In short
Malwarebytes for business pricing depends on the ThreatDown bundle, add-ons and number of devices. Direct, ThreatDown sells four bundles: Core Next-Gen AV, Advanced EDR, Elite MDR and Ultimate MDR Plus, with add-ons such as server protection and DNS filtering. Through Forever Systems, modules are billed monthly per endpoint, user or mailbox. Ask us for a quote.
Get a quote for ThreatDown
Ask us for a quote and we will reply by email with options priced for your organisation.
How ThreatDown pricing works
There are two ways to buy Malwarebytes for business, and they are priced differently:
- Direct from ThreatDown: you choose one of four bundles, priced per device per year (with multi-year options), and add optional extras.
- Through an IT provider using ThreatDown OneView, such as Forever Systems: each module is switched on per endpoint and billed monthly on what was protected that month, so there is no bundle to buy up front.
Either way, the price is driven by the same things: which capabilities you need, how many workstations, servers, users or mailboxes they cover, and the term. We do not publish prices, because the right answer depends on your estate; ask us for a quote. Product details are on our ThreatDown Endpoint Protection page.
The four ThreatDown bundles
ThreatDown's pricing page sets out four bundles, each building on the one before:
| Bundle | Headline capability | What it typically adds |
|---|---|---|
| Core Next-Gen AV | Next-generation antivirus | Next-gen antivirus, incident response (automated remediation), device control, Application Block, vulnerability assessment, browser phishing protection and AI visibility |
| Advanced EDR | Detection and response | Core plus EDR with isolation and ransomware rollback, patch management, host firewall management, drive encryption and managed threat hunting |
| Elite MDR | Managed detection and response | Advanced plus ThreatDown's MDR service and its AI assistant |
| Ultimate MDR Plus | MDR Plus | Elite plus MDR Plus, with ITDR and Premium Support included |
The right-hand column reflects the ticks on ThreatDown's pricing page at the time of writing. Bundle contents change over time, so we confirm exactly what is included for your quote before you commit.
Not sure which bundle fits? Ask us
We will match the right bundle to your requirements and quote for it.
ThreatDown add-ons
ThreatDown lists these as add-ons alongside the bundles:
| Add-on | What it covers | Notes |
|---|---|---|
| Server Protection | Physical and virtual servers | Servers are licensed separately from workstations |
| DNS Filtering | Blocks malicious and unwanted web categories at DNS level | Add-on to every bundle |
| Email Security | Phishing detection and remediation for cloud mailboxes | Counted by mailbox |
| Mobile Security | Phones and tablets | Counted by device |
| ITDR | Identity threat detection and response | Included in Ultimate; an add-on to Advanced and Elite; not offered with Core |
| Premium Support | Enhanced vendor support | Included in Ultimate; an add-on to lower bundles |
Server protection is the add-on most often missed when comparing quotes: a price for Core on twenty laptops does not cover the file server. Our server antivirus guide explains why vendors license servers separately.
Buying direct vs through Forever Systems
| Direct from ThreatDown | Through Forever Systems | |
|---|---|---|
| How you buy | One of four bundles | Individual modules switched on per endpoint |
| Billing | Yearly, with multi-year options | Monthly, on usage recorded in the console |
| Console | Nebula (single-tenant) | OneView (multi-tenant), with access to your own site's dashboards |
| Mixing capabilities | Same bundle across the licence | Different modules for different devices, such as EDR on servers only |
| Who sets it up | You | We can deploy, set policies and handle licence changes |
The monthly model suits organisations whose device count changes, because a new laptop simply appears on the next invoice and a retired server drops off. It also means you pay for EDR only where you have switched it on. Our licensing site explains monthly vs annual licences in general.
Want a price for your organisation?
Tell us your users, sites and timescales and we will come back with a clear quote.
What drives the cost
Whichever route you choose, these are the factors that move the price:
- Number of workstations and laptops, the main licence count.
- Number of servers, licensed separately from workstations.
- Capability level: antivirus only, or EDR, managed threat hunting or MDR on top.
- Add-ons such as DNS filtering, Application Block, patch management, mobile security, email security (per mailbox) and ITDR (per user).
