Symantec Endpoint Security Licensing Guide
June 12, 2020
Table of Contents
Summary of Changes ............................................................................................................. 1
Changes for Existing Customers ............................................................................................. 1
Changes for New Customers .................................................................................................. 2
Metering ............................................................................................................................... 2
SKU Quick Reference ............................................................................................................. 2
Product Feature Comparison.................................................................................................. 3
Example Sales Scenarios ........................................................................................................ 4
How to Activate License in Product ........................................................................................ 5
License Enforcement in Product ............................................................................................. 5
Summary of Changes
● NEW! SES Enterprise now includes an entitlement for servers, similar to SEP.
● Symantec Endpoint Protection 15 (SEP 15) is now known as Symantec Endpoint
Security (SES).
● The cloud console now requires a SES license for full cloud management or for
hybrid (bridged) mode. SEP customers who are using the cloud console to protect
endpoints (formerly known as SEP 15) may continue to do so until renewal time.
o At renewal time, the customer will be required to upgrade their license to SES.
▪ An upgrade SKU is available.
▪ If the customer has already purchased Advanced Endpoint Defense (AED)
or Complete Endpoint Defense (CED), they are already entitled to the use
the cloud console and will not need to purchase an upgrade
Note: Enforcement of license usage will take place on Feb 28, 2020, giving customers some
additional time to use their existing SEP licenses.
Changes for Existing Customers
SEP customers who are only using SEP Manager (SEPM) and not protecting endpoints
from the cloud console are unaffected and may continue to renew their existing license
or purchase additional SEP licenses as needed.
BROADCOM CONFIDENTIAL
SEP licenses can no longer be used to activate the cloud console. SES licenses will be
required.
o If the customer has already purchased Advanced Endpoint Defense (AED) or
Complete Endpoint Defense (CED), they will be entitled to the use the cloud
console and will not need to purchase an upgrade.
Changes for New Customers
● Multiple products have been consolidated under a single product: Symantec Endpoint
Security Complete (SESC).
● SEP Mobile and Cloud Connect Defense are now included as features of SES.
● SES licenses are required to use the cloud console to protect endpoints.
Metering
SES licenses are metered per managed device. Device(s) means a single physical or virtual
desktop, laptop computer, thin client, workstation, mobile device, server, or other virtual
operating system environment, on which a single instance of the Software, or portion
thereof, is installed, executed, or performing services.
SKU Quick Reference
SKU Prefix Description Prefix Key Entitlements
SESC-SES Endpoint Security Complete ● Everything in SES
(Includes New SES Subscription) ● EDR
● Threat Defense for Active Directory
Used for customers who do not (TDAD)
already own SEP or SES ● App Isolation
● App Control
SESC Endpoint Security Complete ● On-prem or cloud
(Includes Upgrade from SEP to SES)
Used for customers who already own
SEP
SES Endpoint Security ● SEP features
SES-UPG Endpoint Security, ● On-prem or cloud
Upgrade from Endpoint Protection to ● Cloud Connect Defense (CCD)
Endpoint Security ● SEP Mobile
SEP Endpoint Protection ● On-prem SEP 14
Notes:
BROADCOM CONFIDENTIAL
1) Other legacy SKUs are available for features that were once standalone products, but
those may be removed in the future. Legacy SKUs include Cloud Connect Defense (CCD),
Application Isolation, and Application Control.
Product Feature Comparison
SEP SES SES
Complete
On-prem ✅ ✅ ✅
(not all features
Management available on-
Options prem)
SaaS / Pure Cloud ✅ ✅
Workstation ✅ ✅ ✅
(Windows/Mac)
Supported Server ✅ ✅ ✅
Platforms (Windows/Linux)
Mobile ✅ ✅
(iOS/Android)
Breach ✅
Assessment
Attack Device Control ✅ ✅ ✅
Surface
Reduction App Control ✅
App Isolation ✅
Malware ✅ ✅ ✅
Prevention
Exploit ✅ ✅ ✅
Prevention
Attack
Prevention Intensive ✅ ✅
Protection
Network ✅ ✅
Connection
Security
Breach Intrusion ✅ ✅ ✅
Prevention Prevention
BROADCOM CONFIDENTIAL
Firewall ✅ ✅ ✅
Deception ✅ ✅ ✅
Active Directory ✅
Security
Auto-Managed ✅ ✅
Policies
Targeted Attack ✅
Response Analytics
and Threat Hunter ✅
Remediation
Auto Response ✅
Example Sales Scenarios
Customer Profile Customer Need What to Sell
Existing customer owns 12,300 Purchase Attack Surface 12,300 seats of SESC
SEP seats for 12,000 Reduction capabilities
workstations 300 servers
Existing customer owns 4,000 Cloud management of SEP 4,000 seats of SES
SEP seats and for 3,850 clients
workstations and 150 servers
Existing customer owns 1000 Buying EDR for 1000 1000 seats of SESC
SEP seats, 1,500 SEP Mobile workstations or servers Option for Mobile:
devices (1) Leave as SEP Mobile
until renewal
(2) Convert 1500 SEP
Mobile to 1500 SES or
SESC at no additional
cost
Desired state: customer gets
2,500 seats of SESC
New customer has 9,000 Advanced protection and EDR 18,300 seats of SESC-SES
workstations, 300 servers, and for workstations and mobile
9,000 mobile devices devices
New customer has 14,500 Malware prevention for 30,900 seats of SES
workstations, 400 servers, and workstations and protection
16,000 mobile devices for mobile devices
BROADCOM CONFIDENTIAL
How to Activate License in Product
Detailed instructions: http://entced.symantec.com/sep/15/activate_sub
License Enforcement in Product
This table describes license enforcement in the product, but a customer may still be out of
compliance even if the behavior is allowed. For license compliance details, review the Product
Usage Rights document.
Management License Type License Status Behavior
Protection features
not activated on
Over-deployed
devices exceeding
the trial limit of 25
Trial Protection features
disabled
Expired
Cloud
LiveUpdate content
disabled*
Over-deployed Allowed
LiveUpdate content
Paid disabled after a 30-
Expired
day grace period*
Over-deployed Allowed
Trial LiveUpdate content
Expired
SEP Manager (on-prem) disabled*
Over-deployed Allowed
Paid
Expired Allowed
* = When LiveUpdate content is disabled, anti-malware real-time scanning is
automatically disabled on Windows 10 RS3+
BROADCOM CONFIDENTIAL
