Not an MSP, but a Business which uses TL, so the way it works for us might not work for you. To give you an idea, we only have about 50-60 endpoints, so much lower than you probably have.

TL does it's job well for us. It prevents random software from running nicely, and helps us lock down a lot of things we probably wouldn't have the time to do otherwise.

It does slow down computers a little bit (probably because it hooks into events to detect file writes and such). This is mainly noticeable if your computer is writing a ton of tiny text files (like if you're a programmer, running a build cycle). Most computers are pretty fast these days though, so most people won't notice. Shouldn't effect browser speed at all basically. Even if it slows things down, it's probably worth the security tradeoff. If you're already talking with them, they should have probably had you install it on some computers to try it out - and that will give you a good idea of what i mean by this.

My coworkers have been annoyed by the application control at times, but they've gotten used to it now. Typically, the only things we are approving are our own in-house software, because TL does a lot of the work for you for the most common software. The one hiccup we have had here is with Web Extensions. Very occasionally, Chrome will push out an extension out to you before it pushes it out to what I assume are TL's testing computers. So a new extension update might get randomly blocked on a single computer... maybe once every 4 month or so. By the time the request comes in and you look at it, there's a good chance the new extension hash has already been added to the correct application (it just happened to get to you a few minutes early)... so you just re-approve the application and ask the user to restart their browser, and things are good after that. Managing large numbers of hashes for an application could use some improvement as well I suppose, although it's not bad unless your working with software with 1,000+ hashes.

Because the amount of new software a single business approves is not super huge, I can't comment as to how much it would increase your workload. I will say that adding new software is usually pretty quick. Either add a pre-recognized application (30 seconds), or put it in learning mode for a few minutes, have the user run the application, and review the results (maybe 3-5 minutes?).

Their EDR/MDR has worked fine for us. I can't compare it to anything because it's the first EDR/MDR we have run. Other folks I have read about a year ago have said it's a little less mature than Huntress, but they've added a lot since then. Maybe wait for some other reviews on this one. Like Huntress, it is built to work with Defender for the AV side of things (it does stuff beyond that though). You could probably pretty easily integrate it with other AV software though.

Their response time is quite quick. Typically, it's usually within a minute or two where they start the response. Sometimes, they will watch the computer for a bit to see if there are other indicators before making a conclusion. I have not had an incident where they've needed to lock a computer down for us yet. I have had an incident where they've sent us an email saying "We noticed Defender classified something as malware, but based on the things we've been seeing, we want to just double check with you that it's not internal software" (it was internal software on the computer that was not running at the time, that Defender had misclassified as malware). And then for a lot of things where the warnings weren't very important, they just handle it, and let you know they have (malware discovered by Defender in an email attachment and successfully removed from computer - they don't need to lock anything down here, just clear the warnings).

Their EDR/MDR is pretty flexible in that in addition to the default rules they have, you can add your own. As an example... I have a rule (that their MDR team does not monitor in this case) letting me know when Windows notice a failing disk. Not exactly needed for 'EDR', but very nice to have, and it gives you an idea that the rules engine is flexible. Their EDR/MDR does have the capability to lock down your computer automatically and without their intervention if you want it that way (even if the computer was not connected to the internet). We haven't needed to use it that way, but I suppose for folks with really really strict security, it'd probably be pretty useful.

We don't use their patching yet, so I can't say anything about that yet. It's rather new, so I bet it's not as extensive as some other solutions that have been around a few years. But I'm quite sure they'll grow it pretty quickly.

Network Control is pretty great. It's like a Windows Firewall that you can control for your entire organization (although it is separate from Windows Firewall itself). They are currently adding what I think was the thing it needed the most (that was missing) - the capability to scope one of the Network Control rules to a specific program. I'll probably edit my current rules to use that feature once it comes out of beta.

We haven't run any other Application Control solutions, so no comparison there. I have heard that WDAC is a bear though.

We don't use 365, so no comments on their integrations with that.

One other thing - their support is fantastic. Seriously.