Aurora Endpoint Security is the family name Arctic Wolf uses for the endpoint products it sells under the “formerly Cylance” heading on its legal page.[10] The Product List names four Aurora Endpoint Security Products: Aurora Endpoint Defense, Aurora Managed Endpoint Defense, Aurora Protect and Aurora Mobile Threat Defense.[2] All of them are governed by the General Terms plus product-specific Supplemental Product Terms. Use is limited to the licence counts and metric on the Order Form.[12][1] The licensing unit throughout is the endpoint. Arctic Wolf publishes no endpoint price list.
Editions
| Product | What it is | Earlier name |
|---|---|---|
| Aurora Protect | AI-driven endpoint protection that prevents malware and ransomware before execution[4] | Cylance PROTECT[4] |
| Aurora Endpoint Defense (AED) | Aurora Protect plus the Aurora Focus Agent for detection and response[4] | CylanceMDR software platform[5] |
| Aurora Managed Endpoint Defense (MED) | 24x7x365 managed EDR in which Arctic Wolf SOC analysts monitor and respond using Aurora Endpoint Defense[4] | CylanceMDR On Demand (legacy name used for both MED and MED On Demand)[5] |
| Aurora Managed Endpoint Defense On Demand | On-demand managed EDR help when the customer raises a Service Request[5] | CylanceMDR On Demand[5] |
| Aurora Mobile Threat Defense (MTD) | Mobile protection delivered through a third-party mobile app[8] | None |
The On Demand Product Description maps further legacy names. CylancePROTECT may also be called CylanceENDPOINT Standard, and CylancePROTECT with CylanceOPTICS may be called CylanceENDPOINT Advanced. Both are among the “Managed Arctic Wolf Software” that the managed services cover.[5] The Supplemental Product Terms also mention Aurora Protect Server as a product whose data the Solution may process.[1] A Solution may include Software, Services (such as Technical Support Services and cloud services) and Documentation, to the extent identified on the Order Form.[1]
Metrics
Endpoint. The Aurora product descriptions define “Endpoints” as “wireless devices, desktops, computer systems and any other endpoints with which the Solution operates”.[3] On its wording, the definition reaches beyond desktops to wireless devices and other computer systems. Catalog: Endpoint.
Device (MSP). For MSP delivery, the Aurora Endpoint Defense PDR defines a Device as any computing network, environment or equipment that accesses or uses the Solutions. The list includes desktops, laptops, smart phones, tablets, point-of-sale terminals and industrial control systems, and the definition “further includes non-persistent deployments and virtual machines”. A Transaction grants the right to use the Solution on a specified number of Devices “(or other chargeable unit)”.[6] Catalog: Device (MSP Aurora Endpoint Defense); rule MSP endpoint Devices include virtual machines and non-persistent deployments.
Service Request. Managed Endpoint Defense On Demand allows up to five Service Requests a month and no more than sixty a year. Additional requests may cost extra.[5] Catalog: Service Request; On Demand service is capped at 5 Service Requests a month and 60 a year.
Counting / floors
Licence parity for managed services. An On Demand customer must buy enough On Demand subscription licences to cover all of its licences for the managed Aurora software. The two numbers must match.[5] A licence manager should therefore reconcile two entitlements against one endpoint population: the Aurora Protect or Endpoint Defense licences, and the managed service licences. Catalog: Managed Endpoint Defense On Demand licences must match the managed software licences.
Monthly audit and overage. Arctic Wolf may monitor and audit On Demand usage every month. If authorized usage is exceeded, the customer pays for the excess endpoints at Arctic Wolf’s then-current price list, plus interest. Refusing to provide information or to pay is a material breach.[5] This is stricter than the General Terms audit, which invoices excess licences pro rata to the end of the term.[12] Catalog: Monthly usage audit; excess endpoints billed at the then-current price list.
Installation reporting. MSPs must have each customer record the locations and number of installations in the Tenant or Multi-Tenant Console within 30 days of delivery. The records must be updated within 30 days of any change.[6] Catalog: Install counts and locations reported within 30 days.
