Apex One, Deep Security and Cloud One licensing covers the enterprise endpoint, server and cloud workload products that Trend Micro sold before consolidating on Trend Vision One. Apex One (with its console, Apex Central) and Deep Security are activated with Activation Codes that carry a seat quantity; Apex Central’s licence view reports for each managed product “The number of seats the Activation Code allows”, together with the Activation Code, licence status and expiration date.[2] Trend Cloud One, the SaaS successor to Deep Security as a Service, was billed either per hour of use through AWS Marketplace or by an annual subscription.[9] All of these products are governed by the Global Products Agreement, and several now have End-of-Sale and End-of-Life dates, with Vision One Endpoint Security and Server & Workload Protection as their credit-licensed successors.[12]
Editions
| Product | Delivery | Licensing unit | Lifecycle status in the EOL list |
|---|---|---|---|
| Apex One | On-premises | Seats on an Activation Code | Supported (no dates listed) |
| Apex One as a Service | SaaS | Seats on an Activation Code | End-of-Sale 2025-12-31, End-of-Life 2027-12-31 |
| Apex Central | On-premises console | Licence for managed products | Supported (no dates listed) |
| Deep Security | On-premises (Deep Security Manager) | Seats per module package on an Activation Code | End-of-Life set per Long-Term Support and Feature Release lines (see the list’s note) |
| Deep Security Virtual Appliance | VMware NSX | Seats on an Activation Code | End-of-Sale/End-of-Renewal entry: “31-Dec-21 the date of NSX-4.X EOSL (if it reaches before 31-Dec-27)” |
| Cloud One Workload Security | SaaS | Protection-hours or annual subscription | End-of-Sale 2025-12-13, End-of-Life 2027-12-31 |
| Cloud One Endpoint Security | SaaS | As above | End-of-Sale 2025-10-01, End-of-Life 2027-12-31 |
| Cloud One Network Security | SaaS | GB of traffic inspected | End-of-Sale 2026-10-01, End-of-Life 2027-12-31 |
| Cloud One File Storage Security, Cloud One Sentry | SaaS | Scans per hour; per AWS account per hour | End-of-Sale 2025-09-30, End-of-Life 2026-12-31 |
| Cloud One Conformity, Cloud One Container Security | SaaS | Per account; per node | End-of-Life 2026-07-31 and 2025-12-31 |
The lifecycle dates are from the supported and End-of-Life products list as updated on 2026-09-30.[12] The list defines End-of-Sale as the date a product stops being available for purchase or renewal and End-of-Life as the date maintenance is no longer available.[12] Deep Security consists of six module packages: Anti-Malware and Web Reputation; Firewall and Intrusion Prevention; Integrity Monitoring and Application Control; Log Inspection; Deep Security Scanner; and Multi-Tenant. Each package can be licensed fully or on a trial basis (rule).[4]
Metrics
- Seat (Activation Code licence) for Apex One, products managed by Apex Central, and Deep Security.[2] For Deep Security, “An activation code is also known as a license”.[5]
- Protection-hour for Cloud One Workload Security: “Cost is based on hours during which your computers are protected by a Deep Security Agent.”[10]
- Agent seat for the legacy Deep Security as a Service Annual + Pay as You Go listing, where “1 seat equals 1 agent”.[10]
Counting / floors
Apex One
Apex One shows licence reminders 60 days before a full licence expires and during a grace period whose length “varies by region”. After expiry and the grace period the customer can no longer get technical support or component updates, although scanning continues with out-of-date components. When a trial licence expires, component updates, scanning and all agent features are disabled (rule).[1] Licences are renewed by entering a new Activation Code in the product.[1]
Since 2022-12-01, support for Apex One (on-premises and SaaS) and Apex Central has been based on the release date of each program build: a build is supported for 18 months after the month of release, and fixes are produced only on the latest build (rule).[3] On-premises Apex One receives patch releases twice a year and Apex One as a Service monthly updates.[3] Because Maintenance covers Updates, a customer that stops renewing Maintenance also stops receiving the builds needed to stay within this 18-month window.
