Kaspersky for business in Morocco: which Kaspersky Next edition to choose (EDR Foundations, EDR Optimum, XDR Expert)

The short answer: Kaspersky’s business range is now called Kaspersky Next, and it has taken over from Kaspersky Endpoint Security for Business (Select and Advanced editions). For a Moroccan SMB, the choice almost always comes down to two editions. EDR Foundations if you want solid endpoint protection that is simple to manage, with application and web control. EDR Optimum as soon as you are exposed to ransomware, hold sensitive data, or nobody patches software by hand: it adds EDR, patch management, encryption and Microsoft 365 protection. XDR Expert is for organisations with a security team or a SOC.

At ALLSAFE SOLUTIONS, we are a Kaspersky Registered B2B Partner in Casablanca. We supply licences, with or without installation, and we operate the console for our managed services clients. The features quoted here come from Kaspersky’s published documentation; we do not give prices, which depend on the number of devices, the term and the edition.

What changed: from Endpoint Security for Business to Kaspersky Next

For years, a business would buy “Kaspersky Endpoint Security for Business Select” or “Advanced”, or Endpoint Security Cloud for small organisations. Kaspersky has grouped its business offering into a single family, Kaspersky Next, organised in tiers:

• EDR Foundations: the base, endpoint protection with root cause analysis.
• EDR Optimum: essential EDR, cloud security and enterprise-grade controls.
• XDR Optimum and MXDR Optimum: extended detection, the latter with monitoring managed by Kaspersky.
• EDR Expert and XDR Expert: threat hunting, investigation and response orchestration, for experienced security teams.

In practice, if your Select or Advanced licence is about to expire, do not renew it “like for like” without looking: Kaspersky offers a migration to Next, and it is the right moment to check whether you need to step up. For very small organisations without a server, Kaspersky also still offers Small Office Security, simpler but less complete on the administration side.

The three editions that matter for an SMB: comparison

Feature (Kaspersky documentation)	EDR Foundations	EDR Optimum	XDR Expert
File, mail, web, network protection and firewall	Yes	Yes	Yes
Behaviour detection, exploit prevention, remediation engine	Yes	Yes	Yes
Vulnerability assessment	Yes	Yes	Yes
Application, web and device control	Yes	Yes	Yes
BadUSB attack prevention, removable drive scan	Yes	Yes	Yes
Root cause analysis of an attack	Yes	Yes	Yes
EDR features (device isolation, indicator of compromise scanning)	No	Essential	Advanced
Patch management	No	Yes	Yes
Disk encryption management	No	Yes	Yes
Adaptive anomaly control	No	Yes	Yes
Microsoft 365 protection	No	Yes	Yes
Cybersecurity training for IT staff	No	Yes	Yes
Orchestration, playbooks, case management, SIEM	No	No	Yes

Source: Kaspersky Next edition comparison table and Kaspersky product pages. Some features only apply to certain operating systems, Windows first and foremost.

In our view, two rows of this table make the difference for most SMBs: patch management and EDR. Most intrusions we see come through software that was never updated or through a compromised device nobody isolated in time. That is exactly what EDR Optimum covers and Foundations does not. For the underlying difference, read EDR or antivirus: why antivirus is no longer enough.

The console: cloud or on-premises Kaspersky Security Center

This is the second decision, and it is often overlooked.

Option	For whom	Points to watch
Kaspersky Next cloud console	SMBs with no server room, multiple sites, remote workers	Nothing to install or maintain, browser access; management data is hosted by Kaspersky
On-premises Kaspersky Security Center	Businesses with internal servers, strong data location requirements	A server to maintain, back up and update; full control over configuration
Open Single Management Platform (XDR Expert)	Large organisations with a SOC	Deployed on your infrastructure, includes event correlation (KUMA SIEM)

Kaspersky states that EDR Foundations and EDR Optimum can be deployed in the cloud or on premises. Kaspersky also supports migrating an existing Kaspersky Security Center installation to the cloud console, manually or automatically. Our default recommendation for an SMB: the cloud console, unless a regulatory constraint or group policy requires management data to stay in-house. If you process sensitive personal data, check the question of transfers outside Morocco, which we cover in our article on Morocco’s data protection law 09-08.

Smartphones: included, as long as you enrol them

Kaspersky Next manages Android, iOS and iPadOS from the same console as computers. According to the vendor’s documentation, this includes:

• an enforced lock screen passcode;
• anti-theft for Android, iOS and iPadOS: remote lock, locate and wipe;
• anti-malware, app control and compliance control on Android;
• web control on Android and on supervised iPhones;
• Wi-Fi configuration and management of built-in iOS features.

