In short
WatchGuard Endpoint Security modules add features to an Endpoint Security edition and are licensed per endpoint. Patch Management and Full Encryption work with every edition; Advanced Reporting Tool, Data Control and Orion need 360, Elite or WatchGuard EDR; 1-Year Data Retention needs Prime, 360 or Elite. Patch Management, Full Encryption, Advanced Reporting Tool and SIEMFeeder can be billed monthly; the others are confirmed at quote.
Get a quote for WatchGuard Endpoint Security modules licensing
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What the modules add
WatchGuard Endpoint Security modules extend an Endpoint Security edition with extra features, from patching and disk encryption to reporting, personal data discovery, threat hunting and longer data retention. They are managed in WatchGuard Cloud from the same console and agent as the edition itself, so adding a module is a licence change rather than a new deployment. This page covers how the modules are licensed; for a fuller product guide see WatchGuard Endpoint Security on endpointprotection.uk (opens in a new tab).
To use a module you need an existing Endpoint Security licence: Basic, Prime, 360, Elite or WatchGuard EDR. WatchGuard EDR Core, which comes with the Firebox Total Security Suite, does not support modules. Which modules you can add depends on the edition, as the table below shows.
Modules by edition
WatchGuard publishes which modules work with which edition. This table follows its modules overview:
| Module | What it does | Available with |
|---|---|---|
| Patch Management | Manages operating system and third-party application vulnerabilities on workstations and servers | Basic, 360, Elite and WatchGuard EDR |
| Full Encryption | Encrypts disks and USB or removable drives and stores recovery keys centrally | Basic, 360, Elite and WatchGuard EDR |
| Advanced Reporting Tool | Security intelligence and IT insights, with configurable reports on 12 months of history | 360, Elite and WatchGuard EDR |
| Data Control | Discovers, classifies and monitors personal and sensitive data on endpoints and servers | 360, Elite and WatchGuard EDR, in selected countries |
| 1-Year Data Retention | Extends the data retention period for your endpoints to 365 days | Prime, 360 and Elite |
| Orion | LLM-powered investigations, threat hunting and deep telemetry analysis | 360, Elite and WatchGuard EDR |
| SIEMFeeder | Sends the security context of processes on your devices to your SIEM | Confirmed at quote |
| Core MDR | WatchGuard's 24/7 managed detection and response service, licensed as a module | 360, Elite and WatchGuard EDR; WatchGuard's MDR licensing also lists Prime |
Endpoint Security Basic takes the two hygiene modules, Patch Management and Full Encryption. The investigation modules need an edition with EDR.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Patch Management and Full Encryption
Patch Management finds missing operating system and third-party application updates on Windows, macOS and Linux devices and deploys them from WatchGuard Cloud. Keeping software updated is one of the five Cyber Essentials controls, so it is often the first module organisations add.
Full Encryption encrypts Windows and macOS devices and keeps recovery keys in WatchGuard Cloud. Both are licensed per endpoint, so you can cover every device with Patch Management and only laptops with Full Encryption.
Reporting, investigation and data retention
- Advanced Reporting Tool: configurable reports and dashboards built on 12 months of historical endpoint data, to spot attacks, unusual behaviour and internal misuse
- Orion: LLM-powered investigations, advanced threat hunting and deep telemetry analysis for security operations teams
- 1-Year Data Retention: keeps endpoint data for 365 days, for longer look-backs during an investigation
- SIEMFeeder: sends the security events and process context from your devices into your existing SIEM
If you would rather have WatchGuard's analysts do the investigating, compare WatchGuard MDR licensing.
Is WatchGuard Endpoint Security modules licensing the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Data Control
Data Control discovers and classifies personal and confidential information on endpoints and servers. WatchGuard offers it only in selected countries and with WatchGuard EDR, Endpoint Security 360 or Endpoint Security Elite, so we confirm availability and the licence for your organisation at quote.
How WatchGuard Endpoint Security modules licensing works
Endpoint Security products and modules are licensed per endpoint. Each module uses one licence for each endpoint it covers, so you can add Patch Management to every device and Full Encryption only to laptops, for example.
WatchGuard offers term licences for a set number of endpoints and duration and subscription licences billed monthly on the endpoints you have allocated. On the monthly MSP route the one Endpoint Security subscription (WTG-ZDS-EPS-C100) covers Advanced Reporting Tool, Patch Management, Full Encryption and SIEMFeeder alongside the Basic and 360 editions, billed on the endpoints allocated, with terms confirmed at quote. Data Control, Orion and 1-Year Data Retention are confirmed at quote. Ask us for a quote for your device count and the modules you need.
Vendor documentation: WatchGuard: Endpoint Security modules overview (opens in a new tab); WatchGuard: Patch Management (opens in a new tab); WatchGuard: Orion (opens in a new tab).
WatchGuard Endpoint Security module part numbers
Modules do not have separate codes on the monthly MSP route: you add them to the one Endpoint Security subscription in WatchGuard Cloud and each is billed on the endpoints it covers. Term licences for individual modules, Orion and 1-Year Data Retention are quoted on request.
| Part number | Description | Unit | Term | Route | Basket |
|---|---|---|---|---|---|
| WTG-ZDS-EPS-C100 | Endpoint Security subscription (modules billed per endpoint) | Per endpoint | Monthly, on usage | Monthly MSP |
Part numbers from WatchGuard: Endpoint Security modules overview (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.
How we help
Forever Systems can recommend the modules that fit your edition, enable them in WatchGuard Cloud, set up patch and encryption policies and add or remove module licences as your device count changes, all on one account and one invoice. See also endpoint protection.
How Forever Systems supplies your software licences
Forever Systems supplies business software subscriptions to UK organisations from one account, with one invoice and a team who know the products.
- Help choosing the right edition: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from our engineers, not just a reseller account
- Consolidated billing and renewal reminders to help stop subscriptions lapsing unexpectedly
We can supply businesses, schools, charities and public sector organisations of all sizes.
Frequently asked questions
Which WatchGuard modules work with Endpoint Security Basic?
Patch Management and Full Encryption. Advanced Reporting Tool, Data Control and Orion need Endpoint Security 360, Endpoint Security Elite or WatchGuard EDR, and 1-Year Data Retention needs Prime, 360 or Elite.
Are WatchGuard Endpoint Security modules licensed per endpoint?
Yes. Each module uses one licence for each endpoint it covers, on top of the edition licence for that endpoint.
Can I add modules to WatchGuard EDR Core?
No. EDR Core, which comes with the Firebox Total Security Suite, does not support modules. Moving to an Endpoint Security edition opens up the modules.
Can modules be billed monthly?
Patch Management, Full Encryption, Advanced Reporting Tool and SIEMFeeder can, as part of the monthly Endpoint Security subscription, billed on the endpoints allocated, with terms confirmed at quote. Data Control, Orion and 1-Year Data Retention are confirmed at quote, and term licences are also available.
Still have a question about WatchGuard Endpoint Security modules licensing?
Ask us and a member of our team will get back to you.
More software and licensing guides
Endpoint SecurityEndpoint protection and EDR per endpoint: Basic, Prime, 360 and Elite.MDR24/7 managed detection and response: Core, Core for Microsoft, Total and Open MDR.Zero Trust BundleAuthPoint MFA, Endpoint Security 360 and FireCloud Total Access, licensed per user.Endpoint protectionNext-generation antivirus for laptops, desktops and servers.