In short
Managed Cisco Secure Endpoint means a provider deploys, tunes and runs Cisco's endpoint protection and EDR for you, licensed per endpoint. It comes in Essentials, Advantage and Premier editions; Premier adds threat hunting by Cisco Talos. Forever Systems, a Cisco Partner, can supply and manage Secure Endpoint, billed monthly if preferred, terms confirmed at quote.
Get a quote for Managed Cisco Secure Endpoint
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What managed Cisco Secure Endpoint covers
Cisco describes Secure Endpoint (opens in a new tab) as "built-in or completely managed endpoint detection and response (EDR)". A connector on each device reports to Cisco's cloud console, where policies are set and detections reviewed. On Windows it can also run as a module of Cisco Secure Client (opens in a new tab), which Cisco calls the next generation of AnyConnect.
A managed service hands the running of it to us. The scope is agreed at quote, and usually covers:
- Roll-out: deploying the connector through your device management tool or Cisco Secure Client, and removing the product it replaces
- Policies and exclusions: protection settings tested on a pilot group first, with exclusions kept to what your line-of-business software needs
- Isolation and device control: one-click isolation of an infected device and rules for USB mass storage
- Investigation tools: Orbital Advanced Search queries and Remote Scripts, on Advantage and Premier
- Licences: adding and removing endpoints as devices come and go, and edition changes
- Alert routing: sending detections to your team, to us where agreed, or into Cisco XDR
Who looks at detections, and when, is agreed with you and written into the quote. For the wider service across other vendors, see managed endpoint security, and for what a managed EDR service means in general, see managed EDR.
Secure Endpoint editions
Cisco sells Secure Endpoint in three editions. This table follows Cisco's licensing comparison (opens in a new tab):
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| Next-generation endpoint protection, continuous monitoring and dynamic file analysis | Yes | Yes | Yes |
| One-click endpoint isolation and USB device control | Yes | Yes | Yes |
| Orbital Advanced Search and Remote Scripts | No | Yes | Yes |
| Malware Analytics Cloud and risk-based vulnerability scores | No | Yes | Yes |
| Host Firewall for Windows and macOS | No | Yes | Yes |
| Threat Hunting by Cisco Talos | No | No | Yes |
Cisco's data sheet (opens in a new tab) says Talos threat hunting "is offered exclusively as part of the Premier license tier", and that Secure Endpoint can be bought on its own, in the User Protection Suite or in the Breach Protection Suite. In the Breach Protection Suite (opens in a new tab), the Essentials tier includes Secure Endpoint Advantage and the Advantage tier includes Secure Endpoint Premier. We can manage any edition, and help you choose between buying Secure Endpoint on its own or in a suite.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
How Cisco licenses Secure Endpoint for managed service providers
Cisco licenses Secure Endpoint on the number of endpoints, where an endpoint is any device that can process data and access a network, including PCs, mobile devices and workstations (offer description (opens in a new tab)). For managed service providers, Cisco offers it in two ways:
- Cisco Secure MSP Center: Cisco's programme for MSPs (opens in a new tab) covering Duo, Umbrella and Secure Endpoint, with one centralised console for onboarding clients and provisioning licences, and no minimums or commitments. Its Secure Endpoint packages (opens in a new tab) are Essentials and Advantage, licensed on the number of endpoints and invoiced on that same usage meter (opens in a new tab). Cisco's November 2025 update (opens in a new tab) put Umbrella, Duo and Secure Endpoint under one managed-ready licence with monthly billing.
- Managed Service License Agreement (MSLA): Cisco's post-paid licence agreement for managed service providers. Its MSLA product terms (opens in a new tab) list the Secure Endpoint Cloud Service, and the Secure Endpoint MSLA terms (opens in a new tab) offer usage-based or fixed-price options.
Cisco's Secure MSP Center package page lists the same Essentials and Advantage capabilities as the first four rows of the editions table above.
Forever Systems works with Cisco through both Secure MSP Center and the MSLA, so we can supply and manage Cisco Secure Endpoint per endpoint, billed monthly, terms confirmed at quote, and we can adjust licence counts as your estate changes. The edition, term and buying route that suit you are set out in the quote.
