In short: Cisco Secure Endpoint Essentials covers prevention, continuous monitoring, sandbox file analysis, isolation and device control. Advantage adds the risk-based vulnerability framework, Orbital Advanced Search, Remote Scripts, Malware Analytics Cloud and Host Firewall. Premier adds threat hunting by Cisco Talos. Teams that investigate incidents themselves usually get most value from Advantage.
Edition comparison
This table follows Cisco's current Secure Endpoint licensing comparison.
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| Next-generation endpoint protection (machine learning and behavioural blocking, including fileless malware and ransomware) | Yes | Yes | Yes |
| Continuous monitoring of endpoint activity | Yes | Yes | Yes |
| Dynamic file analysis in a built-in sandbox | Yes | Yes | Yes |
| One-click endpoint isolation | Yes | Yes | Yes |
| Device control for USB mass storage | Yes | Yes | Yes |
| Risk-based vulnerability framework (scannerless vulnerability visibility and risk scores) | No | Yes | Yes |
| Orbital Advanced Search (live queries) | No | Yes | Yes |
| Remote Scripts powered by Orbital | No | Yes | Yes |
| Malware Analytics Cloud (advanced sandboxing and malware intelligence) | No | Yes | Yes |
| Host Firewall, managed centrally | No | Yes | Yes |
| Threat hunting by Cisco Talos | No | No | Yes |
Cisco adjusts packaging from time to time, so we confirm the current offer description before you order.
Secure Endpoint Essentials
Essentials is the core product: the prevention engines, continuous monitoring with retrospective detection, device trajectory, isolation and USB device control, all managed from the cloud console and backed by Talos intelligence. Suspicious files can be analysed in the built-in sandbox.
It suits organisations that mainly want strong prevention and a clear view of what happened when something gets through, and that will investigate in the console or in Cisco XDR rather than querying endpoints directly.
What Advantage adds
- Orbital Advanced Search: ask live questions of your endpoints, such as which devices run a vulnerable version of an application or have a suspicious scheduled task, using Cisco's library of predefined queries or your own
- Remote Scripts powered by Orbital: run clean-up and containment scripts remotely, alongside isolation, to remove persistence and speed up recovery
- Malware Analytics Cloud: fuller access to Cisco Secure Malware Analytics for deep dynamic analysis and malware intelligence
- Host Firewall: manage endpoint firewall policy from the Secure Endpoint console or API, instead of a separate tool
- Risk-based vulnerability framework: vulnerability visibility and risk scores from the connector, without running a separate scanner
Advantage is the edition we recommend most often, because Orbital and Remote Scripts turn Secure Endpoint from a detection tool into something you can investigate and respond with. It is also the Secure Endpoint edition in the Advantage tier of the User Protection Suite and the Essentials tier of the Breach Protection Suite.
What Premier adds
Premier adds threat hunting by Cisco Talos: Talos hunters look across your Secure Endpoint telemetry for attacker behaviour that automated detection might miss, mapped to the MITRE ATT&CK framework, and send you detailed alerts with recommended remediation steps.
Secure Endpoint Premier is the edition included from the Advantage tier of the Breach Protection Suite. Premier does not include a managed response service. Talos tells you what it found; your team, or a provider such as us, still acts on it. If you want Cisco to run detection and response for you, look at Cisco's managed XDR in the Breach Protection Suite Premier tier, and at Cisco Talos Incident Response for emergency help.
Which edition suits which buyer?
| You are... | Consider |
|---|---|
| A smaller organisation that wants to replace antivirus with something stronger, with alerts reviewed by IT | Essentials |
| An organisation with an IT or security team that investigates incidents and wants live queries and remote clean-up | Advantage |
| Standardising on Cisco across identity, email and endpoint | Advantage, or the User Protection Suite |
| A team without capacity to hunt proactively, or a regulated organisation that wants expert hunting on top of its tools | Premier |
| Wanting endpoint, XDR and email threat protection together | The Breach Protection Suite |
If you also need XDR, compare the Cisco XDR editions at the same time, because the suites can work out simpler than buying each product separately.
How Secure Endpoint is licensed
Secure Endpoint is sold as a term subscription and sized on the number of endpoints you protect. You can buy it on its own, as part of a Cisco security suite, or under a Cisco Security Enterprise Agreement if you are buying several Cisco security products. Our Cisco security licensing guide explains Smart Accounts, terms and suites across the portfolio.
We count your devices, including servers and any virtual desktops, match the edition to how your team works, and co-term renewals with your other Cisco subscriptions where we can. Pricing depends on quantity, edition and term, so ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Secure Endpoint Essentials and Advantage?
Advantage adds Orbital Advanced Search, Remote Scripts, Malware Analytics Cloud, Host Firewall and the risk-based vulnerability framework to everything in Essentials. In practice it adds live investigation and remote response.
What does Secure Endpoint Premier include?
Everything in Advantage plus threat hunting by Cisco Talos, who review your telemetry for attacker activity and send detailed alerts with remediation steps. It is not a full managed detection and response service.
Is Cisco Secure Endpoint included in a suite?
Yes. The Breach Protection Suite includes Secure Endpoint Advantage in its Essentials tier and Secure Endpoint Premier from its Advantage tier, and the User Protection Suite includes Secure Endpoint Advantage in its Advantage tier. Buying a suite can be simpler than licensing each product separately.
Is Orbital included with Cisco Secure Endpoint?
Orbital Advanced Search and Remote Scripts are included in the Advantage and Premier editions, not in Essentials.
How much does Cisco Secure Endpoint cost?
It depends on the number of endpoints, the edition, the term and whether you buy it alone or in a suite. We do not publish prices; contact us and ask us for a quote.