In short
Cisco antivirus for business is Cisco Secure Endpoint, formerly AMP for Endpoints. One connector combines file reputation and machine learning backed by Cisco Talos, definition-based antivirus, exploit prevention, behavioural and script protection, and keeps watching files after they are allowed. It covers Windows, macOS and Linux, with apps for iOS and Android, and is licensed per endpoint in Essentials, Advantage and Premier editions.
Get a quote for Cisco antivirus
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Does Cisco make antivirus?
Yes. Cisco's antivirus for laptops, desktops and servers is Cisco Secure Endpoint, which Cisco used to sell as AMP for Endpoints (Advanced Malware Protection). Cisco renamed the product, and it is still sold in its own right in Essentials, Advantage and Premier editions. Quotes, renewals and older documents may use either name.
Secure Endpoint is more than a signature scanner. It is next-generation antivirus with endpoint detection and response (EDR) built in, managed from Cisco's cloud console, and its verdicts draw on Cisco Talos, Cisco's threat intelligence organisation. Cisco also sells email and network security that inspects files in transit; this page is about protection installed on each device.
For the full product, our Cisco specialist site covers Cisco Secure Endpoint in depth. Our guide to next-generation antivirus explains how techniques such as machine learning and behaviour monitoring differ from signature-based antivirus across vendors.
How Cisco Secure Endpoint stops malware
Cisco's data sheet lists several prevention engines, which you switch on by policy and can run in audit mode first:
| Engine | What it does |
|---|---|
| File reputation | Checks files against Cisco's cloud intelligence, backed by Talos, before they run |
| Antivirus engine | Definition-based detection on Windows, Mac and Linux, which also helps when a device is offline |
| Machine learning analysis | Identifies malicious files that have never been seen before |
| Polymorphic malware detection | Catches variants of known malware that change their appearance to avoid signatures |
| Exploit prevention | Protects applications against attempts to exploit vulnerabilities, including fileless techniques |
| Behavioural protection | Stops activity that matches attacker behaviour, such as abuse of tools already on the machine |
| Script protection | Blocks malicious scripts |
Engine availability varies by operating system, and Windows has the fullest set. We review policies against Cisco's current release notes before moving devices from audit to protect mode.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Retrospective detection: why it is more than antivirus
Traditional antivirus makes one decision when a file arrives. Secure Endpoint keeps watching. The connector records file, process and network activity after a file has been allowed, so if Cisco later judges that file malicious, Secure Endpoint can show every device it reached and quarantine it there. Cisco calls this retrospective security.
Two views make that practical for a small IT team:
- File trajectory: where else in your estate the same file appeared
- Device trajectory: a timeline of what ran on a device, what it created and where it connected
Together with one-click endpoint isolation, included in every edition, this means a business buying Cisco for antivirus already has the basics of detection and response on the same agent. Our EPP vs EDR guide explains when you need more than that.
Platforms and management
Cisco lists connectors for Windows, macOS and Linux, with apps for iOS and Android. Feature coverage differs by platform, with the fullest set on Windows, so we check your operating system versions against Cisco's current compatibility list before quoting.
Secure Endpoint is managed from Cisco's cloud console, with nothing to host. Organisations that cannot use the public cloud console can use Secure Endpoint Virtual Private Cloud, Cisco's private cloud option. The connector can be deployed with the software distribution tools you already use, such as Microsoft Intune.
If you have Macs, servers or Linux machines in the estate, our guides to antivirus for Macs, server antivirus and Linux antivirus compare coverage across the vendors we supply.
Is Cisco antivirus the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Editions at a glance
Every edition uses the same connector; the licence decides which features are switched on. This table follows Cisco's current licensing comparison:
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| Next-generation endpoint protection | Yes | Yes | Yes |
| Continuous monitoring and dynamic file analysis | Yes | Yes | Yes |
| Endpoint isolation | Yes | Yes | Yes |
| Device control for USB mass storage | Yes | Yes | Yes |
| Host Firewall, managed centrally | - | Yes | Yes |
| Orbital Advanced Search and Remote Scripts | - | Yes | Yes |
| Malware Analytics Cloud and risk-based vulnerability framework | - | Yes | Yes |
| Threat Hunting by Cisco Talos | - | - | Yes |
So the antivirus layer is the same in every edition. Essentials suits organisations that mainly want strong prevention with isolation and device control. Advantage adds a centrally managed host firewall and live investigation tools, and Premier adds Talos's hunters looking for attacker activity in your telemetry. Edition detail is on our Cisco site's Cisco Secure Endpoint cost page.
