ThreatDown Endpoint Protection (Malwarebytes for business)

Malwarebytes for business is now ThreatDown

ThreatDown is the brand Malwarebytes introduced in 2023 for its business security products, to separate them from its well-known consumer antivirus. The technology is Malwarebytes', and products are often labelled "ThreatDown, powered by Malwarebytes". Older licences and invoices may still say Malwarebytes Endpoint Protection or Malwarebytes EDR; these are the same product lines under the newer name.

This page covers the business product only. We do not supply Malwarebytes' consumer or home products.

What ThreatDown Endpoint Protection includes

ThreatDown Endpoint Protection is the prevention layer of the ThreatDown range and the foundation of every ThreatDown bundle. ThreatDown describes multiple integrated prevention technologies delivering defence in depth:

• Next-gen antivirus: AI-powered, layered prevention against known and new malware, ransomware and exploits.
• Incident response: automated remediation that removes malware and the artefacts it leaves behind.
• Device control: controls access to USB storage and other peripherals.
• Browser phishing protection: blocks malicious and phishing sites and can remove ads.
• Application Block: stops named applications from launching; through us it is a separate monthly module you can switch on.
• Vulnerability assessment: identifies weaknesses on devices and prioritises them; listed by ThreatDown in its Core bundle.
• AI visibility: shows which AI tools are in use across your devices; also listed in the Core bundle.

How these features are packaged differs between ThreatDown's own bundles and the monthly modules we supply. Our ThreatDown pricing page explains both, and our next-generation antivirus guide explains the techniques in general.

What is the Malwarebytes endpoint agent?

The Malwarebytes endpoint agent (now the ThreatDown endpoint agent) is the single, lightweight piece of software installed on each protected device. Every ThreatDown module, from antivirus to EDR, patching and DNS filtering, runs through that one agent, so adding a module is a policy change rather than another install.

The agent reports to a cloud console. ThreatDown has two:

• Nebula, a single-tenant console for organisations that manage their own security;
• OneView, a multi-tenant console that IT providers use to manage many organisations.

We supply ThreatDown through OneView. Your organisation is a site in our console, and you can be given access to your own site's dashboards. The agent can be deployed through an RMM tool, Microsoft Intune, group policy or a manual installer.

Platforms and servers

ThreatDown Endpoint Protection protects Windows and macOS workstations and laptops and Linux, all from the same console. Servers are licensed separately as Endpoint Protection for Servers, physical or virtual, so workstations and servers appear as separate lines on your invoice.

Phones and tablets are covered by the separate ThreatDown Mobile Security add-on. See server antivirus, Linux antivirus, antivirus for Macs and mobile antivirus for business for how ThreatDown compares with the other vendors we supply on each platform.

Malwarebytes for small business

ThreatDown can suit small and mid-sized organisations that want antivirus with little day-to-day upkeep. The points that tend to matter:

• Low maintenance: one agent, a cloud console and automated remediation mean there is little to look after day to day.
• Mixed estates: Windows, Mac and Linux devices in the same console.
• Monthly usage billing through us: a new laptop appears on the next invoice and a retired one drops off, which suits businesses with seasonal staff, charities and schools.
• Room to grow: EDR, managed detection and response, patching and DNS filtering run on the same agent when you need them.

Endpoint Protection can support the anti-malware option of the Cyber Essentials malware protection control. For a full set of criteria and the other small-business products we supply, see our antivirus for small business guide.

Moving up to EDR and MDR

If your insurer or board is asking for detection and response, ThreatDown EDR adds continuous behavioural monitoring, isolation at network, process or desktop level and ransomware rollback that can restore files encrypted, modified or deleted by ransomware up to seven days back. ThreatDown MDR adds ThreatDown's own analysts, who monitor and respond around the clock; that is ThreatDown's service.

Both run on the same agent as Endpoint Protection. Our EPP vs EDR page explains when antivirus alone is reasonable, and our EDR, XDR and MDR guidance on endpointsecurity.uk covers the detection and response side in depth.

Deploying ThreatDown

A typical move to ThreatDown Endpoint Protection follows four steps:

1. Inventory devices and split them into policy groups, such as office, remote and servers.
2. Remove the existing antivirus, so two products are not competing over the same files.
3. Deploy to a pilot group, review detections and add exclusions for line-of-business software.
4. Roll out to everyone, then switch on optional modules such as Application Block or vulnerability scanning if you want them.

Application Block is worth a look on its own: it can stop unapproved remote access tools, file-sharing clients or games from running. It blocks named applications, which is not the same as the application allow listing option in Cyber Essentials, under which only approved applications may run.

How ThreatDown is licensed through us

If you buy direct from ThreatDown, you buy a bundle priced per device per year. Through Forever Systems the model is different: because we supply you through OneView, each module is switched on per endpoint and billed monthly on what was protected that month. Endpoint Protection, Endpoint Protection for Servers and Application Block are each separate lines, and email security and identity modules are counted per mailbox or user.

We do not publish prices; ask us for a quote. Our ThreatDown pricing page explains the bundles and what drives the cost, and our licensing site covers ThreatDown Endpoint Protection licensing in detail.

How we help

We can count your workstations, servers and mobile devices, agree which modules each group needs, create your site in OneView, remove the old antivirus, deploy the agent and apply tuned policies. Afterwards we can help with exclusions, new devices and module changes, all on one Forever Systems invoice. Already running Malwarebytes or ThreatDown elsewhere? We can move your endpoints into OneView at renewal.

Our sister site explains ThreatDown as a platform. Contact us for a quote.