Managed options from Cisco
Some organisations want Cisco's own experts watching their data as well. Cisco offers three ways to add that:
- Secure Endpoint Premier: Threat Hunting by Cisco Talos, described by Cisco as "continuous hunting by elite Cisco threat hunters with detailed alerts and clear remediation instructions" (licensing comparison (opens in a new tab))
- Cisco XDR Premier: Cisco describes it (opens in a new tab) as XDR "as a managed service provided by Cisco security experts", drawing on Secure Endpoint and the other Cisco tools it integrates; see managed XDR
- Breach Protection Suite Premier: adds Cisco Managed Extended Detection and Response and Talos Incident Response to the suite (Breach Protection Suite licensing (opens in a new tab))
These services are Cisco's, delivered under Cisco's service descriptions, which we can take you through at quote. We can set them up, make sure Secure Endpoint data reaches them and act as your escalation point, as agreed at quote. Our sister site covers Cisco XDR (opens in a new tab) in depth.
Is Managed Cisco Secure Endpoint the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Platforms and where data is held
Cisco's data sheet (opens in a new tab) says Secure Endpoint protects "Windows, Mac, Linux, Android, and iOS devices through a public or private cloud deployment". The antivirus signature database sits on each endpoint, so that layer of protection does not rely on a cloud connection.
Secure Endpoint's public cloud runs in three locations (opens in a new tab): North America, Europe and Japan. UK organisations can choose Cisco's European cloud, which Cisco's offer disclosure (opens in a new tab) lists as AWS in Ireland with backup in Germany, managed through the EU console. We confirm the region with you before the organisation is created, since that is where its data is held.
Onboarding
A typical move to managed Cisco Secure Endpoint follows these steps, each agreed at quote:
- Scope. We count the devices and operating systems, agree the edition, and record who should hear about detections.
- Set up the organisation in the Secure Endpoint cloud region you choose.
- Pilot. We deploy the connector to a small group through your device management tool or Cisco Secure Client, and tune policies and exclusions.
- Roll out. We replace the old product in stages and confirm every device is reporting.
- Hand over. We agree alert routing and escalation, including any Cisco XDR or Talos service, and then manage changes and licences.
If you already run Secure Endpoint, we start by reviewing the console, policies and exclusions, and can usually take over its management.
How we help
We recommend the edition, supply the licences, set up and manage Secure Endpoint, and bring it together with Cisco XDR, Cisco Secure Email Threat Defense on our managed email security service, and the rest of your security. Because we also manage other vendors' products, we can compare Secure Endpoint with alternatives on our managed endpoint security page, or explain the product side on our sister sites: Cisco EDR (opens in a new tab) and Cisco antivirus (opens in a new tab).
Pricing depends on the edition, the number of endpoints and how much management you want, so ask us for a quote. Contact us to talk it through.
How Forever Systems helps with managed security
You get round-the-clock monitoring, investigation and response from the managed detection and response services that established security vendors run at scale, chosen to fit your tools, set up properly and managed by us.
- A choice of vendor services: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR (opens in a new tab), Check Point MDR (opens in a new tab) and Cisco XDR (opens in a new tab), so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training (opens in a new tab), Cyber Essentials (opens in a new tab) and cloud security (opens in a new tab) advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is managed Cisco Secure Endpoint?
It is Cisco Secure Endpoint, Cisco's endpoint protection and EDR product, deployed, configured and looked after by a provider. That covers the connector roll-out, policies, exclusions, isolation, device control, licences and alert routing. Forever Systems can supply and manage it, with the scope agreed at quote.
Which Secure Endpoint editions can be managed?
Any of the three: Essentials, Advantage and Premier. Cisco's Secure MSP Center packages for managed service providers list Essentials and Advantage. Premier, which adds threat hunting by Cisco Talos, can be bought on a standard Cisco subscription or within the Breach Protection Suite.
Can managed Cisco Secure Endpoint be billed monthly?
Yes. Forever Systems can supply Cisco Secure Endpoint through Cisco's MSP programme, per endpoint and billed monthly, terms confirmed at quote.
Does Secure Endpoint Premier include Talos threat hunting?
Yes. Cisco's data sheet says Talos threat hunting is offered exclusively in the Premier tier. Cisco describes it as continuous hunting by Cisco threat hunters, with detailed alerts and clear remediation instructions.
Where is Cisco Secure Endpoint data held?
Cisco runs Secure Endpoint clouds in North America, Europe and Japan. UK organisations can choose the European cloud, which Cisco lists as AWS in Ireland with backup in Germany. Cisco's offer disclosure adds that Talos Threat Hunting, in Premier, processes personal data in an AWS cloud in the United States.
Can you take over the Secure Endpoint we already have?
Usually, yes. We review your console, policies, exclusions and licences first, then take over day-to-day management. Ask us for a quote.
Still have a question about Managed Cisco Secure Endpoint?
Ask us and a member of our team will get back to you.