In short: ThreatDown EDR is Malwarebytes' endpoint detection and response product for Windows, macOS and Linux. It watches endpoint behaviour continuously, explains each detection, contains threats by isolating the network, process or desktop, and can restore files encrypted or deleted by ransomware up to seven days back. Through Forever Systems it is licensed per endpoint and billed monthly.
What ThreatDown EDR is
Antivirus blocks known bad files, but many attacks use the tools already on a machine: scripts, remote admin utilities and stolen accounts. Endpoint detection and response (EDR) looks at behaviour instead, flagging things like PowerShell being used in an unusual way, code being injected into another process or files being encrypted in bulk. ThreatDown EDR adds that layer on top of Endpoint Protection, using the same Malwarebytes agent.
Each detection explains what happened, on which device, and what to do about it, so an incident can be handled by a generalist IT team rather than a dedicated analyst. Incident reports summarise the attack, the response and any follow-up actions, which is useful when management, auditors or an insurer ask what happened.
What is included
| Capability | What it does |
|---|---|
| Endpoint Protection features | Next-gen antivirus, device control, browser phishing protection and automated remediation on the same agent |
| Suspicious activity monitoring | Continuous behavioural monitoring of every endpoint, with each detection explained |
| Isolation | Contain a threat at network, process or desktop level while you investigate |
| Ransomware rollback | A kernel-level driver keeps on-device copies of files before they change, so files encrypted, modified or deleted by ransomware can be restored up to seven days back |
| Guided remediation | Remove the threat and its leftover artefacts from the console |
| Reporting | Incident reports suitable for management, auditors and insurers |
Patch management runs on the same agent (see Vulnerability and Patch Management). If you want analysts to watch and act on these detections around the clock, add ThreatDown MDR.
Options and how it is licensed
| Option | What it covers | Unit |
|---|---|---|
| ThreatDown EDR | Windows and macOS workstations and laptops, and Linux | Endpoint, monthly |
| ThreatDown EDR for Servers | Servers, physical or virtual | Server endpoint, monthly |
EDR is enabled per endpoint in ThreatDown OneView and billed monthly on usage. You can run it everywhere, or only on servers and high-risk laptops with Endpoint Protection elsewhere; each device is counted for the module it actually has. If you bought ThreatDown direct, EDR is the heart of the Advanced bundle on an annual term, alongside Windows firewall management, drive encryption and Managed Threat Hunting. Prices depend on the number of endpoints and the modules you choose, so ask us for a quote.
Requirements and deployment
ThreatDown EDR uses the same agent as Endpoint Protection, so if you already run ThreatDown it is a policy change rather than a new install. On new estates the agent deploys through your RMM, Microsoft Intune, Group Policy or an installer, without a reboot.
Ransomware rollback needs local disk space for its file cache; we size the policy to your devices. We usually:
- Enable EDR on a pilot group and review the first fortnight of detections.
- Tune suspicious activity rules for admin tools and scripts you use legitimately.
- Agree isolation rules: which detections isolate automatically and which wait for a person.
- Extend to all devices and set up alert routing to our team.
If your cyber insurance questionnaire asks whether you run EDR, ThreatDown EDR answers that question for workstations and servers alike.
Who it suits
ThreatDown EDR suits organisations that have outgrown antivirus alone: those with sensitive data, remote staff, insurers asking about detection and response, or simply a wish to see what is happening on their devices. It is a good fit for small IT teams because detections are explained in plain terms and rollback can undo ransomware damage without restoring from backup.
Compare other EDR, XDR and MDR products, or read more about endpoint security and XDR on our Cloud Security site.
How we help
We deploy and tune EDR, triage detections, isolate and remediate where needed and send you a clear summary of each incident. If you want 24/7 cover, we add ThreatDown MDR to the same endpoints with no reinstall. Contact us for a quote or a pilot.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does ThreatDown EDR add to Endpoint Protection?
Continuous behavioural monitoring with explained detections, network, process and desktop isolation, seven-day ransomware rollback, guided remediation and incident reporting, all on the same agent.
How far back can ThreatDown roll back ransomware?
ThreatDown states that ransomware rollback can restore encrypted, deleted or modified files up to seven days after an attack.
Is ThreatDown EDR licensed per device?
Yes. It is counted per endpoint, with a separate server option, and billed monthly on the endpoints it is enabled on.
Does ThreatDown EDR include 24/7 monitoring?
No. EDR gives you the tools; ThreatDown MDR adds analysts who monitor and respond around the clock.