Endpoint Protection Software Licences

In short: Endpoint protection software stops malware, ransomware and exploits on laptops, desktops and servers. Modern products use behavioural detection and machine learning rather than signatures alone, and are managed from a cloud console. They are usually licensed per device or per user, with server licences priced separately, on monthly or annual terms.

What is endpoint protection?

Endpoint protection is the security software that runs on each device: laptops, desktops, servers and sometimes virtual machines. It is the modern successor to antivirus. As well as scanning files against known threats, today's products watch behaviour, block exploits that abuse legitimate software, stop ransomware encrypting files, and control risky things such as USB storage and malicious websites.

Everything is managed from a cloud console, so you can see the state of every device, wherever your staff work, and push policy changes without visiting anyone. Malware protection is one of the five technical controls in Cyber Essentials, so a supported, centrally managed product is the starting point for most UK organisations.

Endpoint protection: vendors and products we supply

Absolute Security: Firmware-anchored device visibility, control and self-healing resilience.
Absolute Security Secure Endpoint: Visibility, Control and Resilience editions compared, with Persistence.
Acronis: Backup, disaster recovery, EDR, email security, RMM and protected servers on one platform.
Acronis Cyber Platform (Cyber Protect Cloud): Backup, anti-ransomware and management in one agent, per workload or on storage used.
Acronis DLP and GenAI Protection: Endpoint data loss prevention and GenAI controls, billed monthly.
Acronis EDR and XDR: Endpoint detection and response, extended to email, identity and Microsoft 365.
Acronis RMM: Patching, monitoring, scripting and remote access, billed monthly.
Bitdefender: GravityZone endpoint protection, EDR, email security, patching and encryption from one console.
Bitdefender Full Disk Encryption: Central management of native Windows and macOS encryption, with recovery keys and reports.
Bitdefender GravityZone Cloud MSP Security: Cloud-managed endpoint protection for PCs, Macs, Linux and servers, billed monthly.
Bitdefender GravityZone EDR: Incident correlation, attack visualisation and guided response, with XDR and MDR options.
Bitdefender Patch Management: Automated OS and third-party application patching from the GravityZone console.
Blackpoint Cyber MDR: 24/7 endpoint detection and active response, with Microsoft Defender integration.
Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
Check Point Harmony Endpoint: Endpoint protection, anti-ransomware and EDR in one agent, licensed per device.
CrowdStrike: Falcon endpoint protection, managed threat hunting, Falcon Complete MDR, identity, SIEM and AI security.
CrowdStrike Falcon Complete Defend: Falcon endpoint protection with CrowdStrike's 24/7 managed detection, response and remediation.
CrowdStrike Falcon Data Protection: Endpoint and cloud data loss prevention from the Falcon sensor, including GenAI uploads.
CrowdStrike Falcon Defend: Next-gen antivirus, USB control and firewall management, with OverWatch threat hunting in Advanced Defend.
CrowdStrike Falcon Guardian: Shadow AI discovery, AI usage policy and protection for AI agents and prompts.
Cynet: One-agent security platform with EDR, XDR, deception and 24x7 CyOps MDR, licensed per endpoint.
Cynet All-in-One platform: Protect, Elite and All-in-One packages compared, licensed per endpoint.
Guardz Managed security plans: Pro, Ultimate and Elite plans compared, run for you and licensed per user.
Halcyon: Dedicated anti-ransomware beside your EDR: prevention, key capture and data theft blocking.
Halcyon Anti-Ransomware Platform: Pro and Pro Plus DXP: prevention, key capture, recovery and data theft blocking.
Keeper Security Endpoint Privilege Manager: Remove local admin rights with just-in-time elevation on Windows, macOS and Linux.
SentinelOne: Singularity endpoint, cloud and identity security with Purple AI and managed detection and response.
SentinelOne Cloud Workload Security: Runtime protection for servers, VMs, containers and Kubernetes, per endpoint or host.
SentinelOne Singularity Endpoint: Control and Complete editions: AI prevention, rollback, device control and full EDR.
Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
Sophos Device Encryption: Central management of BitLocker and FileVault, licensed alongside Sophos Endpoint.
Sophos Endpoint: Next-gen antivirus and anti-ransomware, licensed per user, with separate server licences.
ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
ThreatDown Endpoint Protection: Next-gen antivirus for PCs, Macs, Linux and servers, with application block, billed monthly.
ThreatDown OneView: Multi-tenant console for every ThreatDown module, billed monthly per endpoint.
ThreatDown Vulnerability and Patch Management: Find vulnerable software, rank it by CVSS and deploy patches from one console, per endpoint.
Todyl: Modular SASE, EDR, SIEM, 24/7 MXDR and GRC on one agent, billed monthly per device.
Todyl Endpoint Security: EDR and NGAV in one agent, with isolation, quarantine and ATT&CK mapping.
Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
Trend Micro Endpoint Security: Core, Essentials and Pro endpoint and server protection, with EDR included from Essentials.
Trend Micro Worry-Free: Per-user endpoint, email and XDR suites for small businesses, up to Co-Managed XDR.
WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
WatchGuard Endpoint Security: Endpoint protection and EDR per endpoint: Basic, Prime, 360 and Elite.
Webroot: Lightweight cloud endpoint protection, DNS filtering and awareness training.
Webroot Business Endpoint Protection: Cloud-managed endpoint protection for Windows, macOS and servers, per device.

