In short: ThreatDown is Malwarebytes' business security brand. One agent and cloud console provide endpoint protection, EDR with ransomware rollback, 24/7 MDR, vulnerability and patch management, DNS filtering, email security, mobile security and identity threat detection, sold in Core, Advanced, Elite and Ultimate MDR Plus bundles and managed for multiple customers through OneView.
What ThreatDown is
Malwarebytes introduced ThreatDown to separate its business products from its consumer antivirus; the old Malwarebytes for business web address now leads to ThreatDown. Products are often labelled "ThreatDown, powered by Malwarebytes", and older invoices may still say Malwarebytes Endpoint Protection or Malwarebytes EDR.
There are two consoles. Nebula is a single-tenant console for organisations that run their own security. OneView is a multi-tenant console that IT providers use to manage many customers, with each organisation as a separate site. We manage ThreatDown through OneView, and you can be given access to your own site's dashboards.
ThreatDown bundles
ThreatDown sells four bundles, each building on the one before. Feature differences, without prices:
| Bundle | What it adds | Typical fit |
|---|---|---|
| Core | Next-generation antivirus, automated incident response, device control, application blocking, vulnerability assessment, browser phishing protection and AI visibility | Replacing traditional antivirus |
| Advanced | Core plus EDR, ransomware rollback (restoring files for up to seven days after an attack), patch management, host firewall management, drive encryption and managed threat hunting | Organisations with IT staff who can act on alerts |
| Elite | Advanced plus 24/7 managed detection and response and ThreatDown AI, which turns security data into plain-language recommendations that admins approve | Small and mid-size organisations without a security team |
| Ultimate MDR Plus | Elite plus identity threat detection and response, MDR Plus (malware removal, root cause analysis, threat intelligence, dark web exposure monitoring and a published SLA) and premium support | Organisations wanting endpoint and identity covered by MDR |
DNS filtering, email security, server protection and mobile security are add-ons, ITDR can be added to Advanced and Elite, and inclusions change from time to time, so we confirm current bundle contents before quoting. Licensing detail is on softwarelicensing.uk/threatdown.
Modules beyond the endpoint
The same agent and console cover several adjacent controls, which is ThreatDown's main appeal for smaller teams:
- ITDR: identity threat detection and response across Active Directory, Entra ID and Okta, covering compromised credentials, privilege abuse and non-human identities such as service accounts; compared with other options on our ITDR page.
- DNS Filtering: blocks access to malicious and unwanted websites at DNS level; see DNS filtering.
- Email Security: protection for inboxes against advanced phishing; see email security for how it compares with dedicated options.
- Vulnerability and Patch Management: finds vulnerable software and deploys operating system and third-party patches.
- Mobile Security: protection for Android, iOS, iPadOS and Chromebook devices.
- AI visibility: the first phase of ThreatDown AI Detection and Response, which uses the existing agent to inventory installed and browser-based AI tools on managed devices, including shadow AI, so you can mark each as authorised or not; see generative AI security.
ThreatDown MDR
ThreatDown MDR provides analysts who monitor, investigate and remediate threats 24/7, included from the Elite bundle. With ITDR in place, the MDR team also watches identity activity. The Ultimate MDR Plus bundle adds MDR Plus services such as malware removal, root cause analysis and dark web exposure monitoring. For organisations that only want expert hunting rather than full response, managed threat hunting is included from the Advanced bundle.
As with any managed service, agree the response actions you authorise and how you are informed. Our managed detection and response guide compares ThreatDown MDR with other providers.
Who ThreatDown suits
ThreatDown fits small and mid-size organisations that want a straightforward bundle with MDR included, and those that value patching, DNS filtering and identity protection from one console without stitching tools together. Larger estates with dedicated security teams may prefer broader platforms such as CrowdStrike Falcon or SentinelOne Singularity; see the endpoint security and XDR hub for the wider comparison.
How we help
ThreatDown is a reasonable step up for organisations that already run Malwarebytes on some devices, because the agent and console carry over. When moving from another product, deploy the agent to a pilot group first, check that ransomware rollback and patching behave as expected with your applications, and confirm who is notified when MDR analysts act on a device.
We choose the right bundle and add-ons, deploy the agent through your management tools, remove the previous antivirus cleanly, and run the estate day to day from OneView. Licensing is per endpoint, with ITDR licensed per identity; ask us for a quote.
Contact us to discuss ThreatDown.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is ThreatDown the same as Malwarebytes?
ThreatDown is Malwarebytes' business brand. It covers the company's business endpoint, EDR, MDR and related products, while the Malwarebytes name continues for consumer products. Many business products are labelled ThreatDown, powered by Malwarebytes.
What is the difference between ThreatDown Advanced and Elite?
Advanced adds EDR, ransomware rollback, patch management, firewall management, drive encryption and managed threat hunting to the Core antivirus bundle. Elite adds 24/7 managed detection and response, where ThreatDown analysts monitor and respond for you.
What is ThreatDown OneView?
OneView is ThreatDown's multi-tenant console for IT providers. It lets a provider manage endpoint security, EDR, MDR, patching and other modules for many customer organisations, each as a separate site, with centralised visibility across them.
Does ThreatDown include DNS filtering and email security?
Both are available as add-ons to every bundle, including Ultimate MDR Plus, rather than being included. They are managed from the same console as endpoint protection.