In short
Cisco EDR is Cisco Secure Endpoint, formerly AMP for Endpoints, sold in Essentials, Advantage and Premier editions. Every edition includes continuous monitoring, retrospective detection, device trajectory and one-click isolation. Advantage adds Orbital Advanced Search, Remote Scripts and Host Firewall; Premier adds threat hunting by Cisco Talos. Secure Endpoint feeds Cisco XDR, and the Breach Protection Suite bundles them, with Cisco's managed XDR in its Premier tier.
Get a quote for Cisco EDR
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Cisco's EDR is
Cisco's endpoint product is Cisco Secure Endpoint, which Cisco used to sell as AMP for Endpoints (Advanced Malware Protection). It is still a product in its own right: Cisco has not folded it into Cisco XDR. Instead, Secure Endpoint is one of the main sources of telemetry for Cisco XDR, and both are bundled in Cisco's Breach Protection Suite.
A lightweight connector runs on each device and reports to the Secure Endpoint cloud console. Cisco lists Windows, macOS and Linux, with apps for iOS and Android. Organisations that cannot use the public cloud console can use Cisco's Secure Endpoint Virtual Private Cloud instead. Verdicts on files draw on Cisco Talos threat intelligence, which Cisco also uses across its email and network security products.
Cisco describes Secure Endpoint as offering built-in or completely managed EDR, alongside threat hunting and risk-based vulnerability visibility. For the product in depth, our Cisco specialist site covers Cisco Secure Endpoint. For antivirus on its own, see our sister site endpointprotection.uk.
How Secure Endpoint detects and investigates
Cisco's detection model rests on two ideas that go beyond a single verdict when a file first runs:
- Continuous monitoring and retrospective security: the connector keeps recording file, process and network activity after a file is allowed, so if Cisco later judges that file malicious, Secure Endpoint can show every device it touched
- Device trajectory and file trajectory: a timeline of what ran on a device, what it created and where it connected, and a view of where else the same file appeared
- Command line visibility: the commands that processes ran, which helps when attackers use tools already on the machine
- Dynamic file analysis: suspicious files can be detonated in a sandbox; Advantage and Premier add Malware Analytics Cloud for deeper analysis and malware intelligence
- Orbital Advanced Search (Advantage and Premier): live queries against your endpoints, using Cisco's library of predefined threat-hunting, vulnerability and IT queries or your own
Together these shorten investigations: instead of asking what the alert means, an analyst can see how the threat arrived, what it did and where else it is. Our guide to threat hunting explains how live queries like Orbital fit a hunting routine.
Response tools
Detection is half the job. These are the response and control tools Cisco lists, and which editions include them:
| Tool | What it does | Editions |
|---|---|---|
| Endpoint isolation | Cuts a device off the network with one click while keeping its connection to the console for investigation | Essentials, Advantage, Premier |
| Device control | Allows only approved USB mass storage devices, with visibility of what was blocked | Essentials, Advantage, Premier |
| Remote Scripts powered by Orbital | Runs clean-up and containment scripts remotely to remove persistence and speed up recovery | Advantage, Premier |
| Host Firewall | Manages endpoint firewall rules centrally from the Secure Endpoint console | Advantage, Premier |
| Threat Hunting by Talos | Cisco Talos hunters search your telemetry for attacker activity, mapped to MITRE ATT&CK, and send alerts with remediation advice | Premier |
How far automated response should go is a policy decision. Most organisations isolate laptops quickly and take more care with servers; our EDR deployment guide covers that in steps, and USB device control explains the policy side of device control.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Essentials, Advantage and Premier compared
Cisco sells Secure Endpoint in three editions, each including everything in the one before it. This table follows Cisco's current licensing comparison:
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| Next-generation endpoint protection | Yes | Yes | Yes |
| Continuous monitoring | Yes | Yes | Yes |
| Dynamic file analysis | Yes | Yes | Yes |
| Endpoint isolation | Yes | Yes | Yes |
| Device control | Yes | Yes | Yes |
| Risk-based vulnerability framework | No | Yes | Yes |
| Orbital Advanced Search | No | Yes | Yes |
| Remote Scripts powered by Orbital | No | Yes | Yes |
| Malware Analytics Cloud | No | Yes | Yes |
| Host Firewall | No | Yes | Yes |
| Threat Hunting by Talos | No | No | Yes |
Essentials suits teams that mainly want strong prevention and a clear view of what happened. Advantage turns Secure Endpoint into a tool you investigate and respond with, through Orbital and Remote Scripts. Premier adds Talos's hunters looking for what automation misses. Edition detail is on our Cisco site's Cisco Secure Endpoint cost page.
