Symantec Endpoint Security

Basic Information

Symantec Endpoint Security (SES) is a comprehensive cybersecurity solution developed by Broadcom Inc. It provides multi-layered defenses for various devices and operating systems, focusing on prevention, detection, and response to advanced threats. SES is the successor to Symantec Endpoint Protection (SEP), with Broadcom suggesting migration to SES for existing SEP users.

• Model: Symantec Endpoint Security (SES) Complete, SES Enterprise.
• Version: Latest stable versions are typically part of the 14.3 RU (Release Update) series for the underlying Endpoint Protection client. For instance, 14.3 RU9 (Build 11216) was released on June 24, 2024.
• Release Date: The first release of Symantec Endpoint Protection was in September 2007. The current Symantec Endpoint Security (SES) represents an evolution and consolidation of previous offerings, with continuous updates and feature releases.
• Minimum Requirements:
  • Processor: 64-bit processor: 2-GHz Pentium 4 with x86-64 support or equivalent minimum. For virtual computers, one virtual socket and one core per socket at 1 GHz minimum.
  • RAM: 1 GB (2 GB recommended) or more if required by the operating system. For the Symantec Endpoint Protection Manager (SEPM), 2 GB RAM minimum, 8 GB or more recommended.
  • Hard Drive: Disk space requirements vary by client type and installation location. For a standard client with program data on the system drive, 395 MB is needed, with an additional 135 MB during installation. For the SEPM with a local SQL Server database, 40 GB minimum (200 GB recommended).
  • Display: 800x600 or larger.
• Supported Operating Systems:
  • Windows: Windows 7 through Windows 11, and Windows Server 2008 R2 through Windows Server 2022 (and later versions like Windows Server 2025 for 14.3 RU10 and later).
  • macOS: macOS 10.14.x "Mojave" through macOS 13.x "Ventura". Apple M1 and M2 chips are supported.
  • Linux: Amazon Linux, CentOS, Debian, Oracle Enterprise Linux, Rocky Linux, Red Hat Enterprise Linux, SUSE Linux Enterprise Server/Desktop, Ubuntu LTS versions. Specific versions vary by SEP release update.
  • Mobile: iOS and Android.
• Latest Stable Version: 14.3 RU9 (Build 11216) as of June 24, 2024, for Symantec Endpoint Protection.
• End of Support Date: For older versions like SEP 12.1, extended support ended April 23, 2021. For SEP 14.3, there is no publicly stated end-of-life date, but Broadcom encourages migration to SES.
• End of Life Date: Symantec Endpoint Protection Cloud (SEP C) and Symantec Endpoint Protection Small Business Edition (SBE) had an official end-of-life date of December 7, 2020, with users encouraged to migrate to SES Enterprise.
• License Type: Trialware, subscription-based. Pricing is typically per-device and varies by vendor.
• Deployment Model: On-premises, cloud-based, or hybrid solutions are available.

Technical Requirements

Symantec Endpoint Security client and management components have specific technical requirements to ensure optimal performance and security. These requirements are designed to accommodate a wide range of enterprise environments.

• RAM:
  • Client (Windows): 1 GB minimum, 2 GB recommended. More if required by the operating system or for EDR features.
  • Client (macOS): 2 GB minimum.
  • Client (Linux): 4 GB recommended, with 500 MB free.
  • Manager (SEPM): 2 GB minimum, 8 GB or more recommended.
• Processor:
  • Client (Windows 64-bit): 2-GHz Pentium 4 with x86-64 support or equivalent.
  • Client (Windows virtualized): One virtual socket, one core per socket at 1 GHz minimum (two cores at 2 GHz recommended).
  • Client (macOS 64-bit): Intel Core 2 Duo or later, including Apple M1 and M2 chips.
  • Client (Linux): Intel Xeon with 4 cores or more.
  • Manager (SEPM): Intel Pentium Dual-Core or equivalent minimum, 8-core or greater recommended. Intel Itanium IA-64 processors are not supported.
• Storage:
  • Client (Windows Standard): 395 MB on system drive (180 MB system drive, 350 MB alternate drive if applicable). Additional 135 MB during installation.
  • Client (Windows Embedded/VDI): 245 MB on system drive (180 MB system drive, 200 MB alternate drive if applicable).
  • Client (Linux): 2 GB free space if /var, /opt, and /tmp use the same volume; or 1 GB free space in each if on different volumes. An additional 5 GB is recommended in /opt for EDR features.
  • Client (macOS): 2 GB free space on system drive.
  • Manager (SEPM): 40 GB minimum (200 GB recommended) for management server and local database.
• Display: 800x600 or larger for clients, 1024x768 or larger for SEPM.
• Ports: Requires network connectivity for communication with the management console and for updates. Specific port requirements depend on deployment configuration (e.g., cloud vs. on-premises).
• Operating System: As listed in the "Basic Information" section, covering various Windows, macOS, and Linux distributions, including server and desktop environments.

