Malwarebytes licensing covers two families. The first is the ThreatDown business products: endpoint protection, endpoint detection and response (EDR), managed detection and response (MDR) and add-ons managed in the Nebula and OneView consoles. The second is the Malwarebytes consumer and very-small-business software (Malwarebytes for Home and Malwarebytes for Teams). ThreatDown describes its platform as born from the security lineage of Malwarebytes.[12] Malwarebytes’ own legal page refers business customers to threatdown.com/legal for ThreatDown terms.[11] The ThreatDown Software License Agreement is with ThreatDown Inc. for software acquired in the United States or Canada, and with ThreatDown Limited of Ireland elsewhere.[1] It grants a non-exclusive, non-transferable licence to execute the number of copies paid for, on the corresponding number of Devices.[1] For the general model, see concurrent and device licensing.
Editions
| Family | Editions in vendor documents | Licensing unit |
|---|---|---|
| ThreatDown bundles | Core (“Core Next-Gen AV”), Advanced (“Advanced EDR”), Elite (“Elite MDR”), Ultimate (“Ultimate MDR Plus”)[3] | Devices, per year, with a three-year option[3] |
| ThreatDown add-ons | Server Protection, Mobile Security, Premium Support[3] | Devices; support tier |
| ThreatDown Email Security | Email Security[1] | Per email address[1] |
| ThreatDown ITDR | ITDR[1] | Per Account in connected identity providers[1] |
| ThreatDown Site License | Site License[1] | Employee-count band[1] |
| Malwarebytes for Teams | Sole proprietor (3 devices), Boutique business (10), Small office (20)[4] | Devices, per year[4] |
Bundle and add-on detail is in ThreatDown bundles and managed services licensing.
Metrics
| Term | Catalog row | Rule |
|---|---|---|
| Device | Device | Devices, computers or virtual machines, with each OS instance on a partitioned or virtualized machine counted as a Device[1] |
| Email address | Email address | Email Security is licensed per email address, not per Device[1] |
| Account | Account | Any account, identity or credential in a connected identity provider, directory or authentication system, regardless of type or status[1] |
| Site License band | Site License employee band | Not limited to a fixed number of Devices; banded by employee count[1] |
| Billable endpoint | Billable endpoint | OneView: unique endpoints active at any point in the monthly cycle[8] |
Counting / floors
Everything that is protected is counted. Outside a Site License, the customer needs a licence for every Device, email address or Account on which the Software operates or which it monitors, analyses or protects.[1] On a network, licences are also needed for each Device, email address or Account that can access the Software.[1] Catalog: A licence is needed for every Device, email address or Account protected; Devices that can access the Software over a network need licences.
Accounts are counted at their peak. ITDR needs a licence for each Account that exists in the connected identity providers at any point during the term.[1] Because Accounts count regardless of type or status, the requirement follows the highest count during the term, not the count of active employees. Catalog: ITDR covers every Account that exists at any point in the term.
Servers. Paid licences may not run on a server operating system unless the product is a ThreatDown server product.[1] Catalog: Server operating systems need a ThreatDown server product.
Console seats. In Nebula each product has its own seat allocation unless a bundle is bought, in which case every subscription has the same number of seats. Over-use alerts usually come from policies that enable a feature on more endpoints than were bought.[9] Catalog: Nebula seats are allocated per subscription.
Floors. The EULA sets no minimum quantity. The online store’s device selector defaults to 5 devices.[3] Malwarebytes for Teams may be used only by businesses with no more than 25 Devices.[2] Catalog: Malwarebytes for Teams is only for businesses with up to 25 Devices.
Virtualization & partitioning
ThreatDown has no host-based or core-based model. Each instance of an operating system on a partitioned or virtualized machine counts as a Device.[1] In a VDI pool, every virtual desktop running the agent therefore needs a Device licence. Catalog: Each OS instance on a virtualized or partitioned machine is a Device. See virtualization and partitioning.
Cloud / BYOL
Nebula and OneView are SaaS consoles. The EULA covers the SaaS delivery services together with the software. Access is conditional on continued compliance with the Documentation’s deployment, configuration, telemetry and account requirements.[1] No bring-your-own-licence or hyperscaler marketplace terms appear in the cited documents.
Programs
- Trial. Evaluation only, with up to five Devices for 30 days for the business download.[1]
- OneView usage billing, upfront billing and NFR. MSPs subscribe to a maximum protection level and are billed monthly for the endpoints actually deployed.[8] See ThreatDown OneView MSP licensing.
- Managed Services. MDR and Managed Threat Hunting are sold only for all of a customer’s endpoints and require EDR on every endpoint.[5]
- Small Business Exception. A business with no more than 10 Devices may use paid Malwarebytes for Home software for business under the Teams terms. Otherwise Home software is for personal, non-commercial use only.[2] Catalog: Malwarebytes for Home is personal, non-commercial use only.
Contract terms
ThreatDown publishes its Software License Agreement, Support Service Agreement, Managed Services Agreement and data processing terms on one legal page.[10] The main licensing terms are:
- Term and renewal. The term runs from the Purchase Receipt date, by default for one year, and subscriptions renew automatically unless the customer opted out.[1]
- Transfers. Each subscription year, up to 10% of licensed Devices may be moved once to a new Device.[1] The Agreement itself cannot be assigned without consent.[1]
- Payment. Fees are charged at the start of the term and are not refunded for the current period.[1]
Details are in ThreatDown Software License Agreement.
Support and lifecycle. Standard support comes with Incident Response, Endpoint Protection, EDR and Education Site License subscriptions.[6] Business application versions reach End of Life 12 months after End of Maintenance.[7]
Audits and compliance
Unlike many endpoint vendors, ThreatDown has a full audit clause. During the term and for one year after, on reasonable notice, ThreatDown may audit the customer’s systems and accounts for the number and type of Devices and for compliance.[1] Each Device found beyond what was ordered and paid for is charged as liquidated damages at the current list price, including related support. The charge covers the longer of the period it was used or 12 months, and the customer also pays reasonable audit costs.[1] Catalog: ThreatDown may audit during the term and for one year after; Over-deployment found in audit is charged at list price for at least 12 months. See software license audit.
Out of scope
- Consumer products (Malwarebytes Standard, Plus and Premium, Identity Theft Protection, Personal Data Remover) beyond their business-use restrictions.
- Prices, which the online store shows by region and partners quote.
- ThreatDown products sold through distributors under distributor terms, and partner programme agreements on the partner portal.
- Legacy Malwarebytes business products past End of Life.