Kaspersky Endpoint Security Cloud Review: Console, Policies and Rollout

Fix it now

Kaspersky Endpoint Security Cloud is the base tier of what Kaspersky now sells as Kaspersky Next, with Kaspersky Next EDR Foundations and Kaspersky Next EDR Optimum above it. The console is browser-based and hosted by Kaspersky, deployment is by email invitation with default security profiles applied automatically, and managed devices are Windows, macOS, Android and iOS.

1. Buy it if you need central policy and reporting for a small estate and have no appetite for running a management server.
2. Buy it if mobile devices are part of the estate. Android and iOS are managed in the same console as the computers.
3. Ask for the Kaspersky Next tier names on your quote. Ordering from the old ladder is how you end up with the wrong SKU.
4. Ask about Linux separately. Kaspersky publishes Linux arriving at the Kaspersky Next EDR Foundations tier, not at this one.
5. Ask about Windows Server coverage in writing. It is not stated on the pages we could reach, and a file server left uncovered is what turns an incident into an outage.
6. Skip it if your sector, client contracts or national guidance restrict this vendor. Settle that before you plan a rollout.

Plan a week rather than an afternoon. Removing the incumbent security product is the step that goes wrong, and it is the only genuinely dangerous part of the project.

If that settles it you can stop here. If you want the rollout sequence and the licensing questions, read on.

Why it happens

The first thing to get right is the name, because it decides what you order. Kaspersky’s current small and medium business line-up is Kaspersky Next, with the tiers Kaspersky Next EDR Foundations, Kaspersky Next EDR Optimum, Kaspersky Next XDR Optimum and Kaspersky Next MXDR Optimum. Kaspersky Endpoint Security Cloud is not listed among the current products on that index, and on its own page it sits as the base tier with Kaspersky Next EDR Foundations and Kaspersky Next EDR Optimum above it. Buying from a description of the old ladder is how a small firm ends up with a licence that does not match what it was sold.

The console is browser-based and hosted by Kaspersky, with supported browsers published as Edge 80 and later, Chrome 78 and later, Firefox 72 and later and Safari 13 and later. There is no server for you to build, patch or back up, and machines report in from anywhere without a VPN. For a business without a domain, or without anyone whose job includes maintaining infrastructure, that removes the part of these projects that usually stalls.

Deployment is by email invitation. You send users an invitation to install the protection application, and default security profiles are applied automatically. That is a genuinely shorter path to coverage than building a package and pushing it, and the fact that the defaults are applied without anyone configuring anything matters more than it sounds: a business that never opens the console again still ends up protected rather than running an unconfigured product.

On platforms, be precise. Kaspersky publishes managed devices as Windows, macOS, Android and iOS, with Linux arriving at the Kaspersky Next EDR Foundations tier rather than here. Windows Server coverage is not stated on the pages we could reach, and we are not going to assert it either way. If you own a server, name it on the quote and get its coverage written down, because it is the machine whose protection decides how bad a ransomware incident becomes.

Licence counting is the other thing to have in writing rather than in a review. How workstations, servers and mobile devices are counted, whether there is a minimum seat count, and how terms work are all commercial questions that Kaspersky does not publish on the reachable product pages. Anyone quoting you rules from memory is guessing at something a quotation can state definitively.

Day-to-day operation, once it is running, is undemanding. The dashboard reports machines that are out of date, unprotected or reporting detections, and scheduled reports can be mailed to somebody who will never log in. The realistic administrative burden after the first month is checking for machines that stopped reporting, which is true of every managed product and is the one report worth reading weekly. A device silent for three weeks is usually a device that was rebuilt and never re-enrolled.

Full reference

Where this product sits now

We are not going to publish a module-by-module split between those tiers, because the reachable pages do not give one. Make the tier matrix part of your quote rather than relying on any description, including this one.

The first week, in order

1. Create the workspace, enable multi-factor authentication on the administrator account, and add a second administrator so one lost phone does not lock you out.
2. Add a pilot group of three or four users by email address and let them install from the invitation on one machine each.
3. Watch what happens to the incumbent security product. Some competitors are removed cleanly; others need their own vendor’s removal tool and a reboot before the new agent will start.
4. Compare the default profile against reality: exclusions for line-of-business applications, a scan schedule that suits your shift patterns, and a device control decision made before somebody loses access to a USB drive they need.
5. Roll out to the remaining users by invitation or through your existing deployment tool, in batches.
6. Enrol mobile devices last and separately. Personal devices need a conversation before they need a profile.

The window in which the old product has been uninstalled and the new one has not yet started is the only genuinely dangerous part of this project. Migrate in batches, make sure the reboot happens promptly, and confirm each batch is reporting into the console before starting the next. Never uninstall the incumbent product across the whole estate in advance.

What to have written on the quote

Living with a hosted console

A hosted tenancy means Kaspersky runs the management infrastructure and you do not. That is the right trade for most firms of this size, and the trade-off to be conscious of is that your management data sits in somebody else’s service. If data residency or offline operation is a requirement for you, this product is the wrong shape and no amount of configuration changes that; the on-premises management products are a different family with a different console.

Secure the console properly regardless. Administrator accounts are the keys to every machine you own, multi-factor authentication should be on from the first day, and a second administrator account exists so that a lost phone is an inconvenience rather than an incident.

Before you commit

• Settle the vendor question for your sector and your client contracts before you plan a rollout, not after. Migrating an estate twice is expensive.
• Build the seat count from an inventory rather than a headcount. A person with a laptop and a desktop is two.
• Name every server and every non-Windows machine on the quote.
• Decide who reads the weekly report of machines that stopped reporting, by name.
• If you need on-premises or offline management, stop here and ask about the other product family instead.

Questions people ask about this