WatchGuard EPDR: endpoint protection, EDR and Endpoint Security

The short answer: WatchGuard EPDR has not disappeared, it has been renamed. Since 1 April 2026, WatchGuard’s endpoint protection range is organised in four tiers, Endpoint Security Basic, Prime, 360 and Elite, and EPDR now corresponds to Endpoint Security 360. For an SMB, it is still the tier we recommend by default: next-generation antivirus, full EDR, and a service that only lets applications classified as trusted run. Everything is managed from the WatchGuard Cloud console, the same one used for the Firebox firewall and AuthPoint MFA.

This guide does not reopen the antivirus versus EDR debate, covered in EDR vs antivirus: why traditional antivirus is no longer enough, nor the question of human monitoring, covered in managed EDR in Morocco. It explains the WatchGuard range as published today, the modules, and how to choose. We supply and deploy these licences as a WatchGuard partner in Morocco.

Old names and new names

WatchGuard announced its new range in March 2026, with the names in force since 1 April 2026. Many quotes, documents and articles still use the old names: here is the mapping published by WatchGuard.

Old name	New name	In one sentence
WatchGuard EPP	Endpoint Security Basic	Endpoint protection with automated behavioural detection
(none, new tier)	Endpoint Security Prime	Full EDR, without extra operational workload
WatchGuard EPDR	Endpoint Security 360	Prime, plus default-deny application control
WatchGuard Advanced EPDR	Endpoint Security Elite	360, plus advanced investigation tools
WatchGuard EDR	Unchanged	EDR alone, alongside another security solution
WatchGuard EDR Core	Unchanged	The EDR included in the Firebox Total Security Suite

A licence bought before 1 April 2026 and activated afterwards shows both names in the WatchGuard portal. On a quote, check the actual tier, not just the label.

What each tier includes

Each tier includes the one below and adds features. The table follows the comparison published by WatchGuard.

Feature	Basic	Prime	360	Elite
Attack surface reduction	Yes	Yes	Yes	Yes
Malware and ransomware protection	Yes	Yes	Yes	Yes
AI-powered behavioural detection	Yes	Yes	Yes	Yes
Anti-exploit protection	No	Yes	Yes	Yes
Endpoint isolation and response	No	Yes	Yes	Yes
MITRE ATT&CK-mapped alerts, root cause analysis	No	Yes	Yes	Yes
ThreatSync XDR remediations	No	Yes	Yes	Yes
Compatible with the MDR service	No	Yes	Yes	Yes
Zero-Trust Application Service	No	No	Yes	Yes
Lateral movement detection and containment	No	No	Yes	Yes
Advanced investigation tools	No	No	No	Yes

The Zero-Trust Application Service is what sets 360 apart. WatchGuard describes it as the classification of all applications, programs and executables: only those recognised as legitimate can run. It is not available with Prime. For an SMB without a security team, it is valuable protection against unknown ransomware, because the endpoint refuses whatever has not been validated instead of waiting to recognise it as malicious.

The service works in three modes. Audit mode (called Learning in recent versions) only reports, without blocking: WatchGuard reserves it for evaluation. Hardening mode lets unknown programs already installed keep running, but blocks those arriving from the internet, removable media or another computer until they are classified. Lock mode blocks any unknown program pending classification. WatchGuard recommends starting in Hardening to let classification build up, then moving to Lock after a few weeks, adding rules for authorised software.

Elite targets teams that investigate themselves: centralised management of indicators of compromise compatible with STIX and Yara, advanced security policies, remote access to the endpoint to contain and remediate an incident. It is aimed more at a provider or an in-house security team than at a stand-alone SMB.

Supported systems

Product	Windows (Intel and ARM)	macOS (Intel and ARM)	Linux	iOS and Android
Basic, Prime, 360	Yes	Yes	Yes	Yes
Elite, WatchGuard EDR	Yes	Yes	Yes	No

Protecting smartphones does not replace managing them: locking, remote wipe and separation of business data require a dedicated tool, presented in managing business smartphones.

EDR and EDR Core: the two special cases

WatchGuard EDR is EDR on its own. According to WatchGuard, it can coexist with traditional security solutions: it is the route when a company wants to keep its current antivirus until the licence expires, while adding visibility. Note: according to its documentation, WatchGuard EDR reports detected threats without blocking or disinfecting files; it is a transition solution, not complete protection.