Analysis of Technical Requirements: The technical requirements for Symantec Endpoint Security are generally moderate for client endpoints, aligning with typical business-grade hardware. The management server (SEPM) requires more substantial resources, particularly for larger deployments with local databases. The support for both physical and virtual environments, along with a wide array of operating systems, highlights its enterprise focus. The increased RAM and storage recommendations for EDR features and larger deployments reflect the growing demands of advanced security functionalities. Itanium processors are explicitly not supported.

Support & Compatibility

Symantec Endpoint Security offers broad compatibility and robust support options, catering to diverse enterprise IT infrastructures.

• Latest Version: The Symantec Endpoint Protection client, which forms the core of SES, is actively maintained with release updates (RUs), such as 14.3 RU9.
• OS Support:
  • Windows: Supports Windows 7 through Windows 11, and Windows Server 2008 R2 through Windows Server 2025. Note that 32-bit Windows is supported up to SEP 14.3 RU5, and 14.3 RU6 and later no longer support 32-bit operating systems.
  • macOS: Supports macOS 10.14.x "Mojave" up to macOS 13.x "Ventura", including Apple M1 and M2 chips.
  • Linux: Comprehensive support for various distributions including Amazon Linux, CentOS, Debian, Oracle Enterprise Linux, Rocky Linux, Red Hat Enterprise Linux, SUSE Linux Enterprise Server/Desktop, and Ubuntu LTS versions. Specific kernel support varies by SEP version.
  • Mobile: Supports iOS and Android devices.
• End of Support Date: While older SEP versions have reached their end-of-life, Broadcom actively supports and updates the current SES platform. There is no public end-of-life date for SEP 14.2/14.3, but migration to SES is recommended.
• Localization: Information on specific localization is not explicitly detailed in the provided snippets, but as an enterprise solution, it typically offers multi-language support.
• Available Drivers: Symantec Endpoint Security includes necessary drivers for its functionalities, such as the Application and Device control driver. Updates to these drivers are part of regular product updates.

Analysis of Overall Support & Compatibility Status: Symantec Endpoint Security demonstrates strong support and compatibility across major operating systems and device types, including traditional endpoints, servers, and mobile devices. The continuous release updates and broad OS coverage ensure that enterprises can deploy the solution in heterogeneous environments. The shift towards cloud-based management and a single agent simplifies deployment and ongoing maintenance. However, users of very old 32-bit Windows systems need to be aware of version limitations. The active encouragement to migrate from older SEP products to the current SES platform indicates a commitment to modern security architectures.

Security Status

Symantec Endpoint Security is designed as a multi-layered defense system to protect against a wide array of cyber threats.