Support depends on licences. Technical Support Services are subject to payment for the required period and “number and type of licenses” on the Order Form. Customers may need to update Software to keep using the Solution.[1] Catalog: Technical support depends on the number and type of licences paid for.
No published floors. No minimum endpoint quantity is published. The Managed Endpoint Defense role tables make the customer responsible, with Arctic Wolf, for maintaining endpoint configuration health and protection coverage.[4]
Virtualization & partitioning
Under the MSP terms, virtual machines and non-persistent deployments are Devices.[6] Arctic Wolf’s deployment guidance explains the counting risk in VDI. A non-persistent VM is deleted at the end of the session and replaced from the same gold image. Each new VM then registers with the console, which creates duplicate device records for what should be one endpoint.[7] Installing the agent on the gold image with the VDI=1 (or AD=1) parameter switches to VDI fingerprinting, and duplicates are then not registered.[7] Arctic Wolf recommends enabling device lifecycle management (DLCM), which removes and de-registers devices that stay inactive for a set period. Gold image template devices must be excluded from DLCM.[7] Supported platforms include Azure Virtual Desktop and Windows 10 and 11 Enterprise multi-session, Citrix, VMware Horizon and Microsoft Hyper-V.[7] Catalog: Use VDI fingerprinting on gold images to avoid duplicate device registrations. For the general issue, see virtualization and partitioning.
The guidance is technical, but it matters for licensing. The General Terms audit clause checks licence counts against the records the customer provides, so duplicate device records in the console can overstate the count.[12]
Cloud / BYOL
The management console is cloud-hosted. Customer data is stored in third-party data centres that the customer selects, as shown in the Unified Portal.[1] Some configurations send files to Arctic Wolf servers for analysis. Arctic Wolf may use anonymised file hashes for research and product development.[1] Mobile Threat Defense data is stored in the United States and deleted on a rolling 90-day basis.[8] No separate cloud or bring-your-own-licence metric is published.
Programs
- Trial license. An Aurora endpoint Solution provided for internal testing runs for a limited Trial Period. Arctic Wolf can extend or end it by email, and it ends automatically when the Trial Period expires.[1] Mobile Threat Defense Trial Access lasts 30 days from activation.[8] Catalog: Trial Access.
- MSP and MSP Plus. Partners may distribute and install the Solutions on Devices owned or controlled by their customers and manage them through the Multi-Tenant Console. They may also run Evaluations under the Program Guide.[6] The customer consents to its MSP or MSP Plus partner managing its Tenants. Arctic Wolf disclaims liability for the partner’s services.[1] Catalog: MSP and MSP Plus partner delivery.
- AMED warranty. Aurora Managed Endpoint Defense can qualify for Security Operations Warranty benefits. Schedule 1 lists USD 100K for AMED alone with a three-year term. For AMED-level benefits, the solution must be fully deployed within 45 days of the Order Form.[9] Catalog: AMED warranty benefits need full deployment within 45 days.
- Mobile Threat Defense app. End Users must download a mobile app from a third-party provider’s store listing and accept that provider’s end user licence agreement. Arctic Wolf’s liability for MTD is capped at the fees for the 12 months before the claim.[8]
Termination
Ending an Aurora endpoint subscription needs action on the endpoints. If the customer does not immediately stop using the Solution and delete all copies of the Software, the subscription does not terminate and fees stay payable.[1] Catalog: Endpoint subscription continues while the software stays in use. Partner orders under the Terms and Conditions of Sale renew automatically for 12 months at the same quantities unless notice of non-renewal is given 30 days before the end of the term.[11] Catalog: Legacy Aurora (Cylance) resale subscriptions renew for 12 months at the same quantities.
Out of scope
This article does not cover CylanceGATEWAY, CylanceHYBRID, on-premises or air-gapped console options, OEM licensing of the Aurora engine, or technical support tiers. Arctic Wolf MDR’s own endpoint agent is covered in Arctic Wolf MDR, bundles and Security Operations Warranty.