In short: ThreatDown Endpoint Protection is Malwarebytes' business next-gen antivirus for Windows, macOS and Linux. Layered, AI-based prevention blocks malware, ransomware and exploits, with device control for USB peripherals, browser phishing protection and automated remediation. Through Forever Systems it is licensed per endpoint, with separate server licences, and billed monthly from our OneView console.
What ThreatDown Endpoint Protection is
Endpoint Protection is ThreatDown's prevention layer: the next-generation antivirus (NGAV) that stops malware, ransomware and exploits from running on your devices. It is the foundation of every ThreatDown bundle and the module most organisations start with.
Its prevention layers include signatureless payload analysis, behaviour-based blocking, exploit protection and web protection, all in one lightweight agent that reports to a cloud console. Through Forever Systems that console is ThreatDown OneView, so we manage your policies, exclusions and detections for you.
Older licences and invoices may call it Malwarebytes Endpoint Protection; the product is the same line under the ThreatDown name.
What is included
| Capability | What it does |
|---|---|
| Next-gen antivirus | Layered, AI-based prevention against known and new malware and ransomware |
| Incident response | Automated remediation that removes malware and the artefacts it leaves behind |
| Device control | Controls access to USB storage and other peripherals |
| Browser phishing protection | Blocks phishing and malicious sites, drive-by downloads, unwanted ads and tracking scripts |
| Cloud console | Policies, alerts, quarantine and reports in OneView |
Ransomware rollback and behavioural detection with isolation come with ThreatDown EDR, and vulnerability scanning and patching with Vulnerability and Patch Management. Both add to Endpoint Protection on the same agent.
Options and how it is licensed
| Option | What it covers | Unit |
|---|---|---|
| Endpoint Protection | Windows and macOS workstations and laptops, and Linux | Endpoint, monthly |
| Endpoint Protection for Servers | Servers, physical or virtual | Server endpoint, monthly |
| Application Block | Blocks named applications from launching, for security, productivity or compliance | Endpoint, monthly add-on |
| Incident Response | Automated remediation of malware and its leftover artefacts, as a standalone module | Endpoint, monthly |
Each option is switched on per endpoint in OneView and billed monthly on usage, so a new laptop simply appears on the next invoice and a retired server drops off. There are no licence keys to track. Prices depend on the number of endpoints and the modules you choose, so ask us for a quote.
Application Block deserves a mention: it lets us stop specific applications from running, such as unapproved remote access tools, games or file-sharing clients, and its blocking reports can be used as evidence for cyber insurance questionnaires and policy audits.
Requirements and deployment
The agent runs on supported Windows, macOS and Linux versions and, ThreatDown says, deploys without a reboot. It can be installed through an RMM tool, Microsoft Intune, Group Policy or a command-line installer.
Our usual rollout:
- Inventory devices and split them into policy groups (office, remote, servers).
- Remove the existing antivirus so two products are not fighting over the same files.
- Deploy to a pilot group, review detections and add exclusions for line-of-business software.
- Roll out to everyone, then enable Application Block and vulnerability scanning if wanted.
Endpoint Protection supports the malware protection control in Cyber Essentials, and Application Block can help enforce the requirement to run only approved software.
Who it suits
Endpoint Protection suits small and mid-sized organisations that want straightforward, low-maintenance antivirus with central management, including mixed Windows and Mac estates. Monthly usage billing copes well with devices coming and going, which suits schools, charities and businesses with seasonal staff.
If your insurer or board is asking for detection and response, or you want someone watching alerts overnight, step up to ThreatDown EDR or ThreatDown MDR. Compare other endpoint protection products on this site.
How we help
We scope your estate, remove the old product, deploy and tune ThreatDown and then run it: investigating detections, managing exclusions and keeping device counts accurate so your invoice matches reality. Contact us for a quote or a trial on a few devices.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is ThreatDown Endpoint Protection the same as Malwarebytes Endpoint Protection?
Yes. ThreatDown is Malwarebytes' business brand, and ThreatDown Endpoint Protection is the same product line under the newer name, managed from the same kind of cloud console.
Does ThreatDown Endpoint Protection include ransomware rollback?
No. Ransomware rollback is part of ThreatDown EDR, which runs on the same agent and can be added at any time.
Are servers licensed separately?
Yes. Endpoint Protection for Servers is a separate option counted per server endpoint, so workstations and servers each have their own line on your invoice.
Can Application Block be added on its own?
Yes. Application Block is a separate module we can enable on any endpoint running the ThreatDown agent.
Does it work on Macs?
Yes. The agent supports macOS as well as Windows and Linux, all managed from the same console.