In short: Harmony Endpoint editions are Advanced, Complete and Elite. Advanced covers threat prevention, access control, browser security, EDR and sandboxing with CDR. Complete adds full disk and removable media encryption. Elite adds Infinity XDR for Endpoint, posture management, DLP and GenAI security. Lower editions can add XDR, posture management or DLP separately.
How the editions are structured
Harmony Endpoint uses one agent and one console whichever edition you buy. The edition decides which components the licence switches on. The packages are cumulative:
- Advanced is the full prevention and EDR package
- Complete is Advanced plus data protection (encryption)
- Elite is Complete plus XDR, posture management, DLP and GenAI security
Because it is the same agent, moving up an edition is a licence change and a policy change, not a reinstall. Components such as Full Disk Encryption still need to be added to the deployment policy, and the client restarts to enforce them.
Feature comparison table
This table follows Check Point's 2025 Harmony Endpoint solution brief.
| Capability | Advanced | Complete | Elite |
|---|---|---|---|
| ThreatCloud threat intelligence and IOC management | Yes | Yes | Yes |
| Firewall, application control, endpoint compliance | Yes | Yes | Yes |
| Remote access VPN | Yes | Yes | Yes |
| Anti-ransomware with file restoration | Yes | Yes | Yes |
| Anti-malware, anti-bot, anti-exploit, Behavioural Guard | Yes | Yes | Yes |
| Port protection (device control) | Yes | Yes | Yes |
| Browser security: zero-phishing, URL filtering, password reuse, safe search | Yes | Yes | Yes |
| EDR: automated forensics, MITRE ATT&CK mapping, threat hunting | Yes | Yes | Yes |
| Threat Emulation (sandboxing) and Threat Extraction (CDR) | Yes | Yes | Yes |
| Full disk encryption | No | Yes | Yes |
| Removable media encryption | No | Yes | Yes |
| Infinity XDR for Endpoint, with Playblocks | Add-on | Add-on | Yes |
| Posture management (vulnerability and patch management) | Add-on | Add-on | Yes |
| DLP and GenAI security | Add-on | Add-on | Yes |
Edition pages: Harmony Endpoint Advanced, Harmony Endpoint Complete and Harmony Endpoint Elite.
Optional add-ons
| Add-on | What it includes |
|---|---|
| Infinity XDR / XPR | Incident management, correlation of events across Check Point products, and Infinity Playblocks for Endpoint to automate responses. See Harmony Endpoint EDR and XDR |
| Posture Management | Vulnerability management plus automated patch management for the operating system and third-party applications. See posture management |
| DLP and GenAI Security | Upload and download scanning, clipboard and print control, predefined data types with an option to use Microsoft Purview sensitivity labels, and controls that monitor GenAI tools and stop sensitive data being typed or pasted into them |
If you find yourself adding two or more of these to Advanced or Complete, compare the cost with Elite, which includes them. We quote both ways so you can see the difference.
Check region availability for DLP and GenAI controls. Check Point's administration guide currently lists DLP as available for Check Point Portal tenants hosted in the EU, US, India, Australia and UAE regions, and GenAI Protect for the EU, India, US, Australia and Canada regions; the UK region is not on either list. If your tenant is, or needs to be, hosted in the UK, we confirm what is available before you commit to Elite or the DLP add-on.
Older packages: Prevent and Basic
Earlier Check Point briefs listed two lower packages that you may still see on existing contracts and renewal notices:
- Prevent: threat intelligence, access control and threat prevention, without browser security, EDR or sandboxing
- Basic: Prevent plus browser security and EDR, without sandboxing and CDR
The same earlier brief also listed Vulnerability Management (discovery of vulnerable operating systems and third-party applications, without patching) as a separate add-on. Check Point's 2025 brief lists only Advanced, Complete and Elite, with Advanced as the entry package containing everything Prevent and Basic offered, and three add-ons. If you hold an older package, ask us before renewal and we will map your current SKUs to what Check Point sells today so there are no surprises.
Which edition fits which organisation?
| Your situation | Edition we usually suggest |
|---|---|
| Replacing an antivirus product and adding EDR, with encryption already handled elsewhere | Advanced |
| Laptops leave the office and hold personal data, and you want encryption managed in the same console | Complete |
| Regulated sector, or audit pressure on patching and data handling | Complete or Elite |
| Small IT team that wants patching, DLP and correlated incidents without extra tools | Elite |
| Staff using public GenAI tools with company data | Elite, or add Workforce AI Security |
| You want a 24/7 team watching alerts | Any edition plus Check Point MDR |
If different groups of devices need different protection, for example laptops that need encryption and fixed servers that do not, tell us when you ask for a quote and we will set out the licensing options for that split.
Licensing and how to buy
Every edition is licensed per protected endpoint as a subscription, with the add-ons priced on top. We supply Harmony Endpoint through the Check Point Portal as a managed service provider, so flexible monthly billing may also be available. The factors that change the price are covered in our Harmony pricing and licensing guide. Ask us for a quote: contact us with your device numbers and we will recommend an edition.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Harmony Endpoint Advanced and Complete?
Complete includes everything in Advanced and adds data protection: full disk encryption and removable media encryption. Choose Complete if you want encryption of laptops and USB storage managed from the same console as your threat prevention.
What does Harmony Endpoint Elite include?
Elite includes everything in Complete plus Infinity XDR for Endpoint (with Playblocks automation), posture management (vulnerability and patch management), endpoint DLP and GenAI security.
Does Harmony Endpoint Advanced include EDR?
Yes. EDR, with automated forensics reports, MITRE ATT&CK mapping and threat hunting, is included in every current edition, starting with Advanced. XDR is the part reserved for Elite or the XDR add-on.
What happened to Harmony Endpoint Basic and Prevent?
They appear in an earlier Check Point brief: Prevent covered threat prevention and access control, and Basic added browser security and EDR. Check Point's 2025 brief lists only Advanced, Complete and Elite, with Advanced as the entry package. If you hold Basic or Prevent, ask us to map it to the current editions before renewal.
Can I change Harmony Endpoint edition mid-term?
Moving up is a licence and policy change on the same agent, so it is straightforward technically. How an upgrade is billed mid-term depends on how you buy, so ask us and we will set out the options.