ESET PROTECT Entry Review: Managed Endpoint Security on a Tight Budget

Fix it now

ESET PROTECT Entry is the cheapest way into ESET’s managed range. What you buy is the console plus endpoint and file server protection: ESET documents PROTECT as managing ESET applications on workstations and servers, up to 50,000 devices, and its published tier table puts endpoint security for Windows, macOS and Linux, ESET Server Security for Windows Server and Linux, device control and anti-phishing in Entry.

1. Buy it if you have anything from a handful to a few dozen machines and currently no central view of any of them. That view is the product.
2. Buy it if you need to show, on demand, that every device is protected and current. Consumer licences cannot produce that and business licensing is not optional.
3. Buy it if you have file servers. ESET’s tier table puts ESET Server Security for Windows Server and for Linux in Entry rather than in an upsell.
4. Skip it if what you actually need is encryption, patch management or mail protection. ESET Full Disk Encryption starts at PROTECT Advanced, and Vulnerability and Patch Management, mail security and ESET Inspect start at PROTECT Complete.
5. Skip it if nobody will ever log in. A console that nobody opens is a more expensive way to buy an unmanaged estate.
6. Skip it if you have five devices, no server and no reporting obligation. ESET Small Business Security is the smaller-shaped product and it is managed through ESET HOME.

ESET publishes the tier matrix on its support site, so the component split is checkable rather than a matter of trust. What it does not publish is any minimum seat count or term, so those still belong on the quote.

If a central console is the thing you are missing, that is the decision made. Below is what the console actually does, what the rollout looks like, and what has changed in ESET’s licence administration.

Why it happens

The question a small business should ask about the bottom of a managed range is not whether the detection is any good. It is how much of the management story survives the price cut. With ESET the answer is straightforward, because the console is not tiered: ESET documents ESET PROTECT as a platform for managing ESET applications on workstations and servers in a networked environment with up to 50,000 devices from one central location. That is the same console regardless of which subscription you hold. What the subscription decides is which protection components your licence permits, not whether you can manage them.

What the console does is also documented rather than inferred. ESET describes the web console as turning extensive information into clear dashboards and reports, applying security policies across managed devices, carrying out tasks on agents and applications, and tracking system health on remote computers. An Active Directory Scanner is one of the platform’s components, which is the piece that keeps your machine list aligned with a directory you already maintain rather than a second list you have to remember to update.

The tier matrix is published, on ESET’s own support site, and it is worth reading before anyone quotes you. Entry covers ESET Endpoint Security and ESET Antivirus Security for Windows, ESET Endpoint Security for macOS, ESET Endpoint Antivirus for Linux, ESET Server Security for Windows Server and for Linux, device control and anti-phishing. It does not cover ESET Full Disk Encryption, which starts at Advanced alongside ESET LiveGuard Advanced and ransomware remediation, and it does not cover Vulnerability and Patch Management, ESET Inspect, mail security or ESET Cloud Office Security, which start at Complete. Tier contents in this market do move between product generations, so check that table against the version of it you are quoted from rather than against a comparison chart on somebody else’s site.

The honest cost of this product is the console’s depth. Policies, inheritance and task triggers are genuinely capable and they are also more concepts than a small business expects to meet in order to switch on antivirus. Budget an afternoon on policies and inheritance specifically, because a policy applied at the wrong level is the most common reason a setting appears not to take effect and the hardest thing to diagnose from the machine’s end.

Full reference

What the console does, from ESET’s own description

Two practical points follow from that list. The first is that hosted and on-premises are a decision about where the data lives and who patches the server, not about what the console can do. The second is that the 50,000-device ceiling tells you something useful even at ten machines: nothing about this platform is going to run out of room, so the reasons to move to a different product later will be about components, not about scale.

Licence administration has moved

If you have used ESET business licensing before, one thing has changed and it is worth knowing before you go looking for a portal that is no longer the one to use. ESET states that ESET Business Account is being phased out and that all licence management moves to its successor, ESET PROTECT Hub, with customers notified roughly two weeks before their own transition. In practice that means a description of the licence portal written a year ago will not match what you sign in to, and any instruction that starts by telling you to go to ESET Business Account should be checked before you follow it.

The capability that matters for a business with more than one site is still there: seats from one subscription can be shared among sites, which is how a branch office or a managed service provider sees only its own devices. Confirm which portal you will actually be administering on, because that is the thing that has moved.

A realistic first week

1. Create the console, secure the administrator account, and add a second administrator so one lost phone does not lock you out of your own estate.
2. Take a pilot group of three or four machines that between them run every important application you have.
3. Deploy the agent to the pilot and watch what happens to the incumbent security product. A clean removal makes this a day; a stubborn one adds a scripted removal to every machine.
4. Run the pilot on real work for a few days and write down every block that turned out to be legitimate.
5. Apply the exclusions, then roll out in batches, confirming each batch reports in before starting the next.
6. Add servers deliberately rather than assuming they were included, and set a scheduled report to email whoever will not log in.

The window in which the old product has been removed and the new agent has not yet started is the only genuinely dangerous part of this project. Migrate in batches, make sure the reboot happens promptly, and never uninstall the incumbent product across the whole estate in advance.

Counting what you are licensing

Seats are devices, not people. A user with a desktop, a laptop and a company phone is three of them, and a file server is another. Build the number from an inventory rather than a headcount, and put the servers on the list before you ask for a price rather than after. No minimum seat count or term length is published on any ESET page reachable for this review, so if a minimum applies to you it will come from the quote, which is the right place for it to come from.

What happens if the subscription lapses

On the Windows side this is documented by Microsoft rather than by ESET, and it is worth knowing. Microsoft Defender Antivirus automatically re-enables itself when a third-party antivirus expires, is uninstalled, or stops providing real-time protection. So a lapsed estate does not go bare, but it does quietly stop being a managed estate: the console keeps showing you machines it can no longer report accurately on, and the policies you built are no longer the thing deciding what happens. Diary the expiry and renew before it rather than after.

Who should be buying something else

• You need managed disk encryption: that is PROTECT Advanced, where ESET Full Disk Encryption and ESET LiveGuard Advanced first appear. Buying Entry and adding it later is the expensive version of this decision.
• You need vulnerability and patch management, mail security or EDR: that is PROTECT Complete, where Vulnerability and Patch Management, ESET Mail Security, ESET Cloud Office Security and ESET Inspect first appear.
• You have five machines, no server and nobody asking for evidence: ESET Small Business Security is the smaller product, managed through ESET HOME.
• You have a Windows server and want it covered specifically: ESET sells ESET Safe Server for that, so name every server on the quote.
• Nobody will read anything the console produces: buy through a provider who will, or accept that you are paying for visibility you are not using.

Questions people ask about this