In short
WatchGuard EPDR is now sold as WatchGuard Endpoint Security 360. It combines prevention with endpoint detection and response, and adds the Zero-Trust Application Service and lateral movement detection and containment. Prime is the EDR edition below it; Elite, formerly Advanced EPDR, adds advanced investigation tools. All are managed in WatchGuard Cloud with ThreatSync XDR.
Get a quote for WatchGuard Endpoint Security (EPDR)
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What WatchGuard EPDR was, and what it is now
EPDR stood for endpoint protection, detection and response: WatchGuard's product that combined prevention (EPP) with endpoint detection and response (EDR) in one agent. The technology came to WatchGuard with its acquisition of Panda Security, which is why older documents may mention Panda Adaptive Defense.
WatchGuard has since reorganised the range as WatchGuard Endpoint Security in four editions:
| Old name | Current name |
|---|---|
| WatchGuard EPP | Endpoint Security Basic |
| (new edition) | Endpoint Security Prime |
| WatchGuard EPDR | Endpoint Security 360 |
| WatchGuard Advanced EPDR | Endpoint Security Elite |
Existing agents and policies carry on working through a rename; the new names show in WatchGuard Cloud and on renewals. If your renewal notice still says EPDR, Endpoint Security 360 is the like-for-like edition.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Editions compared
Each edition includes everything in the one before it. This table follows WatchGuard's own comparison:
| Capability | Basic | Prime | 360 | Elite |
|---|---|---|---|---|
| Attack surface reduction | Yes | Yes | Yes | Yes |
| Malware and ransomware protection | Yes | Yes | Yes | Yes |
| AI-powered behavioural threat detections | Yes | Yes | Yes | Yes |
| Anti-exploit detections | No | Yes | Yes | Yes |
| Endpoint isolation and response | No | Yes | Yes | Yes |
| MITRE ATT&CK-mapped alerts and root cause analysis | No | Yes | Yes | Yes |
| ThreatSync XDR remediations | No | Yes | Yes | Yes |
| Compatible with WatchGuard MDR | No | Yes | Yes | Yes |
| Zero-Trust Application Service | No | No | Yes | Yes |
| Lateral movement detection and containment | No | No | Yes | Yes |
| Advanced investigation tools | No | No | No | Yes |
Elite's advanced investigation tools include correlated attack timelines and process trees, natural-language searching of telemetry, advanced policy enforcement and remote access to affected endpoints. Basic is the prevention edition, and antivirus-only comparisons belong on our sister site endpointprotection.uk. This page is about the editions with detection and response: Prime, 360 and Elite.
WatchGuard EDR vs EPDR
People often ask how WatchGuard's EDR differs from EPDR. In today's names:
- Endpoint Security Prime gives you EDR on top of prevention: anti-exploit detection, isolation and response, MITRE ATT&CK-mapped alerts with root cause analysis, and remediation through ThreatSync XDR. It is the entry point for WatchGuard MDR.
- Endpoint Security 360 (formerly EPDR) adds two things that matter for stopping attacks rather than just seeing them: the Zero-Trust Application Service and lateral movement detection and containment.
- Endpoint Security Elite (formerly Advanced EPDR) adds advanced investigation tools for teams, or providers on their behalf, who investigate incidents in depth.
WatchGuard also still sells a product called WatchGuard EDR, which works with Core MDR, and EDR Core, a light EDR agent that comes with the Firebox Total Security Suite for a limited number of endpoints set by the appliance. Both were left unchanged by the April 2026 renaming. We confirm which fits alongside your existing products at quote.
Is WatchGuard Endpoint Security (EPDR) the right fit for you?
We will check it against your systems and requirements and recommend the right option.
The Zero-Trust Application Service
The feature that most sets 360 apart is the Zero-Trust Application Service. Instead of letting everything run unless it looks bad, it blocks applications by default until they are classified as safe. WatchGuard performs that classification, so you get much of the protection of application whitelisting without building and maintaining allow lists by hand.
That default-deny approach is a practical way to apply zero trust endpoint security on Windows devices. It pairs with lateral movement detection and containment, which looks for an attacker moving from one compromised device to others and stops the spread.
As with any application control, expect a short bedding-in period while line-of-business and specialist software is classified. Plan it into your EDR deployment.