• Security Features:
  • Real-time threat protection using signature-based detection and behavioral analysis.
  • Machine Learning (ML) and Artificial Intelligence (AI)-based threat detection, including anomaly detection.
  • Ransomware protection and remediation, with behavioral analysis to detect encryption patterns.
  • Endpoint Detection and Response (EDR) capabilities for deep visibility, investigation, and response.
  • Firewall and Intrusion Prevention System (IPS).
  • Data Loss Prevention (DLP) features to prevent sensitive data exfiltration.
  • Proactive defense, continuous monitoring, and attack surface reduction.
  • Adaptive Protection, breach prevention, application isolation, and application control.
  • Memory exploit mitigation and protection against fileless malware.
  • Zero Trust Network Access.
  • Active Directory security and automated contextual policies.
  • Threat hunting and incident prediction using AI and analysis of attack chains.
• Known Vulnerabilities: Historically, vulnerabilities have been discovered and patched, such as an exploit in the Application and Device control driver in 2014 that allowed system access, which was subsequently patched.
• Blacklist Status: Symantec leverages its Global Intelligence Network (GIN), one of the largest in the world, to identify and block malicious software and activities, effectively maintaining a blacklist of threats.
• Certifications: Symantec is committed to rigorous, real-world testing with organizations like SE Labs, MRG, MITRE, and AV-Test, achieving high scores and AAA ratings in advanced security tests.
• Encryption Support: While not explicitly detailed, enterprise security solutions typically integrate with or support encrypted environments to protect data at rest and in transit.
• Authentication Methods: Supports strong adaptive multi-factor authentication for verifying user identity before granting access to applications.
• General Recommendations: Symantec Endpoint Security is recommended for its comprehensive, multi-layered approach to security, integrating advanced technologies like AI/ML, EDR, and DLP. It is advised to keep the software updated to benefit from the latest protections and patches.

Analysis on the Overall Security Rating: Symantec Endpoint Security maintains a strong overall security rating due to its comprehensive, multi-layered defense strategy. It integrates advanced technologies like AI/ML for proactive threat detection, EDR for rapid response, and robust prevention mechanisms including firewall, IPS, and DLP. Its consistent high performance in independent tests, such as SE Labs, where it achieved perfect scores for detection and real-world ransomware defense, underscores its effectiveness. The solution's ability to protect against evolving threats, including ransomware, fileless malware, and zero-day attacks, positions it as a leading enterprise endpoint protection platform.

Performance & Benchmarks

Symantec Endpoint Security is engineered for high performance while providing robust protection, with continuous improvements to optimize its impact on system resources.

• Benchmark Scores: Symantec Endpoint Security Complete (SES Complete) achieved perfect scores in SE Lab's Enterprise Advanced Security annual test for Detection for two consecutive years. It also received AAA ratings for perfect real-world ransomware defense with zero false positives. AV-Test has recognized Symantec for being #1 in protection and performance for five years running.
• Real-World Performance Metrics: In real-world testing by SE Labs, SES Complete demonstrated 100% effectiveness in detecting, blocking, and neutralizing ransomware attacks, preventing every attempted threat from executing, with zero false positives. It effectively prevents malicious attacks and ensures PC and server endpoints remain secure.
• Power Consumption: Specific power consumption metrics are not detailed in the provided information. However, performance improvements are a continuous focus, aiming to reduce resource impact.
• Carbon Footprint: Information regarding the carbon footprint of Symantec Endpoint Security is not available in the provided data.
• Comparison with Similar Assets:
  • Strengths vs. Competitors: Symantec Endpoint Security is noted for comprehensive coverage, advanced threat protection, deeper threat visibility, robust device management, superior AI-driven malware detection, and integrated AI. It surpasses competitors like CrowdStrike Falcon, HP Wolf Security, and Trellix Endpoint Security Platform in these areas.
  • Pricing: Symantec Endpoint Security often has a higher initial setup cost compared to some alternatives like Sophos EPP Suite, Kaspersky Total Security, or Trend Vision One Endpoint Security, but offers a more comprehensive protection suite.
  • User Experience: While praised for robust security and user-friendly interface, some users historically reported it could be resource-heavy, though updates have aimed to improve this.
  • Market Position: Symantec Endpoint Protection was the second-largest seller in the endpoint security market in 2024, behind Trend Micro.

Analysis of the Overall Performance Status: Symantec Endpoint Security demonstrates excellent performance in independent, real-world security tests, consistently achieving top scores for threat detection and prevention, particularly against advanced threats like ransomware. While historical user feedback sometimes pointed to resource intensity, Broadcom has focused on optimizing performance, including its cloud-based management platform. Its strong showing against competitors in protection capabilities and market share indicates a highly effective and performant solution for enterprise environments.

