Emsisoft Business Security Review: EDR Is the Tier Above

Fix it now

Emsisoft Business Security is protection and cloud management with a light agent, and it does not include endpoint detection and response. Emsisoft’s own comparison marks EDR, ransomware rollback, threat hunting, SIEM integration and Active Directory integration as things Enterprise Security adds, so if a questionnaire names EDR, this is the wrong tier.

1. Buy it if you run tens to low hundreds of Windows and Mac endpoints with one or two people looking after them, and you want protection plus a console rather than a platform.
2. Buy it if a light agent matters, particularly on session hosts where agent overhead multiplies by concurrent users.
3. Buy Emsisoft Enterprise Security + EDR instead if you need endpoint detection and response, ransomware rollback, threat hunting, SIEM integration or Active Directory discovery.
4. Read the exact wording of any insurance questionnaire or customer security review first, because that wording decides which of the two tiers you need.
5. Skip it if you have a Linux estate. Emsisoft publishes Windows and macOS support and lists no Linux client.
6. Skip it if you expected patch management, disk encryption management, DLP and asset inventory in the same console. Those are separate products.

The protection stack is common to both business tiers, so moving up buys response capability and integration, not better detection.

If the tier is settled you can stop here. If you want to know what the console and the server features actually give you, read on.

Why it happens

Emsisoft splits its business offering into two tiers, and the split is not where most descriptions put it. Emsisoft Business Security is protection plus cloud management. Emsisoft Enterprise Security + EDR is the tier that adds endpoint detection and response, ransomware rollback, AI-assisted threat hunting, third-party SOC and SIEM integrations, Active Directory discovery and premium support. Emsisoft’s own comparison, on the Business Security page itself, lists all of those as what upgrading buys you.

That correction is the reason to read the tier list carefully. Descriptions of this range routinely put Business Security down as the tier with EDR added on top, list EDR events and response actions among its capabilities, and recommend it to anyone who needs those features. A buyer told to demonstrate endpoint detection and response would have bought the tier that does not have it, which is the most expensive kind of mistake a review can cause.

What Business Security does contain is a coherent protection stack with the consumer product’s engine underneath it: Web Protection and Browser Security, the Real-time File Guard described by Emsisoft as a dual-engine scanner with AI-supported detection, the Behavior Blocker and Anti-Ransomware, plus signature detection, exploit detection and attack surface reduction. On a business endpoint the behaviour blocker carries most of the weight, because what reaches staff arrives as macro-laden documents, script chains and signed system binaries doing things they should not.

The server and automation features are the part that distinguishes this from the consumer product and they are worth listing: operation without a user login, connected storage device monitoring, email notifications and webhooks for detections, a command-line scanner for third-party integration, and a public monitoring API. Those are the features that let a small team wire this into whatever they already use rather than logging into another console all day.

Management is the Emsisoft Management Console: web-based, with Android and iOS apps, so the administrator can see status and respond from a phone. That is not the same thing as mobile device management, which the product does not do, and it is worth separating the two before somebody on a procurement call conflates them.

Platform coverage is published and it decides some purchases outright: Windows 10 64-bit and Windows Server 2016 and higher, and macOS 11 Big Sur and higher. There is no Linux client in that list. If you run Linux servers, that is not a detail to confirm later; it is the answer.

On the commercial side this review deliberately says less than the one it replaces. Emsisoft does not publish per-seat pricing, volume bands, term lengths or how servers and session hosts are counted, so none of that is asserted here. Those are questions to get answered in writing, and the unglamorous ones matter most: whether a terminal server counts once or per session, whether mid-term seats run co-terminus with the existing subscription, and what happens at renewal if headcount has fallen.

Full reference

Where the line between the two tiers falls

Read that table before you read any price. The protection columns are identical, so the money buys response and integration. An organisation whose requirement is written as prevention is well served by the left-hand column; one whose requirement is written in the language of detection, retention and hunting is not, and no configuration closes that gap.

Published platform support

Server and automation features worth knowing about

• Operation without a user login, which is what makes it usable on a server that nobody signs into.
• Connected storage device monitoring, for the removable media that still walks into small offices.
• Email notifications and webhooks on detections, so alerts can land somewhere people already look.
• A command-line scanner for third-party integration, which is how you wire scanning into a backup or a file-transfer process.
• A public monitoring API, so protection status can appear on whatever dashboard you already run.

Agent weight, and where it actually matters

One agent with a modest component list is the practical selling point, and it matters in two specific places. The first is ageing desktops that a heavy suite makes visibly worse. The second is terminal servers and virtual desktop hosts, where every agent multiplies by concurrent session count and overhead stops being a detail and becomes the whole performance conversation. Pilot on a representative group including your most awkward department, and give file, database and mail servers the exclusions their own vendors publish before you turn enforcement up.

Questions to get answered in writing

1. Which tier is on the quote, spelled out: Business Security, or Enterprise Security + EDR.
2. How servers count against workstations, and whether a terminal server counts once or per session.
3. Whether mid-term additions run co-terminus with the existing subscription.
4. What happens at renewal if your headcount has fallen.
5. The exact wording of any customer or insurer requirement you are trying to satisfy, checked against the tier table above before you order.

Questions people ask about this