WatchGuard Endpoint Security is a managed service in WatchGuard Cloud that helps you protect IT assets. With WatchGuard Endpoint Security, you can review detected security problems and develop prevention and response plans for unknown and advanced persistent threats (APTs).
From WatchGuard Cloud, you can access the WatchGuard Endpoint Security products:
WatchGuard Endpoint Protection Platform (EPP)
WatchGuard EPP protects endpoints from threats and reduces the attack surface. It prevents, detects, and responds to known and unknown malware as well as fileless and malwareless attacks. It includes a full range of endpoint protection features, such as antivirus, firewall, device control, and URL filtering.
WatchGuard EPP supports these client platforms: Windows (Intel and ARM), Linux, macOS (Intel and ARM), and Android.
WatchGuard Endpoint Detection and Response (EDR)
WatchGuard EDR detects and responds effectively to any type of unknown malware, as well as the fileless and malwareless attacks that traditional solutions cannot detect. It uses the Zero-Trust Application Service to prevent applications and processes from running until they are validated as trusted. WatchGuard EDR can coexist with traditional security solutions.
WatchGuard EDR supports these client platforms: Windows (Intel and ARM), Linux, and macOS (Intel and ARM).
WatchGuard Endpoint Protection Detection and Response (EPDR)
WatchGuard EPDR prevents, detects, and responds to any type of known and unknown malware, as well as fileless and malwareless attacks. It uses the Zero-Trust Application Service to prevent applications and processes from running until they are validated as trusted. It expands on the capabilities of WatchGuard EDR with a full range of EPP features, such as antivirus, firewall, device control, URL filtering, and more.
WatchGuard EPDR supports these client platforms: Windows (Intel and ARM), Linux, macOS (Intel and ARM), and Android.
WatchGuard EPDR and WatchGuard EDR use a layered protection model of these technologies:
- Signature file and heuristic scanners
- Contextual detections for fileless attacks
- Anti-exploit technology for fileless attacks
- Zero-Trust Application Service
- Threat Hunting Service
Zero-Trust Application Service
The Zero-Trust Application Service protects your endpoints through 100% classification of all applications, programs, and executables. It monitors and prevents the execution of malicious applications and processes on endpoints. The service automatically classifies applications and processes as malicious or legitimate, in real-time. Only trusted applications and processes are allowed to run.
Threat Hunting and Investigation Services
The Threat Hunting Service detects anomalous usage of trusted applications on endpoints. It uses hacker detection to find attackers who use living-off-the-land techniques and lateral movements, as well as behavior modeling to identify malicious use by employees. When the Cybersecurity Team detects a living-off-the-land attack is detected, they notify you.