Deep Security
Every computer protected by a Deep Security Manager using a given activation code consumes that code’s seats; Trend describes a single DSM environment as using one licence (rule).[7] Seat counts per licence are shown in the Customer Licensing Portal, reached from the Licenses page of the manager.[4] Trend notes that previously added Deep Security licences can be found in the Customer Licensing Portal, but new keys may no longer be registered to an existing account once the registration period has lapsed, without affecting product function.[8]
When a full licence expires, all modules keep working, including Anti-Malware, Web Reputation, Firewall, Intrusion Prevention, Integrity Monitoring and Log Inspection, but pattern, rule and engine updates are disabled (rule).[6] The manager raises alerts when a module is about to expire or has expired.[4]
Cloud One protection-hours
Workload Security counts protection-hours; a partial hour within a clock-hour counts as a full hour. For computers under an AWS, Azure or GCP cloud connector, protection-hours run while the instance is powered on, including hours when the agent is Offline, and stop when the instance is powered off or deleted or the agent is uninstalled. Agents must be deactivated before being uninstalled, or charges continue. For data-center computers, Offline hours are excluded (rule).[10]
The published pay-as-you-go rates were:[9]
| Billing tier | Scope | USD per instance-hour |
|---|---|---|
| Essentials | Anti-Malware, Web Reputation and Activity Monitoring (XDR) only | 0.007 |
| Medium or smaller | For example EC2 T2, Amazon WorkSpaces, Google Cloud 1 vCPU | 0.011 |
| Large | For example EC2 C4, M4, R3, Google Cloud 2 to 3 vCPUs | 0.032 |
| Extra-large and greater | Larger EC2 families, Google Cloud 4 or more vCPUs | 0.047 |
| Data Center (not cloud) | vCenter or not under a cloud connector | 0.047 |
Size-based rates apply only under a cloud connector; computers outside a connector or in a vCenter account are billed at the Data Center rate regardless of size (rule).[9] Other Cloud One services were billed per GB of traffic inspected (Network Security, USD 0.014/GB), per protected container node (Container Security, USD 0.168), by files scanned per hour with a free tier (File Storage Security), and per cloud account size (Conformity, free below 250 resources).[9]
Virtualization & partitioning
Deep Security and Cloud One count protected computers through their agents, with no host-based alternative in the cited documents. The Deep Security Virtual Appliance for VMware NSX has an End-of-Sale/End-of-Renewal entry tied to 2021-12-31 and to the end of support of NSX 4.x if that falls before 2027-12-31.[12] In Cloud One, virtual machines in a vCenter account were billed as data center computers at the highest rate.[10]
Cloud / BYOL
A Cloud One account has a single subscription and can be subscribed through AWS Marketplace or an annual subscription, not both (rule).[11] Pay-as-you-go usage was reported hourly and billed monthly through the marketplace; custom and prepaid annual pricing was also available through AWS Marketplace.[9][11] Linking a subscription to a different Cloud One account puts the previous account into a 48-hour grace period.[11]
Expiry depends on the billing method. Accounts without a valid subscription lose access and are deleted 60 days after the original expiry.[9] If an annual Workload Security subscription is not renewed, no new activations are allowed and pattern and rule updates stop, though servers stay protected with possibly outdated components.[10]
Programs
- Cloud One pay-as-you-go and Cloud One annual subscription.[9]
- Legacy Deep Security as a Service Annual + Pay as You Go, no longer offered for new deployments: seats bought for 1 month or 1, 2 or 3 years, with overage at the pay-as-you-go rate. Trend applies the seats to the largest instances and the pay-as-you-go rate to the smallest (rule).[10] Credit-card billing has also been withdrawn for new deployments.[10]
- Paid Maintenance for perpetual Apex One and Deep Security licences: one year included from Delivery, then yearly renewals.[15]
Migration to Vision One credits
When customers update to Vision One Endpoint Security, existing entitlements are converted to credits on activation: Endpoint Security Core at 45 credits per seat, Essentials at 65 and Pro at 300.[13] Existing SAP Scanner licences converted automatically to credits when customers updated from Cloud One Endpoint & Workload Security to Vision One Server & Workload Security, as announced on 2024-12-02.[14] The GPA’s End-of-Life clause means that End-of-Sale gives no right to compensation as long as Trend fulfils existing Orders.[15]
Out of scope
Deep Discovery, ScanMail, InterScan and other gateway and appliance products are also activated with Activation Codes but are not covered here. Trend publishes no list price for Apex One or Deep Security seats.