I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, they report a lot of data back from the endpoint so historical detection can happen.

However what I see is essentially their true positive and false negative rate, I would be interested to know what the false positive rate is.

Not OP, but I've worked for an endpoint protection product company. Part of the onboarding was them loading up a virtual machine with the endpoint installed, then demonstrating several attacks (installing malicious software, running scripts off the internet, etc) and showing the logs of what the endpoint detected, and at what point it shut down the malicious behavior.

The examples shown were behavior based, not hash based. It didn't look up a file in a dictionary, it detected priviledge elevations and such.

No product is perfect, but if you have a need to be protected (especially if you are at risk from adversaries such as in banking, health care, government work, or against corporate espionage) I'm quite confident in saying that you're much better off with it than without.

The same company would also, at random times, attempt to phish us or send us fake emails to get us to click on links, to help educate us on the kinds of threats our customers faced I consider myself fairly savvy, and even I fell for one of them.

I ended up leaving for a variety of reasons, but "losing faith in the product" was not one of them.

I'm not the guy above but the better ones can be very useful. And if they are behaving that badly and impeding your work THAT much then it is most likely that the person in your org configuring it just sucks as their job.