User Reviews & Feedback

User reviews and feedback for Symantec Endpoint Security highlight its robust protection capabilities and ease of management, though some historical concerns exist regarding resource usage and support speed.

• Strengths:
  • Reliable and Accurate Protection: Users frequently praise its accuracy in detecting and blocking threats, including malware, ransomware, and zero-day attacks. It provides a layered protection system that keeps endpoints safe.
  • Comprehensive Features: The solution offers a wide array of features like antivirus, anti-malware, firewall, web security, EDR, and DLP, all integrated into a single agent and console.
  • Ease of Use and Management: The management console is generally considered easy to use and understand, simplifying deployment, configuration, and monitoring across various endpoints. Cloud-based management further enhances accessibility and deployment.
  • Strong Security Posture: Provides confidence in protecting machines and data from evolving cyber threats.
  • Real-time Monitoring: Offers real-time monitoring features.
• Weaknesses:
  • Resource Intensity: Historically, some users reported that Symantec Endpoint Protection could be resource-heavy, requiring significant RAM and potentially slowing down servers. However, updates have aimed to improve this.
  • Cost: It is perceived as being on the costlier side compared to some other products with similar features.
  • Support Speed: Some feedback suggests that customer support could be speedier in their replies, and major challenges can arise during implementation and integration due to compatibility issues with Windows and Office updates.
  • Limited Features (compared to NGAV): Some users feel it has limited features/modules compared to Next-Gen Antivirus (NGAV) tools in the market.
• Recommended Use Cases:
  • Large Enterprises: Highly recommended for large enterprises seeking a robust business security system due to its comprehensive features and ability to manage a plethora of endpoints from one place.
  • Protection of Sensitive Data: Ideal for organizations needing to safeguard confidential data and prevent data breaches through its DLP capabilities.
  • Heterogeneous Environments: Suitable for environments with diverse operating systems (Windows, macOS, Linux, mobile) and devices, offering broad infrastructure support.
  • Organizations Prioritizing Advanced Threat Protection: Recommended for those prioritizing advanced threat detection, prevention, and rapid response against sophisticated attacks like ransomware and zero-day exploits.

Summary

Symantec Endpoint Security (SES) stands as a robust and comprehensive enterprise asset management solution, offering multi-layered protection against a wide spectrum of cyber threats. As an evolution of Symantec Endpoint Protection (SEP), SES provides advanced capabilities in prevention, detection, and response across diverse operating systems and devices, including Windows, macOS, Linux, and mobile platforms. Its core strength lies in integrating AI and Machine Learning for real-time threat detection, behavioral analysis, and ransomware protection, complemented by EDR, firewall, IPS, and DLP features. The solution supports flexible deployment models—on-premises, cloud, or hybrid—managed through a single agent and console, simplifying administration for IT teams.

Key strengths include its consistent high performance in independent security benchmarks, achieving perfect scores in detection and ransomware defense tests by SE Labs, and being recognized by AV-Test for top protection and performance. Users frequently praise its reliability, accuracy in threat blocking, and the breadth of its security features. The unified management console and broad OS compatibility are also significant advantages for enterprise environments.

However, some weaknesses exist. Historically, the solution has been perceived as resource-intensive, though recent updates aim to mitigate this. Its initial setup cost can be higher than some competitors, and some users have noted that customer support response times could improve. While comprehensive, some feedback suggests it might offer fewer features compared to certain Next-Gen Antivirus (NGAV) tools.

Overall, Symantec Endpoint Security is highly recommended for large enterprises, organizations with heterogeneous IT environments, and those prioritizing advanced threat protection and data security. Its ability to defend against complex and evolving cyberattacks, coupled with continuous development and broad compatibility, makes it a strong contender in the endpoint security market. The information provided is based on publicly available data and may vary depending on specific device configurations; for up-to-date information, please consult official manufacturer resources.