In short: Harmony Endpoint posture management is vulnerability and patch management built into Check Point Endpoint Security. The agent scans devices for known vulnerabilities (CVEs) in the operating system and third-party applications, ranks them by CVSS score and deploys patches automatically or on demand. It is included in Harmony Endpoint Elite and sold as an add-on for Advanced and Complete.
What posture management does
Unpatched software is one of the most common ways in for attackers, and the hardest part is usually knowing what is out of date across every laptop and server. Posture management adds that job to the Harmony Endpoint agent you already run:
- Discover: the agent checks installed applications against the list held on Check Point's signature server and records every known vulnerability (CVE) it finds; Check Point describes the coverage as operating systems and third-party applications
- Prioritise: each CVE is shown with its CVSS score, and the dashboard highlights vulnerabilities by severity, the riskiest applications and the most exposed devices
- Patch: administrators push patches for selected CVEs or devices, or let policy apply them automatically, with options for users to postpone within limits you set
- Contain: a device with a serious, unpatched vulnerability can be isolated from the network until it is fixed, then released and rebooted from the same screen
- Prove it: the vulnerability table exports to CSV, and the portal produces vulnerability and posture reports for audits and management
Because it shares the agent and the Check Point Portal with the rest of Harmony Endpoint, there is no extra software to deploy and no separate console to keep in step.
How scanning and patching work in practice
Posture assessment is switched on in the Access and Compliance policy. You choose manual scans or an automated schedule (weekly or monthly, at a time you set), and end users can also start a scan and see their own vulnerable software from the client.
Patching can be run three ways: on demand for selected CVEs or devices, enforced by policy with an optional reboot, or as automated patch management on a schedule you set, limited to the applications and severities you choose and with exclusions for software you do not want touched. When a patch runs, the endpoint downloads it directly from the software vendor, so devices need to reach those vendor sites. The console tracks every patch through clear states, such as downloading, executing, pending reboot, updated or failed, and it flags a patch as interrupted when something else, for example Windows Update, installed it first. A single patch can close several CVEs at once.
A few points we plan for during scoping, all taken from Check Point's current admin guide:
- CVE detection is documented for Windows and macOS endpoints only, so Linux servers need another route
- patching has documented limits: it applies to applications installed in the Program Files folder, and patches of 2 GB or more are not downloaded, so some software will still need your usual update route
- you can let users postpone a patch for a set time and then force it, which keeps disruption down without letting updates slip
- administrators can add comments against a CVE or device, for example to record why an application is not being patched
For most organisations posture management complements Windows Update, Intune update rings or Configuration Manager rather than replacing them: Microsoft's tools look after the operating system, and posture management closes the long tail of third-party applications such as browsers, PDF readers and runtimes.
Posture management and Cyber Essentials
The security update management control in Cyber Essentials expects software to be licensed and supported, removed when it is no longer supported, and updated within 14 days of release where a fix addresses a vulnerability rated critical or high risk. That covers a vendor rating of critical or high, a CVSS v3 base score of 7 or above, and updates where the vendor gives no severity at all. Our sister site explains the security update management control in detail.
Posture management maps neatly onto that requirement:
| Cyber Essentials expectation | How posture management helps |
|---|---|
| Know what software is installed and whether it is vulnerable | Scheduled CVE scans across Windows and macOS devices |
| Prioritise critical and high-risk fixes | CVSS scores on every CVE, filterable by severity |
| Apply those fixes within 14 days | Automatic or on-demand patching, with forced installation after a set delay |
| Show evidence to an assessor | CSV exports and vulnerability and posture reports |
| Deal with devices that cannot be fixed quickly | Isolate the device until it is patched or removed |
It does not certify you on its own: unsupported software still has to be removed, and the other controls still apply. Our sister site explains the full Cyber Essentials requirements.
Editions and licensing
| Package | Posture management |
|---|---|
| Harmony Endpoint Advanced | Available as an add-on |
| Harmony Endpoint Complete | Available as an add-on |
| Harmony Endpoint Elite | Included |
Check Point's current solution brief lists two related add-ons: Posture Management, which covers vulnerability management and patch management, and Vulnerability Management, which covers vulnerability management for operating systems and third-party applications without the patching element. Like the rest of Harmony Endpoint, both are licensed per protected endpoint.
If you would buy posture management plus one other add-on, such as XDR or DLP, compare the cost with moving to Elite. Our editions comparison and pricing and licensing guide explain the trade-off, and we will set out both options in a quote.
Who it suits
Posture management is a good fit when:
- you have no dedicated patching tool for third-party applications, or the one you have is another agent to maintain
- you are working towards Cyber Essentials or Cyber Essentials Plus and need evidence of patching within the deadlines
- you are regulated, insured or audited and need regular vulnerability reports
- a small IT team wants one console for prevention, investigation and patching
If you already run a mature patching platform that covers third-party software, the Vulnerability Management add-on (visibility without patching) or simply relying on your existing tool may be enough. We will tell you which.
How we help
We switch on posture assessment, agree scan schedules and postponement limits with you, test patching on a pilot group, and build a monthly report that maps to Cyber Essentials. If you prefer, our support team can review the vulnerability table and push patches for you each month as part of ongoing support.
Contact us to add posture management to an existing estate or to price it as part of Harmony Endpoint Elite.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Harmony Endpoint posture management?
It is vulnerability and patch management inside Check Point Endpoint Security (Harmony Endpoint). The same agent finds known vulnerabilities in the operating system and third-party applications, scores them by CVSS, and deploys patches automatically or on demand.
Is posture management included in Harmony Endpoint?
It is included in Harmony Endpoint Elite. For Advanced and Complete it is an optional add-on. A Vulnerability Management add-on, without patching, is also listed.
Does posture management replace Windows Update or Intune?
Usually not. It complements them. Microsoft's tools handle operating system updates well, and posture management covers vulnerable third-party applications and gives you one view of risk across devices.
Can it help with Cyber Essentials patching?
Yes. Scheduled scans, CVSS scores, forced patching after a delay and exportable reports all support the requirement to apply critical and high-risk updates within 14 days. You still need to meet the other Cyber Essentials controls.
Which operating systems does Harmony Endpoint posture management support?
Check Point documents CVE detection for Windows and macOS endpoints. Patching applies to applications in the Program Files folder and to patches under 2 GB, so we confirm what will be covered in your estate before you buy.
Where do the patches come from?
Each endpoint downloads the patch directly from the software vendor's site, so devices need to be able to reach those sites. The console then rescans to confirm the vulnerability has gone and shows the patch as updated, failed or pending reboot.