Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed October 28, 2026 · Tier C
  17. [17]Using advanced macros - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  18. [18]L’IA au service de la sécurité | SplunkSplunk · undated page, accessed November 3, 2026 · Tier A
  19. [19]Investigating and searching across your data estate with Cisco Data Fabric powered by the Splunk platform - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  20. [20]Preparing data for use with the Splunk AI Toolkit - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  21. [21]De-identifying PII consistently with hashing in Edge Processor - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  22. [22]Using Log Observer Connect with Cloud Platform - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  23. [23]Splunk Launches Hosted Generative AI Models: Native-AI Insights, Zero Setup, Maximum SecuritySplunk · published February 18, 2026 · Tier A
  24. [24]Announcing Splunk Enterprise 10.2 & Splunk Cloud Platform 10.2 – Next Generation Querying & AnalyticsSplunk · published January 16, 2026 · Tier A
  25. [25]Splunk Observability + Galileo: Bridging the AI Trust GapSplunk · published May 28, 2026 · Tier A

Spot a factual error? Request a correction.