LICENSEWARE

Apex One, Deep Security and Cloud One licensing

This article is about the licensing of Trend Micro's pre-Vision One enterprise products, Apex One, Apex Central, Deep Security and Trend Cloud One, and their move to Trend Vision One credits. For the credit model itself see Trend Vision One credits.

On This Page

Apex One, Deep Security and Cloud One licensing covers the enterprise endpoint, server and cloud workload products that Trend Micro sold before consolidating on Trend Vision One. Apex One (with its console, Apex Central) and Deep Security are activated with Activation Codes that carry a seat quantity; Apex Central’s licence view reports for each managed product “The number of seats the Activation Code allows”, together with the Activation Code, licence status and expiration date.[2] Trend Cloud One, the SaaS successor to Deep Security as a Service, was billed either per hour of use through AWS Marketplace or by an annual subscription.[9] All of these products are governed by the Global Products Agreement, and several now have End-of-Sale and End-of-Life dates, with Vision One Endpoint Security and Server & Workload Protection as their credit-licensed successors.[12]

Editions

Product Delivery Licensing unit Lifecycle status in the EOL list 
Apex One On-premises Seats on an Activation Code Supported (no dates listed) 
Apex One as a Service SaaS Seats on an Activation Code End-of-Sale 2025-12-31, End-of-Life 2027-12-31 
Apex Central On-premises console Licence for managed products Supported (no dates listed) 
Deep Security On-premises (Deep Security Manager) Seats per module package on an Activation Code End-of-Life set per Long-Term Support and Feature Release lines (see the list’s note) 
Deep Security Virtual Appliance VMware NSX Seats on an Activation Code End-of-Sale/End-of-Renewal entry: “31-Dec-21 the date of NSX-4.X EOSL (if it reaches before 31-Dec-27)” 
Cloud One Workload Security SaaS Protection-hours or annual subscription End-of-Sale 2025-12-13, End-of-Life 2027-12-31 
Cloud One Endpoint Security SaaS As above End-of-Sale 2025-10-01, End-of-Life 2027-12-31 
Cloud One Network Security SaaS GB of traffic inspected End-of-Sale 2026-10-01, End-of-Life 2027-12-31 
Cloud One File Storage Security, Cloud One Sentry SaaS Scans per hour; per AWS account per hour End-of-Sale 2025-09-30, End-of-Life 2026-12-31 
Cloud One Conformity, Cloud One Container Security SaaS Per account; per node End-of-Life 2026-07-31 and 2025-12-31 

The lifecycle dates are from the supported and End-of-Life products list as updated on 2026-09-30.[12] The list defines End-of-Sale as the date a product stops being available for purchase or renewal and End-of-Life as the date maintenance is no longer available.[12] Deep Security consists of six module packages: Anti-Malware and Web Reputation; Firewall and Intrusion Prevention; Integrity Monitoring and Application Control; Log Inspection; Deep Security Scanner; and Multi-Tenant. Each package can be licensed fully or on a trial basis (rule).[4]

Metrics

  • Seat (Activation Code licence) for Apex One, products managed by Apex Central, and Deep Security.[2] For Deep Security, “An activation code is also known as a license”.[5]
  • Protection-hour for Cloud One Workload Security: “Cost is based on hours during which your computers are protected by a Deep Security Agent.”[10]
  • Agent seat for the legacy Deep Security as a Service Annual + Pay as You Go listing, where “1 seat equals 1 agent”.[10]

Counting / floors

Apex One

Apex One shows licence reminders 60 days before a full licence expires and during a grace period whose length “varies by region”. After expiry and the grace period the customer can no longer get technical support or component updates, although scanning continues with out-of-date components. When a trial licence expires, component updates, scanning and all agent features are disabled (rule).[1] Licences are renewed by entering a new Activation Code in the product.[1]

Since 2022-12-01, support for Apex One (on-premises and SaaS) and Apex Central has been based on the release date of each program build: a build is supported for 18 months after the month of release, and fixes are produced only on the latest build (rule).[3] On-premises Apex One receives patch releases twice a year and Apex One as a Service monthly updates.[3] Because Maintenance covers Updates, a customer that stops renewing Maintenance also stops receiving the builds needed to stay within this 18-month window.

Deep Security

Every computer protected by a Deep Security Manager using a given activation code consumes that code’s seats; Trend describes a single DSM environment as using one licence (rule).[7] Seat counts per licence are shown in the Customer Licensing Portal, reached from the Licenses page of the manager.[4] Trend notes that previously added Deep Security licences can be found in the Customer Licensing Portal, but new keys may no longer be registered to an existing account once the registration period has lapsed, without affecting product function.[8]

When a full licence expires, all modules keep working, including Anti-Malware, Web Reputation, Firewall, Intrusion Prevention, Integrity Monitoring and Log Inspection, but pattern, rule and engine updates are disabled (rule).[6] The manager raises alerts when a module is about to expire or has expired.[4]

Cloud One protection-hours

Workload Security counts protection-hours; a partial hour within a clock-hour counts as a full hour. For computers under an AWS, Azure or GCP cloud connector, protection-hours run while the instance is powered on, including hours when the agent is Offline, and stop when the instance is powered off or deleted or the agent is uninstalled. Agents must be deactivated before being uninstalled, or charges continue. For data-center computers, Offline hours are excluded (rule).[10]

The published pay-as-you-go rates were:[9]

Billing tier Scope USD per instance-hour 
Essentials Anti-Malware, Web Reputation and Activity Monitoring (XDR) only 0.007 
Medium or smaller For example EC2 T2, Amazon WorkSpaces, Google Cloud 1 vCPU 0.011 
Large For example EC2 C4, M4, R3, Google Cloud 2 to 3 vCPUs 0.032 
Extra-large and greater Larger EC2 families, Google Cloud 4 or more vCPUs 0.047 
Data Center (not cloud) vCenter or not under a cloud connector 0.047 