From EDR to Cisco XDR
Cisco XDR brings endpoint, network, email, cloud and identity telemetry together, uses AI-assisted investigation to prioritise incidents and offers guided remediation and automated response. Secure Endpoint is one of its built-in sources, so an analyst can see a phishing email, the user who clicked and the laptop involved in one incident, then isolate the device from the same place.
Cisco XDR also takes alerts from third-party EDR tools, including Microsoft Defender for Endpoint, CrowdStrike and SentinelOne, which helps in a mixed estate. It comes in three tiers:
| Cisco XDR tier | What Cisco says it adds |
|---|---|
| Essentials | Built-in integrations across the Cisco security portfolio |
| Advantage | Commercially supported, curated integrations with select third-party tools |
| Premier | A managed service run by Cisco security experts, plus security validation through penetration testing and select Cisco Talos Incident Response services |
Our extended detection and response guide explains when XDR is worth it, and our Cisco site covers Cisco XDR in depth.
Is Cisco EDR the right fit for you?
We will check it against your systems and requirements and recommend the right option.
The Breach Protection Suite
Cisco bundles Secure Endpoint, Cisco XDR and email threat protection in the Breach Protection Suite. Cisco's UK licensing page lists three tiers, each including the one before:
| Suite tier | What it includes |
|---|---|
| Breach Protection Essentials | Cisco XDR Essentials, Cisco Secure Endpoint Advantage and Cisco Secure Email Threat Defense |
| Breach Protection Advantage | Adds Cisco XDR Advantage, Cisco Secure Endpoint Premier, Cisco Secure Network Analytics and Cisco Telemetry Broker |
| Breach Protection Premier | Adds Cisco XDR Premier, Cisco Managed Extended Detection and Response, Cisco Talos Incident Response and a Cisco Technical Security Assessment |
If you want endpoint, XDR and email protection from Cisco, a suite can be simpler than licensing each product separately. Our Cisco site explains the Breach Protection Suite tiers in more detail.
Who watches the alerts
With Cisco, the realistic options are:
| Option | Who acts | Suits |
|---|---|---|
| Secure Endpoint Essentials or Advantage, self-managed | Your IT or security team, in the console or Cisco XDR | Teams that can triage alerts promptly, including out of hours |
| Secure Endpoint Premier | Talos hunts and alerts you with remediation advice; your team responds | Teams that handle day-to-day alerts but want experts looking for hidden threats |
| Breach Protection Premier | Cisco's managed XDR service monitors and responds across Cisco XDR | Organisations without their own security operations centre |
Compare these with other vendor-run services on our endpoint security vendors page, such as Check Point MDR and Sophos MDR.
How Cisco is licensed and how we help
Cisco licenses Secure Endpoint on the number of endpoints, which Cisco's terms define broadly as devices that process data and connect to a network, including computers and mobile devices. You can buy it on its own, in the Breach Protection Suite or in the User Protection Suite. Through Forever Systems, Cisco can be billed monthly, with terms confirmed at quote.
We can count your endpoints, match the edition to how your team works, compare Secure Endpoint alone with a suite, deploy the connector in audit mode first, tune exclusions and agree with you who acts on alerts. Licence changes and renewals then sit on one Forever Systems account.
Contact us to talk about Cisco Secure Endpoint and Cisco XDR for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos, Check Point, TrendAI and Cisco
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is Cisco's EDR called?
Cisco's endpoint detection and response product is Cisco Secure Endpoint, formerly AMP for Endpoints. It is sold in Essentials, Advantage and Premier editions and feeds Cisco XDR.
Has Cisco Secure Endpoint been replaced by Cisco XDR?
No. Cisco Secure Endpoint is still sold as its own product. Cisco XDR uses it as one of its telemetry sources, and Cisco bundles both in the Breach Protection Suite.
Is Cisco AMP for Endpoints the same as Cisco Secure Endpoint?
Yes. Cisco renamed AMP for Endpoints to Cisco Secure Endpoint. The connector, console and core detection approach carried over.
What does Secure Endpoint Premier add?
Premier adds Threat Hunting by Cisco Talos to everything in Advantage. Talos hunters search your telemetry for attacker activity, mapped to MITRE ATT&CK, and send you alerts with recommended remediation steps.
Does Cisco offer managed detection and response?
Yes. Cisco XDR Premier and the Premier tier of the Breach Protection Suite include a managed service run by Cisco security experts, which Cisco calls Managed Extended Detection and Response.
How much does Cisco EDR cost?
Cisco licenses Secure Endpoint on the number of endpoints, by edition and term, alone or in a suite. Ask us for a quote.
Still have a question about Cisco EDR?
Ask us and a member of our team will reply by email.
More endpoint security guides
Check Point EDREDR in every Check Point Endpoint Security edition, Infinity XDR in Elite and Check Point MDR, explained.
Trend Micro EDRTrendAI Vision One's EDR sensor, XDR, Security Operations and MDR services, explained.