ESET PROTECT Entry vs Advanced: Where Encryption and Sandboxing Kick In

Fix it now

Advanced adds more than the two components most comparisons list. On ESET’s own pages it brings Full Disk Encryption, Mobile Threat Defense, Cloud Workload Protection and Advanced Threat Defense – so if company phones are in scope, that alone decides it before you get to encryption.

1. Stay on Entry if the estate is desktops in one building, BitLocker is already handled through Group Policy or Intune, there are no company phones to manage, and unknown executables are rare.
2. Move to Advanced if you manage company phones. ESET states Mobile Threat Defense – antimalware, anti-theft and MDM for Android and iOS – is available from PROTECT Advanced, not Entry. This is the exclusion that catches people out.
3. Move to Advanced if laptops leave the building and you need centrally recorded proof that each one is encrypted with a recoverable key.
4. Move to Advanced if unknown attachments and downloads are part of the working day: finance, human resources, tendering and recruitment all qualify.
5. Do not buy Advanced expecting an incident timeline. ESET’s US pages place EDR, ESET Inspect, in ESET PROTECT MDR, and also sell it as a paid upgrade starting at 25 devices.
6. Check the composition on your own quote against your region’s page, not against a comparison table. ESET’s international knowledge base and its US product pages place EDR and patch management in different bundles.

ESET sells these bundles online up to 100 devices, with larger counts through the sales channel.

If mobile management or encryption evidence settles it, you are done. Below is what both tiers already give you, what encryption management actually buys, and when pre-execution analysis is worth paying for.

Why it happens

Entry is not a cut-down product. ESET publishes it as three things: the console, available as cloud or on-premises deployment; Modern Endpoint Protection for computers; and Server Security, described as real-time protection for data passing through general servers. For a business that wants managed antivirus and nothing more elaborate, that is the whole requirement met.

What Entry is not is a complete management platform, and ESET is explicit about the exclusions. It states that Full Disk Encryption and Mobile Threat Defense are available from ESET PROTECT Advanced, Mail Server Security from ESET PROTECT Complete, and EDR and Vulnerability & Patch Management from ESET PROTECT MDR. Read that list before you decide Entry covers your estate, because three of those five are things people assume are in a business antivirus product.

Advanced, on ESET’s own page, is Console, Modern Endpoint Protection, Server Security, Mobile Threat Defense, Cloud Workload Protection, Advanced Threat Defense and Full Disk Encryption. That is four additions rather than the two that most comparisons list, and one of them – mobile – is the kind of requirement that decides a purchase on its own.

One thing this comparison used to assert and should not have: that the protection layer is identical between the tiers and Advanced is only a wider bundle. Advanced Threat Defense is a protection layer, and it acts before execution rather than after it. Both tiers do stop ordinary commodity malware with the same engine, so the point survives in a narrower form – but it is not true that nothing about protection changes.

Full reference

What ESET publishes for each tier

Where the tier tables disagree, and why

ESET’s international knowledge base and its US product pages do not place every component in the same tier. The knowledge base describes PROTECT Complete as the tier introducing ESET Inspect, Vulnerability & Patch Management, Mail Security and Cloud Office Security. The US product pages state that EDR and Vulnerability & Patch Management are available in ESET PROTECT MDR and can be added as paid upgrades starting at 25 devices.

That is not a contradiction to resolve in an article; it is a packaging difference between markets, and it is exactly why the answer to ‘which tier has EDR’ is ‘check the page for the market you are buying in’. What is consistent across both is the Entry-to-Advanced boundary, which is where encryption, mobile and cloud analysis of unknown files start.

Full disk encryption: what it adds over BitLocker

Windows Pro already includes BitLocker, so the module is not selling you encryption. It is selling you management of it: one policy applied across the estate, recovery keys escrowed and retrievable by your administrator, and a status view showing which devices are encrypted and which are not, in the console you already have open. It also reaches machines not joined to Entra ID or enrolled in Intune, and covers a mixed estate consistently.

So the honest test is what produces your evidence today. If Intune already reports BitLocker status and holds the recovery keys, you have this and paying again is waste. If the answer is a script and a spreadsheet, or an assumption, then per-device reporting is worth real money the first time a customer sends you a security questionnaire. Evidence is usually what actually drives this purchase, more than the cryptography.

Do not roll full disk encryption across an estate before recovery key escrow is confirmed working and a restore has been tested on a spare machine. Encrypting a disk that is already failing, or one whose recovery key was never captured centrally, turns a recoverable problem into permanent data loss. Take a backup of anything irreplaceable before the first policy is applied.

Cloud analysis of unknown files: when it is worth it

The mechanism is straightforward. When the endpoint meets a file it has no verdict for, the file is submitted to the vendor’s environment, executed in isolation, observed, and a verdict returned. Depending on policy the endpoint can hold the file until that verdict arrives rather than allowing it to run and watching what happens. That closes the window between something new appearing and anyone knowing what it is.

It is worth money where unknown files arrive from outside routinely and a wrong decision is expensive: finance departments receiving invoices, human resources opening curricula vitae, anyone processing tender documents, and any business whose staff are targeted individually rather than in bulk. It is worth very little where staff run a fixed set of applications and never open anything from outside. Files leave your estate to be analysed, so it is a fair data protection question too – check what may be submitted and whether you can restrict document types before you enable it.

Which tier to buy, by situation

• Company Android and iOS handsets in scope: Advanced. Entry does not manage them at all.
• Desktops in one office, Intune managing BitLocker already, no unusual file flow: Entry. Do not pay for the modules twice.
• Laptops going home and to client sites, no Intune, a questionnaire asking about encryption: Advanced.
• Finance, HR, recruitment or public tendering: Advanced, for Advanced Threat Defense rather than the encryption.
• Mixed Windows and macOS estate needing one encryption report: Advanced.
• You want an incident timeline and the ability to hunt across endpoints: neither of these. That is ESET Inspect, higher in the range, and it needs somebody to use it.
• Budget is tight and you must choose one improvement: multi-factor authentication and tested backups before either module here.

Questions people ask about this