In short: Harmony Endpoint Advanced is the entry edition of Check Point Endpoint Security. It includes ThreatCloud intelligence and IOC management, firewall, application control, compliance checks and remote access VPN, anti-ransomware and anti-malware engines, browser zero-phishing, EDR with automated forensics and MITRE ATT&CK mapping, and Threat Emulation and Threat Extraction.
What is included in Harmony Endpoint Advanced?
| Area | Components |
|---|---|
| Threat intelligence | ThreatCloud and IOC management (block your own indicators: domains, IP addresses, URLs and file hashes) |
| Access control | Firewall, application control, endpoint compliance, remote access VPN |
| Threat prevention | Anti-ransomware, anti-malware, anti-bot, anti-exploit, Behavioural Guard, port protection |
| Browser security | Zero-phishing, URL filtering, corporate password reuse protection, safe search |
| EDR | Forensics collection with automated reports, MITRE ATT&CK mapping, threat hunting |
| Sandboxing and CDR | Threat Emulation and Threat Extraction (sanitisation) |
That is everything except encryption, XDR, posture management and DLP, which come with Complete and Elite or as add-ons. See the Harmony Endpoint editions comparison for the full table.
Threat prevention engines
Advanced layers several engines so that an attack missed by one is caught by another:
- Anti-ransomware watches for ransomware behaviour, such as illegitimate mass encryption, without relying on signatures. When it fires, every element of the attack is identified and quarantined and encrypted files are restored automatically from snapshots. More on our Check Point anti-ransomware page.
- Anti-malware covers known threats, from worms and Trojans to adware and keyloggers.
- Anti-bot detects infected devices trying to reach command-and-control servers.
- Anti-exploit stops attackers hijacking vulnerabilities in legitimate applications, shutting down the exploited process when an exploit is detected.
- Behavioural Guard classifies and blocks malware variants in real time by how they behave, catching new mutations of known families.
- Port protection controls which storage and peripheral devices can connect to USB and other ports.
Access control: firewall, application control, compliance and VPN
Advanced is more than an antivirus replacement. It includes:
- Firewall rules that allow or drop traffic to and from the device by IP address, domain, port and protocol
- Application control to allow, block or terminate named applications and processes
- Endpoint compliance, which marks devices that break your rules (for example missing protection) as non-compliant so you can apply a more restrictive policy
- Remote access VPN for users who need encrypted access to applications in your data centre or head office
These help with the firewall, secure configuration and malware protection controls in the Cyber Essentials requirements. Organisations moving to zero trust access instead of a VPN should also look at Harmony SASE.
Browser security, EDR and sandboxing
Browser security. The agent's browser extension blocks unknown phishing sites in real time, allows or blocks websites under your URL filtering policy, enforces safe search and warns when a user enters their corporate password on an outside site. It is the same technology sold separately as Harmony Browse, so you do not need both for managed devices.
EDR. When something malicious is detected, forensics analysis starts automatically and the whole attack sequence appears as a report: how it got in, which processes and files were involved and what was cleaned up. Events are mapped to MITRE ATT&CK tactics and techniques, and threat hunting (with cloud management) lets you query raw and detected events from every device. Our Harmony Endpoint EDR and XDR page covers this in depth.
Sandboxing and CDR. Threat Emulation runs suspicious downloaded files in Check Point's sandbox to find unknown malware. Threat Extraction removes exploitable content and rebuilds the file, so the user gets a sanitised copy within seconds instead of waiting for the sandbox verdict.
Who Harmony Endpoint Advanced suits
Advanced suits most organisations replacing a traditional antivirus product, or a basic EDR tool, with strong prevention and investigation in one agent. It is a good fit when:
- disk encryption is already handled, for example by BitLocker managed in Microsoft Intune, or is not needed on some devices such as fixed servers
- you have a small IT team that values automated forensics reports over raw telemetry
- you want sandboxing and file sanitisation on the endpoint as well as at the email or network layer
When to step up to Complete or Elite
Move to Harmony Endpoint Complete when you want full disk encryption and removable media encryption managed in the same console, which matters for laptops carrying personal data. Move to Harmony Endpoint Elite when you also want XDR, patching and DLP, or when you were about to buy two or more add-ons for Advanced.
Pricing depends on device numbers, add-ons and term, so ask us for a quote. Contact us for a proof of value or a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Harmony Endpoint Advanced include EDR?
Yes. Automated forensics reports, MITRE ATT&CK mapping and threat hunting are all included in Advanced. Infinity XDR for Endpoint, which correlates incidents across products and automates responses, is in Elite or available as an add-on.
Does Harmony Endpoint Advanced include encryption?
No. Full disk encryption and removable media encryption are in Harmony Endpoint Complete and Elite. Advanced does include port protection, which controls which devices can connect to USB and other ports.
Do I need Harmony Browse if I have Harmony Endpoint Advanced?
Not for devices running the agent: Advanced includes the same browser security (zero-phishing, URL filtering, password reuse protection and safe search). Harmony Browse on its own is useful for devices where you cannot install the full agent.
Is Harmony Endpoint Advanced enough for Cyber Essentials?
It supports the malware protection and firewall controls, and application control and compliance checks help with secure configuration. Cyber Essentials also requires timely patching and access control across your estate, so it is one part of meeting the scheme rather than the whole answer.