Optional modules
Modules are licensed per endpoint on top of an edition, and some need Prime or above:
| Module | What it does | Available with |
|---|---|---|
| Patch Management | Finds and deploys missing operating system and third-party application patches | All four editions |
| Full Encryption | Encrypts drives with Microsoft BitLocker, with central key recovery | All four editions |
| Advanced Reporting Tool | Custom reports, dashboards and longer retention of endpoint activity | Prime, 360 and Elite |
| SIEMFeeder | Sends endpoint security events to your SIEM | Prime, 360 and Elite |
| Core MDR | WatchGuard's 24/7 managed detection and response service | Prime, 360 and Elite |
Patch Management and Full Encryption are natural additions because they support two common audit questions: are devices up to date, and are disks encrypted? See our guides to the patch management process and full disk encryption.
WatchGuard Cloud and ThreatSync XDR
There is no management server to build. Every edition is managed from WatchGuard Cloud, the same console used for WatchGuard's Firebox firewalls, AuthPoint MFA and other products. Detections feed ThreatSync, WatchGuard's XDR layer, where they can be correlated with what other WatchGuard products see, and a response, such as isolating a device, taken from the same place.
The agent installs on Windows, macOS and Linux and protects Android and iOS devices, though not every feature or module is available on every platform. If you already run WatchGuard firewalls, keeping endpoints in the same console is a real advantage. If you do not, 360 still stands on its own as an EDR platform with default-deny application control built in. Read more about XDR in our extended detection and response guide.
Choosing an edition
A rough guide:
- Prime if you want EDR visibility and response and the option of WatchGuard MDR, without changing how applications run
- 360 if you also want default-deny application control and lateral movement containment, and can accept a short bedding-in period while software is classified
- Elite if your team, or a provider on your behalf, investigates incidents in depth
- Any of the three plus Core MDR if nobody can watch alerts out of hours: see WatchGuard MDR
WatchGuard Endpoint Security is licensed per endpoint, on a term or a monthly subscription, and a WatchGuard Cloud account for a single organisation holds one edition licence at a time, so plan on one edition for all devices. Licensing detail is on our WatchGuard Endpoint Security licensing page.
Contact us) to talk about WatchGuard Endpoint Security 360 or moving from EPDR. We can recommend an edition, deploy the agent, remove the old product and build policies with you.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is WatchGuard EPDR?
WatchGuard EPDR was WatchGuard's endpoint protection, detection and response product, combining prevention with EDR in one agent. It is now sold as WatchGuard Endpoint Security 360, which also includes the Zero-Trust Application Service and lateral movement detection and containment.
What is WatchGuard EPDR called now?
EPDR is now Endpoint Security 360, Advanced EPDR is now Endpoint Security Elite and EPP is now Endpoint Security Basic. Prime is a new edition that adds EDR to Basic. Existing agents carry on working.
What is the difference between WatchGuard EDR and EPDR?
EDR focuses on detection and response. EPDR, now Endpoint Security 360, combines prevention, EDR and the Zero-Trust Application Service, which blocks applications until they are classified as safe, plus lateral movement containment.
What features does WatchGuard EPDR include?
Endpoint Security 360 includes attack surface reduction, malware and ransomware protection, behavioural detection, anti-exploit detection, endpoint isolation and response, MITRE ATT&CK-mapped alerts with root cause analysis, ThreatSync XDR remediation, the Zero-Trust Application Service and lateral movement detection and containment.
Does WatchGuard Endpoint Security include patch management?
Not by default. Patch Management is an optional module licensed per endpoint, available with every edition. Full Encryption is optional in the same way.
How much does WatchGuard Endpoint Security 360 cost?
It is licensed per endpoint, and the price depends on quantity, term and any modules. We do not publish prices: ask us for a quote.
Still have a question about WatchGuard Endpoint Security (EPDR)?
Ask us and a member of our team will reply by email.
More endpoint security guides
Falcon Insight XDRCrowdStrike's EDR, unified with identity, cloud and mobile telemetry, and how we supply Falcon.
Vigilance MDRSentinelOne's managed detection and response service, now Wayfinder MDR, explained.
WatchGuard MDRWatchGuard's 24/7 MDR service: Core MDR, Core MDR for Microsoft, Total MDR and Open MDR compared.
GravityZone XDRBitdefender's EDR plus native XDR sensors for identity, Microsoft 365, network, cloud and business apps.Bitdefender MDRBitdefender's managed detection and response on GravityZone: what its SOC does and what you agree up front.