WatchGuard EDR Core is included in the Firebox Total Security Suite, for a limited number of endpoints that depends on the firewall model. It is managed in WatchGuard Cloud and runs in Audit mode only, since Hardening and Lock require the Zero-Trust Application Service. It is a good starting point, but it accepts no modules, and WatchGuard recommends moving to a higher tier to use them. On upgrade, the EDR Core licence becomes inactive; it reactivates if the higher licence expires. Choosing the Firebox suite is explained in our WatchGuard Firebox guide for SMBs.

Add-on modules

Module	Purpose	Compatible with
Patch Management	Inventory and deployment of operating system and software patches	Basic, EDR, Prime, 360, Elite
Full Encryption	Full disk encryption for Windows and Mac	Basic, EDR, Prime, 360, Elite
Advanced Reporting Tool	Advanced analysis and reporting on endpoint activity	EDR, Prime, 360, Elite
SIEMFeeder	Sends events to a SIEM	EDR, Prime, 360, Elite
1-Year Data Retention	Keeps data for one year	Basic, Prime, 360, Elite
Data Control	Discovery and classification of personal data on endpoints	EDR, Prime, 360, Elite, only in select European countries

Patch Management is the module we add most often: many compromises go through a flaw already fixed by the vendor, but whose patch was never installed. Encryption mostly matters for laptop fleets. The number of licences for a module must match the number of devices concerned.

ThreatSync: linking endpoints and the Firebox

ThreatSync is WatchGuard’s XDR layer, built into WatchGuard Cloud. It groups detections from endpoints, Fireboxes and WatchGuard access points into scored incidents, and can act automatically through automation policies.

• The default remediation policy isolates from the network any device affected by an incident scored 7 to 10, on endpoints, Fireboxes and access points, while keeping it available for analysis.
• Blocking an IP address or domain at the origin of a threat is applied by every Firebox in the account with ThreatSync enabled.
• On the endpoint, other actions exist: killing a process, deleting a file.

WatchGuard advises keeping the default policies until you know the incidents specific to your environment, and adding exceptions for critical IP addresses, for example a server the whole business depends on. This is exactly the benefit of a single ecosystem: what the endpoint detects can be blocked at network level. The same principle exists at Fortinet, as we explain in FortiGate or WatchGuard for an SMB.

WatchGuard’s human services

Two services complement the software. The Threat Hunting Service looks for abnormal use of trusted applications, typical of attacks that use the system’s own tools (“living off the land”) and of lateral movement; WatchGuard’s security team notifies you when it detects one. Managed EDR hands threat monitoring and investigation to WatchGuard’s experts, around the clock. On our side, we provide 24/7 monitoring of alerts and on-site intervention for our clients.

How to choose

Your situation	Our recommendation
Firebox with Total Security Suite, few endpoints, tight budget	Start with EDR Core, then move to 360
Antivirus still licensed for several months	WatchGuard EDR alongside it, then 360 at renewal
SMB without a security team, Windows endpoints and servers	Endpoint Security 360, with Patch Management
Need for EDR visibility without strict application control	Endpoint Security Prime
Provider or security team that investigates in-house	Endpoint Security Elite
Small isolated endpoint, low risk	Basic, knowing its limits

To place WatchGuard among other vendors, read how to choose a business antivirus in Morocco.

The mistakes we fix

1. An old antivirus left in place next to Endpoint Security, causing conflicts and slowdowns.
2. The Zero-Trust Application Service left in Audit or Hardening for months, never moved to Lock.
3. Servers forgotten in the rollout, although they are the prime targets.
4. EDR Core presented as complete protection for every endpoint, although it covers a limited number of devices.
5. Alerts nobody reads in WatchGuard Cloud.
6. ThreatSync policies never reviewed, or isolation policies changed without exceptions for critical servers.

Checklist before ordering

• Inventory of endpoints and servers by system: Windows, macOS, Linux, mobile.
• Current antivirus licences and their expiry dates.
• Tier chosen: Basic, Prime, 360 or Elite, and modules.
• Endpoints covered by EDR Core identified, where relevant.
• ThreatSync policies and exceptions defined with the Firebox.
• Person or provider in charge of handling alerts, day and night.

How we do it

We start with a free initial audit of your fleet and current protection. We then choose the tier and modules, cleanly uninstall the old solution, deploy the agent group by group, then move the Zero-Trust Application Service from Hardening to Lock once business applications are classified. Endpoints are linked to ThreatSync and the Firebox, and alerts are monitored 24/7, with critical incidents handled in under 15 minutes.

This protection is part of our business cybersecurity in Morocco offering, complemented by the MFA described in WatchGuard AuthPoint. Licences can be supplied on their own or with installation, through our IT hardware and licensing offering. Request your free initial audit: we reply within 24 business hours.