In short
WatchGuard Endpoint Security is WatchGuard's endpoint protection range, built on Panda Security technology and managed in WatchGuard Cloud. Since April 2026 it comes in four editions: Basic (formerly EPP), Prime (new), 360 (formerly EPDR) and Elite (formerly Advanced EPDR). Each edition adds to the one below, and it is licensed per endpoint.
Get a quote for WatchGuard Endpoint Security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What WatchGuard Endpoint Security is
WatchGuard Endpoint Security is the name WatchGuard now uses for its whole endpoint protection range. It protects laptops, desktops, servers and mobile devices with one lightweight agent, managed from WatchGuard Cloud, the same cloud console WatchGuard uses for its Firebox firewalls, AuthPoint MFA and Wi-Fi. There is no management server to build or patch.
The technology comes from Panda Security, which WatchGuard acquired. That is why many people still search for Panda product names, and why older invoices may say Panda Adaptive Defense 360, WatchGuard EPP or WatchGuard EPDR. Endpoint detections also feed ThreatSync, WatchGuard's XDR layer, where they are correlated with what other WatchGuard products see.
In April 2026 WatchGuard reorganised the range into four editions. Three are renames of products you may already have; one, Prime, is genuinely new. If you just want to know what your EPDR renewal is now called, see WatchGuard Endpoint Security 360.
Old names and new names
Existing agents and policies carry on working through the rename. The new names appear in WatchGuard Cloud and on your next renewal.
| Current edition | Formerly | In one line |
|---|---|---|
| Endpoint Security Basic | WatchGuard EPP | Prevention-focused protection: AI-based malware and ransomware blocking with automatic clean-up |
| Endpoint Security Prime | New edition | Adds detection and response: anti-exploit, isolation, root cause analysis and MDR compatibility |
| Endpoint Security 360 | WatchGuard EPDR (and before that Panda Adaptive Defense 360) | Adds the Zero-Trust Application Service and lateral movement containment |
| Endpoint Security Elite | WatchGuard Advanced EPDR | Adds advanced investigation tools for in-depth incident work |
WatchGuard also still sells WatchGuard EDR on its own, and EDR Core comes with the Firebox Total Security Suite for a limited number of endpoints. Both were left unchanged by the April 2026 renaming.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Editions compared
WatchGuard publishes one comparison table for the four editions. Each edition includes everything in the one to its left.
| Capability | Basic | Prime | 360 | Elite |
|---|---|---|---|---|
| Attack surface reduction | Yes | Yes | Yes | Yes |
| Malware and ransomware protection | Yes | Yes | Yes | Yes |
| AI-powered behavioural threat detection | Yes | Yes | Yes | Yes |
| Anti-exploit detections | - | Yes | Yes | Yes |
| Endpoint isolation and response | - | Yes | Yes | Yes |
| MITRE ATT&CK-mapped alerts and root cause analysis | - | Yes | Yes | Yes |
| ThreatSync XDR remediations | - | Yes | Yes | Yes |
| Compatible with WatchGuard MDR | - | Yes | Yes | Yes |
| Zero-Trust Application Service | - | - | Yes | Yes |
| Lateral movement detection and containment | - | - | Yes | Yes |
| Advanced investigation tools | - | - | - | Yes |
Basic is the antivirus replacement: WatchGuard describes it as prevention-focused protection that uses AI-driven malware detection and behavioural analysis to block malware, ransomware, malicious scripts and exploits, then blocks, isolates and cleans up threats automatically. Prime adds the detection and response layer. 360 adds deny-by-default application control. Elite adds the investigation depth that security teams, or providers working on their behalf, use when they dig into an incident: interactive timelines, process trees, lateral movement maps, natural-language searching of telemetry, granular policy controls and remote shell access to affected endpoints.
Which edition suits which business
There is no single right answer, but these are the questions we ask:
- Do you mainly need antivirus that runs quietly? Basic is aimed at organisations that want strong prevention with little day-to-day administration. It is the natural replacement for a traditional antivirus product.
- Do you want to see and respond to incidents, or add a managed service later? Prime adds isolation, MITRE ATT&CK-mapped alerts and root cause analysis, and it is the first edition that works with WatchGuard's MDR service.
- Do you want only approved software to run? 360 adds the Zero-Trust Application Service, which blocks applications by default until they are classified as safe, so unknown ransomware and attack tools have a harder time getting started.
- Does someone investigate incidents in depth? Elite is designed for security teams and providers who need deep telemetry and investigation tools.
If you are not sure whether you need detection and response at all, our guide to EPP vs EDR sets out the difference from a buyer's point of view, and our EDR, XDR and MDR guidance on endpointsecurity.uk goes further.
