We are half way through switching to symantec.. They are all terrible.
My requirements are they shut the fuck up unless there is an actual issue at which point they do not let the users fucking click the screen away because fuck I have lost count of the number of times a user has managed to click ignore on a virus and infect a whole fucking filesystem. My other requirement is that it takes as few CPU resources as possible (ok I get it needs some, but not fucking 90%) and gets the fuck out of the way of the servers primary purpose. Also not requiring an admin to click anything to get it to update or scan is a bonus (im looking at you forefront).
Oh you know, also actually stopping viruses like they are supposed to, but thats just living in a fantasy world.
I have literally watched endpoint on a desktop machine hog 90% CPU, blocking admin access to anything useful while the virus busily continues to encrypt files.. YOU HAVE 1 JOB ENDPOINT, 1 FUCKING JOB.