Two technical details matter: on iPhone, you need an Apple Push Notification service (APNs) certificate to manage devices; on Android 14 and later, some wipe actions require the phone to be enrolled in “device owner” mode (company-owned device). We cover the full topic, BYOD included, in MDM: managing and securing business smartphones.

Which edition for your size and risk

Your situation	Our recommendation
Small office, a few workstations, no server, no sensitive data	EDR Foundations, cloud console
SMB with a file server, accounting, ERP, remote work	EDR Optimum, cloud or on-premises console
Health, financial or customer data in volume; requirements from a group or a main client	EDR Optimum with 24/7 monitoring
Fleet of business smartphones to secure	Foundations or Optimum depending on the workstations, mobiles managed in the same console
In-house security team or SOC, need for correlation and automation	XDR Expert, or XDR Optimum for a simpler approach
Nobody in-house to read alerts	EDR Optimum managed by a provider, or MXDR Optimum

Size alone is not enough to decide. A ten-person practice handling medical records or client funds carries more risk than a fifty-person workshop with no sensitive data. We always start from three questions: what data would you lose in an attack, how long can you afford to be down, and who will read the alerts?

An edition with EDR is useless if nobody is watching

This is the most common mistake: buying EDR Optimum, then never opening the console. An EDR produces alerts that need to be triaged, and some require isolating a device in the middle of the night. Either you have someone in-house, trained and available, or you hand this monitoring to a provider. That is what we do: alerts from the Kaspersky console feed into our 24/7 monitoring, and a critical incident is handled in under 15 minutes. We explain how it works in managed EDR and 24/7 monitoring.

Licensing and renewal: what you need to know

• Counting is per protected device. Depending on the edition and current terms, workstations, servers and mobiles are not always counted the same way: we check this with you before quoting, to avoid surprises.
• Servers should be listed separately in your inventory: they need specific exclusions and rules, especially for databases and backups.
• The term is chosen when ordering. A multi-year licence simplifies management; an annual licence leaves more flexibility if your fleet changes.
• Renewal must be planned ahead: an expired licence means protection that is no longer updated. We track renewal dates for our clients and warn them in advance.
• Migration from Select or Advanced happens at renewal. Devices do not switch consoles overnight: we plan the move so that no device is left unprotected.
• Adding devices mid-contract is possible: plan for it when hiring or buying new workstations.

Kaspersky or another solution?

Kaspersky is not the only serious option, and we say so frankly. If you are already on Microsoft 365 Business Premium, Microsoft Defender for Business is included and worth considering, see how to secure Microsoft 365. If your group or a client imposes a supplier list, check that it allows Kaspersky: some procurement policies, especially in groups with US ties, exclude this vendor. We compare the main players in business antivirus in Morocco: how to choose. Kaspersky remains a solid choice for an SMB that wants a single console for computers, servers and smartphones, with a good level of control.

Mistakes we fix on Kaspersky deployments

1. Automatic renewal to the equivalent of the old edition, without asking whether EDR or patch management are missing.
2. Devices never enrolled: the console shows part of the fleet, the rest is unprotected or runs another antivirus.
3. Two antivirus products on the same machine, causing slowdowns and conflicts.
4. Default policies never adjusted: device control disabled, users with local admin rights.
5. No uninstall password, letting an attacker or a user remove the agent.
6. An on-premises Kaspersky Security Center never updated or backed up.
7. Alerts nobody reads, which turns an EDR into an expensive antivirus.

Checklist before ordering

• Number of Windows, macOS and Linux workstations, servers and smartphones to protect.
• Sensitive data processed, and requirements from a group, client or regulator.
• Cloud or on-premises console, and data location constraints.
• Need for EDR, patch management, encryption, Microsoft 365 protection.
• Current licence (Select, Advanced, other vendor) and expiry date.
• Who will read the alerts at night and at weekends.
• Plan for switching over from the existing antivirus.

How we do it

We start with a free audit of your fleet and your risks: device inventory, current antivirus, exposure to ransomware and phishing, patch status. We then recommend the right edition and console, supply the licences, and deploy the agent remotely while cleanly removing the old antivirus. Policies are adapted to your business: application and USB control, password-protected agent, automatic patching, laptop encryption. Once in production, the console is monitored 24/7, and a critical incident is handled in under 15 minutes. This fits into a broader approach, with 7 measures against ransomware and rolling out MFA.

See our business cybersecurity offering and our Kaspersky partner page, then request your free initial audit: we reply within 24 business hours with an edition recommendation and a quote.