In short: ThreatDown is the business security brand of Malwarebytes. One agent and one cloud console cover endpoint protection, EDR, 24/7 MDR, vulnerability and patch management, DNS filtering, application blocking, mobile security, email security and identity threat detection. Forever Systems supplies ThreatDown through its OneView console, with each module billed monthly on the endpoints, users or mailboxes it covers.
What ThreatDown does
ThreatDown is the name Malwarebytes uses for its business security products, introduced in 2023 to separate them from its well-known consumer antivirus. Products are often labelled "ThreatDown, powered by Malwarebytes", and older SKUs and invoices may still say Malwarebytes Endpoint Protection or Malwarebytes EDR.
Everything runs on one lightweight agent and one cloud console. ThreatDown has two consoles:
- Nebula, a single-tenant console for organisations that manage their own security
- OneView, a multi-tenant console that IT providers use to manage many customers, with usage tracking and billing per site
We supply ThreatDown through OneView. Your organisation is a site in our console, managed day to day by our team, and you can also be given access to your own site's dashboards.
The ThreatDown products we supply
| Product | What it does | Licensed by |
|---|---|---|
| ThreatDown OneView | Multi-tenant console that manages every module below | Endpoint, via the modules enabled |
| Endpoint Protection | Next-gen antivirus with device control, application blocking and automated remediation, for workstations and servers | Endpoint |
| ThreatDown EDR | Detection and response with isolation and ransomware rollback | Endpoint |
| ThreatDown MDR | 24/7 monitoring and response by ThreatDown analysts, or Managed Threat Hunting | Endpoint |
| Vulnerability and Patch Management | Finds vulnerable software and deploys patches | Endpoint |
| DNS Filtering | Blocks malicious and unwanted web categories at DNS level | User or endpoint |
| Email Security | AI-based phishing detection and automatic remediation for cloud mailboxes | Mailbox (user) |
| ThreatDown ITDR | Detects and stops identity attacks on Active Directory, Entra ID and Okta | User |
| Mobile Security | Protection for Chromebooks, iOS and Android | Device |
Browse alternatives in endpoint protection and EDR, XDR and MDR.
How ThreatDown is licensed
If you buy direct, ThreatDown sells annual bundles priced per device:
| Bundle | What it includes |
|---|---|
| Core | Next-gen antivirus, incident response (automated remediation), device control, application block, vulnerability assessment, browser phishing protection and AI tool visibility |
| Advanced | Core plus EDR, ransomware rollback, patch management, Windows firewall management, drive encryption and Managed Threat Hunting |
| Elite | Advanced plus 24/7 managed detection and response (MDR) and the ThreatDown AI assistant |
| Ultimate | Elite plus MDR Plus, ITDR and Premium Support |
DNS filtering, email security, mobile security and server protection are add-ons to every bundle, and ITDR is an add-on to Advanced and Elite.
Through Forever Systems the model is different. Because we manage you from OneView, each module is switched on per endpoint and billed monthly on usage. You can run EDR on every laptop but MDR only on servers, or add DNS filtering for one office, and the invoice reflects what was protected that month. Server versions of Endpoint Protection and EDR are counted separately from workstations. Prices depend on the number of endpoints and the modules you choose, so ask us for a quote. See per-user vs per-device licensing for how mixed counting works.
Buying ThreatDown through Forever Systems
- Scope: we count workstations, servers, mobile devices and mailboxes, and agree which modules each group needs.
- Quote: a monthly quote with every module itemised.
- Deploy: we create your site in OneView, remove the old antivirus, push the agent through your RMM, Intune or Group Policy, and apply tuned policies.
- Run: our team handles alerts, exclusions, new devices and module changes, and everything appears on one Forever Systems invoice with your other subscriptions.
Already running Malwarebytes or ThreatDown with another provider or on a direct Nebula subscription? We can move your endpoints into OneView at renewal.
Explore ThreatDown
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is ThreatDown the same as Malwarebytes?
Yes. ThreatDown is Malwarebytes' business security brand. The products use the same Malwarebytes technology and are often labelled ThreatDown, powered by Malwarebytes.
Can I buy ThreatDown monthly?
Yes. Through Forever Systems each module is billed monthly on the endpoints, users or mailboxes it protected that month, rather than as an annual bundle.
What is the difference between Nebula and OneView?
Nebula is ThreatDown's single-tenant console for organisations managing their own security. OneView is the multi-tenant console IT providers use to manage many customers; we supply you through OneView.
Do you supply Malwarebytes home antivirus?
No. Malwarebytes' consumer products are not sold here. We supply ThreatDown business products only, managed through our OneView console.
Does ThreatDown protect servers?
Yes. Endpoint Protection and EDR both have server versions, counted separately from workstations, and the ThreatDown agent supports Windows and Linux as well as macOS.