Is WatchGuard Endpoint Security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Optional modules
Modules are licensed per endpoint on top of an edition. Which ones you can add depends on the edition:
| Module | What it does | Available with |
|---|---|---|
| Patch Management | Finds and deploys missing operating system and third-party application patches | All four editions and WatchGuard EDR |
| Full Encryption | Encrypts drives with Microsoft BitLocker, with central key recovery | All four editions and WatchGuard EDR |
| Advanced Reporting Tool | Custom reports, dashboards and longer data retention for endpoint activity | Prime, 360, Elite and WatchGuard EDR |
| Data Control | Discovers, classifies and monitors personal data on Windows endpoints, in selected European countries | Prime, 360, Elite and WatchGuard EDR |
| SIEMFeeder | Sends endpoint security events to your SIEM | Prime, 360, Elite and WatchGuard EDR |
| Core MDR | WatchGuard's managed detection and response service, run by WatchGuard | Prime, 360, Elite and WatchGuard EDR |
Modules are not available with EDR Core. Patch Management is a natural first addition, because keeping software up to date is one of the five Cyber Essentials controls and the endpoint agent is already in place.
Platforms and deployment
The WatchGuard agent installs on Windows and macOS (Intel and Apple silicon) and on Linux workstations and servers, and WatchGuard Endpoint Security also protects Android and iOS devices. Not every feature or module is available on every platform, so we check your estate against WatchGuard's current support list before quoting.
Deployment is by installer, group policy or your device management tool, or remotely to unprotected computers WatchGuard finds on the network. Because everything is managed from WatchGuard Cloud, policies follow devices wherever they are. If you run Macs, our guide to antivirus for Macs in business covers the wider picture, and our server antivirus guide covers servers.
How WatchGuard Endpoint Security is licensed
WatchGuard Endpoint Security is licensed per endpoint: each protected computer, server or mobile device uses one licence of your chosen edition, and each module uses one licence per endpoint it covers. The edition licence includes protection for a limited share of servers; if servers make up more than a tenth of your endpoints, WatchGuard requires an additional server licence for the extra ones.
WatchGuard offers term licences for a set number of endpoints and subscription licences billed monthly on the endpoints you have allocated. A WatchGuard Cloud account for a single organisation holds one edition at a time, so plan on one edition across your devices; moving up later is a licence change. Our licensing site explains WatchGuard Endpoint Security licensing in more detail, and our guide to business antivirus cost explains what drives the price across vendors. For a quote, ask us: we do not publish prices.
How we help
We can recommend an edition and modules for your estate, arrange the licences, deploy the agent, remove your old antivirus and build sensible policies, then handle additions, upgrades and renewals on your Forever Systems account. If you are comparing WatchGuard with other vendors, our endpoint protection vendors page sets out the options side by side.
Contact us with your device count, the operating systems you run and what your current renewal says.
More on WatchGuard Endpoint Security
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro, Sophos, Check Point, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
What are the WatchGuard Endpoint Security editions?
Since April 2026 there are four: Endpoint Security Basic (formerly EPP), Prime (a new edition), 360 (formerly EPDR) and Elite (formerly Advanced EPDR). Each adds to the one below. WatchGuard EDR and EDR Core continue unchanged alongside them.
What is the difference between WatchGuard Endpoint Security Basic and Prime?
Basic is prevention-focused: AI-based malware and ransomware protection, behavioural detection and automatic clean-up. Prime adds detection and response: anti-exploit detections, endpoint isolation, MITRE ATT&CK-mapped alerts with root cause analysis, ThreatSync XDR remediations and compatibility with WatchGuard MDR.
What is the difference between WatchGuard EPP and EPDR?
EPP, now Endpoint Security Basic, is prevention-focused protection: AI-based malware and ransomware blocking, behavioural detection and automatic clean-up. EPDR, now Endpoint Security 360, adds detection and response, the Zero-Trust Application Service and lateral movement containment. The new Prime edition sits between them, with detection and response but no deny-by-default application control.
Is WatchGuard Endpoint Security the same as Panda?
It is built on Panda Security technology, which WatchGuard acquired. Panda Adaptive Defense 360 became WatchGuard EPDR and is now WatchGuard Endpoint Security 360. Existing agents carry on working through the renames.
Does WatchGuard Endpoint Security need a Firebox?
No. Endpoint Security works on its own from WatchGuard Cloud. If you also have Fireboxes, detections can be correlated in ThreatSync.
Is WatchGuard Endpoint Security licensed per user or per device?
Per endpoint. Each protected computer, server or mobile device needs a licence of the chosen edition, and WatchGuard requires extra server licences if servers are more than a tenth of your endpoints. Ask us for a quote.
Still have a question about WatchGuard Endpoint Security?
Ask us and a member of our team will reply by email.
More endpoint protection guides
SophosSophos antivirus for business: Sophos Endpoint's protection layers, servers and Linux, and how it is licensed.
Check PointCheck Point antivirus on laptops, desktops and servers: the anti-malware engine in Check Point's endpoint agent.EPP vs EDRThe difference between endpoint protection (EPP) and EDR, which products bundle both, and when EPP alone is reasonable.Vendors comparedThe endpoint protection vendors we supply compared on platforms, licence unit, EDR upgrade path and managed options.