In short: WatchGuard Endpoint Security comes in four editions licensed per endpoint. Basic (formerly EPP) is prevention-focused protection; Prime adds EDR with isolation, root cause analysis and MDR compatibility; 360 (formerly EPDR) adds the Zero-Trust Application Service and lateral movement containment; Elite (formerly Advanced EPDR) adds advanced investigation tools. Modules cost extra.
What WatchGuard Endpoint Security is
WatchGuard Endpoint Security protects laptops, desktops, servers and mobile devices with one lightweight agent managed from WatchGuard Cloud. The technology comes from Panda Security, which WatchGuard acquired, and it is a core part of WatchGuard's Unified Security Platform: endpoint detections feed ThreatSync, where they are correlated with what your Firebox and other WatchGuard products see.
WatchGuard reorganised the range into four editions in April 2026. If your renewal says EPP, EPDR or Advanced EPDR, the table below shows the current equivalent.
Editions compared
Each edition includes everything in the one above it.
| Edition | Formerly | What it adds |
|---|---|---|
| Endpoint Security Basic | WatchGuard EPP | Attack surface reduction, malware and ransomware protection, AI-based behavioural detection, automatic blocking and clean-up |
| Endpoint Security Prime | New edition | Anti-exploit detection, endpoint isolation and response, MITRE ATT&CK-mapped alerts with root cause analysis, ThreatSync XDR remediation, compatibility with WatchGuard MDR |
| Endpoint Security 360 | WatchGuard EPDR | Zero-Trust Application Service, which blocks applications by default until they are classified as safe, plus lateral movement detection and containment |
| Endpoint Security Elite | WatchGuard Advanced EPDR | Advanced investigation tools: correlated attack timelines and process trees, natural-language searching of telemetry, advanced policy enforcement and remote access to affected endpoints |
WatchGuard still sells WatchGuard EDR on its own, and EDR Core comes with the Firebox Total Security Suite for a limited number of endpoints. Both were left unchanged by the April 2026 renaming.
Optional modules
Modules are licensed per endpoint on top of an edition, and which ones you can add depends on the edition:
| Module | What it does | Available with |
|---|---|---|
| Patch Management | Finds and deploys missing patches for Windows, macOS and Linux and many third-party applications | All four editions and WatchGuard EDR |
| Full Encryption | Encrypts drives with Microsoft BitLocker, with pre-boot authentication and central key recovery | All four editions and WatchGuard EDR |
| Advanced Reporting Tool | Custom reports, dashboards and longer data retention for endpoint activity | Prime, 360, Elite and WatchGuard EDR |
| Data Control | Discovers, classifies and monitors personal data on Windows endpoints, offered in selected European countries | Prime, 360, Elite and WatchGuard EDR |
| SIEMFeeder | Sends endpoint security events to your SIEM | Prime, 360, Elite and WatchGuard EDR |
| Core MDR | WatchGuard's 24/7 managed detection and response service | Prime, 360, Elite and WatchGuard EDR |
Modules are not available with EDR Core. Patch Management is a natural first addition, because keeping software updated is one of the five Cyber Essentials controls.
How it is licensed
WatchGuard Endpoint Security is licensed per endpoint: each protected computer, server or mobile device uses one licence of your chosen edition, and each module uses one licence per endpoint it covers. The licence includes protection for a limited share of servers; if servers make up more than a tenth of your endpoints, WatchGuard requires an additional Endpoint Security for Servers licence for the extra ones.
WatchGuard offers term licences for a set number of endpoints and subscription licences billed monthly on the endpoints you have allocated. A WatchGuard Cloud account for a single organisation holds one edition licence at a time, so plan on one edition for all your devices; moving up later is a licence change that we arrange. Ask us for a quote for your device count and preferred edition.
Requirements and deployment
The WatchGuard agent installs on Windows and macOS (Intel and ARM) and on Linux workstations and servers, and protects Android and iOS devices; not every feature or module is available on every platform. Deployment is by installer, group policy or your device management tool, or remotely to unprotected computers found on the network. There is no management server to build: everything runs from WatchGuard Cloud.
Who it suits and how we help
Basic suits small organisations that want strong prevention with little administration. Prime suits teams that want EDR visibility and the option of MDR. 360 suits organisations that want deny-by-default application control on top, and Elite suits teams, or providers on their behalf, who investigate incidents in depth. We recommend an edition, deploy the agent, remove the old product, build policies and handle licence changes. See also endpoint protection.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is WatchGuard EPDR called now?
WatchGuard EPDR is now Endpoint Security 360, Advanced EPDR is now Endpoint Security Elite and EPP is now Endpoint Security Basic. The new names have applied since April 2026, and existing agents carry on working.
What is the difference between Endpoint Security Prime and 360?
Prime adds EDR to Basic: anti-exploit detection, isolation and response, MITRE ATT&CK-mapped alerts and root cause analysis. 360 adds the Zero-Trust Application Service, which blocks applications until they are classified as safe, and lateral movement containment.
Does WatchGuard Endpoint Security include patch management?
Not by default. Patch Management is an optional module licensed per endpoint, available with every edition. Full Encryption is the same; Advanced Reporting Tool, Data Control, SIEMFeeder and Core MDR need Prime or above.
Is WatchGuard Endpoint Security licensed per user or per device?
Per endpoint. Each protected computer, server or mobile device needs a licence of the chosen edition, with a separate server licence if servers exceed a tenth of your endpoints.
Can I add 24/7 monitoring later?
Yes. WatchGuard Core MDR is licensed as an Endpoint Security module and can be added to Prime, 360 or Elite, covering the same number of endpoints as your edition licence.