In short: ThreatDown OneView is the multi-tenant management console that IT providers use to run Malwarebytes business security across many organisations. It manages endpoint protection, EDR, MDR, threat hunting, vulnerability and patch management, DNS filtering and application blocking from one agent. Through Forever Systems, modules are enabled per endpoint and billed monthly on usage.
What OneView is
OneView is ThreatDown's console for IT providers. Where Nebula manages one organisation, OneView manages many: each customer is a site with its own policies, endpoints, dashboards and reports, and the provider sees every site from one place.
For you, that means your security is delivered the same way as an organisation buying direct from ThreatDown, using the same agent and the same Malwarebytes detection technology, but configured, watched and billed by us. OneView also has a customer sign-in, so you can be given access to your own site to view devices, detections and reports.
OneView runs entirely in the cloud. There is no management server to install, and the agent deploys without a reboot.
What OneView manages
| Module | What it adds | Product page |
|---|---|---|
| Endpoint Protection | Next-gen antivirus, device control and browser phishing protection | Endpoint Protection |
| EDR | Behavioural detection, isolation and ransomware rollback | ThreatDown EDR |
| MDR and Managed Threat Hunting | ThreatDown analysts monitoring, hunting and responding around the clock | ThreatDown MDR |
| Incident Response | Automated remediation of malware and its leftover artefacts | Endpoint Protection |
| Vulnerability Management and Patch Management | Finds vulnerable applications and deploys updates | Vulnerability and Patch Management |
| DNS Filtering | Category-based web blocking at DNS level | DNS Filtering |
| Application Block | Stops named applications launching | Endpoint Protection |
| Mobile Security, Email Security, ITDR | Protection for mobile devices, mailboxes and identities | Mobile Security, Email Security, ITDR |
Every module uses the same agent, so adding one is a policy change rather than a new rollout.
How OneView licensing works
| Item | How it works |
|---|---|
| Unit | Each endpoint a module is enabled on (users or mailboxes for email security and identity protection) |
| Billing | Monthly, on the usage recorded in the console for that month |
| Mix and match | Modules are enabled per site or per policy, so servers and laptops can have different coverage |
| Server endpoints | Endpoint Protection and EDR for servers are counted separately from workstations |
| Changes | New devices are picked up automatically; retired devices drop off the next invoice |
OneView keeps per-site usage reports, invoice history and an audit log of billing changes, which is how we keep your invoice matched to what is actually protected. Prices depend on the number of endpoints and the modules you choose, so ask us for a quote.
Requirements and deployment
The ThreatDown agent supports Windows workstations and servers, macOS and Linux, with Chromebooks, iOS and Android covered by Mobile Security. Deployment options include your RMM tool, Microsoft Intune, Group Policy, a command-line installer or a download link.
A typical move to OneView:
- We create your site and policy groups, for example office laptops, remote staff and servers.
- Existing antivirus is removed, or left in place temporarily where MDR runs alongside it.
- The agent is deployed in waves, starting with a pilot group.
- Modules are switched on per group and alert routing is set up to our team.
If you already run ThreatDown on Nebula, we check during scoping whether your existing agents can be moved across or need reinstalling.
Who it suits and how we help
OneView suits organisations that want ThreatDown's protection without running the console themselves, and those whose device numbers change through the year: schools, charities, professional services firms and multi-site businesses. Monthly usage billing means you pay for the endpoints you have, not a quantity guessed at renewal.
We run the console, tune policies, investigate detections, approve patches and add modules as your needs change. You get regular summaries of what was detected, which vulnerabilities were fixed and which devices have stopped reporting. Contact us for a quote or a pilot on a handful of devices.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is ThreatDown OneView?
OneView is ThreatDown's multi-tenant cloud console for IT providers. It manages Malwarebytes business security for many organisations, each as a separate site with its own policies and reports.
Can I see my own devices in OneView?
Yes. We can give you access to your own site so you can view endpoints, detections and reports while we manage it.
Is OneView billed per endpoint?
Yes for the endpoint modules: each one is counted on the endpoints it is enabled on and billed monthly on actual usage. Email security and identity protection are counted on the users or mailboxes covered.
Do I need OneView to buy ThreatDown from you?
Yes. OneView is how we deliver and manage ThreatDown for our customers, and it is what makes monthly usage billing possible.