How Cisco Secure Endpoint is licensed
Cisco licenses Secure Endpoint on the number of endpoints, which Cisco's terms define broadly as devices that process data and connect to a network, including computers and mobile devices. Count laptops, desktops, servers and any virtual desktops before you compare quotes.
You can buy Secure Endpoint on its own, or as part of a Cisco security suite: Cisco lists it in the User Protection Suite and the Breach Protection Suite, which bundle it with Cisco's identity, email or XDR products. Through Forever Systems, Cisco can be billed monthly, with terms confirmed at quote. Ask us for a quote, and see our guide to business antivirus cost for what drives cost across vendors.
Cisco, Microsoft Defender and detection and response
Many organisations comparing Cisco already have Microsoft Defender Antivirus on Windows. Secure Endpoint is a full antivirus and EDR product, so most organisations retire the previous antivirus once the connector is in protect mode. If you would rather keep Microsoft Defender for Endpoint, Cisco XDR can take its alerts alongside other tools, including CrowdStrike and SentinelOne. Our page on whether Windows Defender is enough covers the general question.
For detection and response in depth, including Cisco XDR and Cisco's managed services, see our sister site's EDR, XDR and MDR guidance and our Cisco site's guide to Cisco XDR. Cisco's malware protection also supports the malware protection control in Cyber Essentials.
How we help
We can count your endpoints, recommend an edition or suite, deploy the connector in audit mode first, tune exclusions for your line-of-business software, remove your old antivirus and handle additions, upgrades and renewals on your Forever Systems account. If you are weighing Cisco against other vendors, see our endpoint protection vendors page, including Check Point antivirus and Sophos antivirus.
Contact us with your device count and the operating systems you run.
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, Check Point, Trend Micro (TrendAI), Bitdefender, Sophos, Cisco, ThreatDown, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
Does Cisco have antivirus?
Yes. Cisco's business antivirus is Cisco Secure Endpoint, formerly AMP for Endpoints. It combines file reputation, machine learning, definition-based antivirus, exploit prevention and behavioural protection in one connector, with EDR built in.
Is Cisco AMP for Endpoints the same as Cisco Secure Endpoint?
Yes. Cisco renamed AMP for Endpoints to Cisco Secure Endpoint. It is still sold as its own product, in Essentials, Advantage and Premier editions, so older quotes may use either name.
Which platforms does Cisco Secure Endpoint support?
Cisco lists Windows, macOS and Linux connectors, with apps for iOS and Android. Feature support varies by platform, so we check your estate against Cisco's current compatibility list.
Does Cisco Secure Endpoint work offline?
Yes. Alongside its cloud lookups, Cisco lists a definition-based antivirus engine for Windows, Mac and Linux, which helps protect devices that are offline.
How is Cisco Secure Endpoint licensed?
Cisco licenses it on the number of endpoints, by edition, either on its own or within the User Protection Suite or Breach Protection Suite. Through us it can be billed monthly, with terms confirmed at quote.
How much does Cisco antivirus cost?
It depends on the number of endpoints, the edition and whether you buy it alone or in a suite. Ask us for a quote and we will recommend the edition that fits.
Still have a question about Cisco antivirus?
Ask us and a member of our team will reply by email.
More endpoint protection guides
Check PointCheck Point antivirus on laptops, desktops and servers: the anti-malware engine in Check Point's endpoint agent.
SophosSophos antivirus for business: Sophos Endpoint's protection layers, servers and Linux, and how it is licensed.
CrowdStrikeIs CrowdStrike an antivirus? Falcon Prevent next-gen antivirus, the bundles we supply and how it is licensed.EPP vs EDRThe difference between endpoint protection (EPP) and EDR, which products bundle both, and when EPP alone is reasonable.Server antivirusWhy Windows servers need their own antivirus licence and careful exclusions.Vendors comparedThe endpoint protection vendors we supply compared on platforms, licence unit, EDR upgrade path and managed options.