Size-based rates apply only under a cloud connector; computers outside a connector or in a vCenter account are billed at the Data Center rate regardless of size (rule).[9] Other Cloud One services were billed per GB of traffic inspected (Network Security, USD 0.014/GB), per protected container node (Container Security, USD 0.168), by files scanned per hour with a free tier (File Storage Security), and per cloud account size (Conformity, free below 250 resources).[9]

Virtualization & partitioning

Deep Security and Cloud One count protected computers through their agents, with no host-based alternative in the cited documents. The Deep Security Virtual Appliance for VMware NSX has an End-of-Sale/End-of-Renewal entry tied to 2021-12-31 and to the end of support of NSX 4.x if that falls before 2027-12-31.[12] In Cloud One, virtual machines in a vCenter account were billed as data center computers at the highest rate.[10]

Cloud / BYOL

A Cloud One account has a single subscription and can be subscribed through AWS Marketplace or an annual subscription, not both (rule).[11] Pay-as-you-go usage was reported hourly and billed monthly through the marketplace; custom and prepaid annual pricing was also available through AWS Marketplace.[9][11] Linking a subscription to a different Cloud One account puts the previous account into a 48-hour grace period.[11]

Expiry depends on the billing method. Accounts without a valid subscription lose access and are deleted 60 days after the original expiry.[9] If an annual Workload Security subscription is not renewed, no new activations are allowed and pattern and rule updates stop, though servers stay protected with possibly outdated components.[10]

Programs

  • Cloud One pay-as-you-go and Cloud One annual subscription.[9]
  • Legacy Deep Security as a Service Annual + Pay as You Go, no longer offered for new deployments: seats bought for 1 month or 1, 2 or 3 years, with overage at the pay-as-you-go rate. Trend applies the seats to the largest instances and the pay-as-you-go rate to the smallest (rule).[10] Credit-card billing has also been withdrawn for new deployments.[10]
  • Paid Maintenance for perpetual Apex One and Deep Security licences: one year included from Delivery, then yearly renewals.[15]

Migration to Vision One credits

When customers update to Vision One Endpoint Security, existing entitlements are converted to credits on activation: Endpoint Security Core at 45 credits per seat, Essentials at 65 and Pro at 300.[13] Existing SAP Scanner licences converted automatically to credits when customers updated from Cloud One Endpoint & Workload Security to Vision One Server & Workload Security, as announced on 2024-12-02.[14] The GPA’s End-of-Life clause means that End-of-Sale gives no right to compensation as long as Trend fulfils existing Orders.[15]

Out of scope

Deep Discovery, ScanMail, InterScan and other gateway and appliance products are also activated with Activation Codes but are not covered here. Trend publishes no list price for Apex One or Deep Security seats.

References

  1. Apex One: Product License Status SectionPage not date-stamped. Catalog: Apex One: Product License Status SectionRetrieved 2026-09-30.
  2. Apex Central: Detailed Product License InformationPage not date-stamped. Catalog: Apex Central: Detailed Product License InformationRetrieved 2026-09-30.
  3. Trend Micro Apex One Support Policy (KA-0013579)Last updated 2025-05-08. Catalog: Trend Micro Apex One Support PolicyEffective 2025-05-08. Retrieved 2026-09-30.
  4. Deep Security: Check your license informationPage not date-stamped. Catalog: Deep Security: Check your license informationRetrieved 2026-09-30.
  5. Deep Security 20: Add activation codesPage not date-stampedRetrieved 2026-09-30.
  6. Features dependent on activation code in Deep Security (KA-0003670)Last updated 2025-05-08. Catalog: Features dependent on activation code in Deep SecurityEffective 2025-05-08. Retrieved 2026-09-30.
  7. Identifying Deep Security License Usage (KA-0016231)Last updated 2025-05-08. Catalog: Identifying Deep Security License UsageEffective 2025-05-08. Retrieved 2026-09-30.
  8. Finding the activation code, pattern, scan engine, and product version of Deep Security and Deep Security as a Service (KA-0002366)Last updated 2025-05-08Effective 2025-05-08. Retrieved 2026-09-30.
  9. Trend Cloud One: About subscriptions and billingPage not date-stamped. Catalog: Trend Cloud One: About subscriptions and billingRetrieved 2026-09-30.
  10. Trend Cloud One Workload Security: About billing and pricingPage not date-stamped. Catalog: Trend Cloud One Workload Security: About billing and pricingRetrieved 2026-09-30.
  11. Trend Cloud One: Frequently Asked Questions for subscriptions and billingPage not date-stamped. Catalog: Trend Cloud One: Frequently Asked Questions for subscriptions and billingRetrieved 2026-09-30.
  12. Supported and End-of-Life TrendAI Products and Services (KA-0004690)Last updated 2026-09-30. Catalog: Supported and End-of-Life TrendAI Products and ServicesEffective 2026-09-30. Retrieved 2026-09-30.
  13. How does credit calculation work for Server & Workload Protection?Page not date-stamped. Catalog: How does credit calculation work for Server & Workload Protection?Retrieved 2026-09-30.
  14. Server & Workload Security SAP Scanner feature now uses TrendAI Vision One creditsDated 2024-12-02Effective 2024-12-02. Retrieved 2026-09-30.
  15. Global Products Agreement for Trend ProductsPublication Date 20 May 2026. Catalog: Global Products Agreement for Trend ProductsEffective 2026-05-20. Retrieved 2026-09-30.

See also

Catalog Rows Cited

8Rules3Metrics3Programs

Esc