What to look for

Prevention quality: behavioural and machine-learning detection, exploit prevention and ransomware protection, not just signature scanning
Platform coverage: Windows, macOS and Linux, plus Windows Server and the virtual or cloud workloads you run
Light footprint: one agent rather than several, with low impact on older machines
Central management: a multi-site cloud console, role-based admin and clear reporting
Extras that save buying separately: device control, web filtering, application control, host firewall management, disk encryption management or patching
An upgrade path: the option to add EDR, XDR or MDR later without replacing the agent

Independent test results from organisations such as AV-TEST, AV-Comparatives and SE Labs are worth reading, but how the console fits the way you work matters just as much.

How endpoint protection is licensed

Most vendors license endpoint protection per device (sometimes called a seat or node), with server licences sold separately because servers need different policies and often cost more to protect. Some sell per user instead, with each user covering a set number of devices. Higher editions add EDR, extended detection or managed response, and the price rises with each tier.

Monthly billing is increasingly common, which suits organisations whose headcount changes. Annual terms usually suit stable estates. Either way, it pays to count servers, virtual machines and shared PCs carefully before you order: see per-user vs per-device licensing.

When you compare quotes, make sure they cover the same things. One vendor's entry edition may include device control and web filtering that another sells as add-ons, and some include server protection in a bundle while others price it separately.

How to choose

Count devices by type: workstations, servers, virtual machines and Macs.
Decide whether you need detection and response now, or simply strong prevention with a path to EDR later.
Check how the product handles removal of your existing antivirus; most vendors provide a removal tool.
Trial it on a pilot group, including your oldest machines and any line-of-business software that tends to clash with security tools.
Choose the term: monthly if numbers change, annual if they do not.

Well-known options include Sophos Intercept X, Bitdefender GravityZone, SentinelOne, CrowdStrike Falcon, ThreatDown (from Malwarebytes), Trend Micro and Check Point Harmony Endpoint. Our specialist sites cover Sophos Intercept X and Check Point Harmony Endpoint in depth.

How we help

We help you compare editions on like-for-like terms, plan the switch from your current product and deploy the new agent with policies that suit your business. Licences sit on your Forever Systems account alongside your other subscriptions, so adding a starter or removing a leaver is a quick request. Contact us for a quote.

How Forever Systems supplies your software licences

Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.

The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
Deployment and support from engineers who run these products every day, not just a reseller account
Consolidated billing and renewal reminders so nothing lapses unexpectedly

We work with businesses, schools, charities and public sector organisations of all sizes.

Need a licence quote or a second opinion on your renewal?

Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.

Frequently asked questions

What is the difference between antivirus and endpoint protection?

Traditional antivirus mainly matches files against known malware. Endpoint protection adds behavioural detection, exploit and ransomware prevention, device and web control, and central cloud management. Most products sold today are endpoint protection platforms.

Do servers need a different licence?

Usually, yes. Most vendors sell separate server licences with server-specific protection and policies. Check whether your virtual machines count as servers too.

Can I switch endpoint protection mid-contract?

You can install a new product at any time, but if your current product is on an annual term you will normally keep paying for it until renewal. Many organisations time the switch to the renewal date.

Is endpoint protection enough on its own?

It is essential but not sufficient. Pair it with email security, MFA, patching and backup, and consider EDR or MDR if you need investigation and response.

Security softwareEndpoint, email, identity, network and people security subscriptions.EDR, XDR and MDRDetection and response, with optional 24/7 managed services.Anti-ransomwareStop ransomware encrypting files, and recover if it does.Email securityStop phishing, malware and impersonation in Microsoft 365 and Google Workspace.DMARC and email authenticationGet SPF, DKIM and DMARC to enforcement and stop domain spoofing.Email encryptionSend sensitive information securely from Microsoft 365 or Google Workspace.Password managersEncrypted vaults, safe sharing and central control for passwords.Identity, MFA and privileged accessMFA, single sign-on and control of admin rights.SASE, ZTNA and business VPNSecure access to apps and the internet for hybrid teams.

Endpoint protection software