- Term: a yearly or multi-year bundle direct, or monthly usage billing through us.
For how per-device and per-user counting compare across vendors, see per-user vs per-device licensing. Our business antivirus cost guide compares pricing models across all the vendors we supply.
Which bundle fits?
A short set of questions narrows it down:
- Do you just need to replace antivirus? Core-level protection (next-gen antivirus, device control, browser phishing protection and incident response) is the starting point.
- Is an insurer or auditor asking about EDR? You need EDR-level protection, with isolation and seven-day ransomware rollback.
- Will anyone watch alerts out of hours? If not, ThreatDown's MDR service is the step that puts ThreatDown's analysts on your alerts; that is ThreatDown's service.
- Are identity attacks a concern? ITDR covers Active Directory, Entra ID and Okta. It is included in Ultimate and can be added to Advanced or Elite, but ThreatDown does not offer it with Core.
Through us you do not have to pick one bundle for every device: we can switch on different modules for different groups. For a broader view of where EDR and MDR fit, see EPP vs EDR and managed antivirus.
Comparing ThreatDown quotes like for like
Quotes for Malwarebytes for business often look different because they are built differently. Before comparing, check:
- Are servers included? Server protection is an add-on, so a workstation-only figure is not the full cost.
- Which capability level? A Core quote and an Advanced quote are not comparable; EDR and ransomware rollback come with Advanced.
- Yearly bundle or monthly modules? A bundle bought direct is priced for a set number of devices over the term; monthly usage billing follows your actual numbers.
- Which add-ons are in the price? DNS filtering, mobile security, email security and ITDR are listed separately by ThreatDown.
- Who deploys and looks after it? A licence-only price and a price that includes setup and licence management are different things.
If you send us another quote, we can lay ours out line by line against it.
Getting a ThreatDown quote
To quote accurately we need a rough count of workstations, Macs, Linux devices and servers, any mobile devices or mailboxes you want covered, and what you run today. If you already have a ThreatDown or Malwarebytes renewal notice, send that too and we will match the modules. Our licensing site has more on ThreatDown licensing and the OneView model.
Contact us and ask us for a quote.
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro, Sophos, Check Point, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
How much is Malwarebytes for business?
It depends on the ThreatDown bundle or modules, the number of workstations and servers, any add-ons and the term. We do not publish prices; ask us for a quote and we will itemise every module.
Is ThreatDown priced per device or per user?
Endpoint modules are counted per device (endpoint), with servers counted separately. Email security is counted per mailbox and identity protection (ITDR) per user.
Can I pay for ThreatDown monthly?
Yes, through Forever Systems. We supply ThreatDown through OneView and bill each module monthly on the endpoints, users or mailboxes it protected that month. Buying direct from ThreatDown is a yearly or multi-year bundle.
Are servers included in ThreatDown bundles?
ThreatDown lists Server Protection as an add-on, and servers are licensed separately from workstations. Make sure any quote you compare includes your servers.
What is the difference between ThreatDown Core and Advanced?
Core is the next-gen antivirus bundle. Advanced adds EDR with isolation and ransomware rollback, patch management, host firewall management, drive encryption and managed threat hunting. We confirm exact inclusions at quote.
What does ThreatDown Ultimate include?
Ultimate MDR Plus builds on Elite MDR and, per ThreatDown's pricing page, adds MDR Plus, ITDR and Premium Support. Premium Support is an add-on to the lower bundles, and ITDR an add-on to Advanced and Elite.
Still have a question about ThreatDown?
Ask us and a member of our team will reply by email.
More endpoint protection guides
ThreatDown (Malwarebytes)Malwarebytes endpoint protection, now ThreatDown: next-gen antivirus for Windows, macOS and Linux, servers and add-ons.CostWhat drives the cost of business antivirus, without the guesswork.
CrowdStrikeIs CrowdStrike an antivirus? Falcon Prevent next-gen antivirus, the bundles we supply and how it is licensed.
SentinelOneIs SentinelOne an antivirus? Singularity Endpoint's AI prevention, rollback and packages, and how it is licensed.Managed antivirusAntivirus deployed, configured and kept in order for you, with vendor-run MDR options.