WithSecure Elements subscriptions and module licensing

WithSecure Elements subscriptions are the entitlements that switch on the modules of the WithSecure Elements platform. Each subscription has a subscription key, an expiry date and a number of seats. A key is embedded in the agent installer or entered during setup, and “The subscription key determines which software is installed” on a workstation or server.^[1] Endpoint modules consume one seat per protected Device. Microsoft 365 and Entra ID modules are priced per protected User identity.^[5] All keys for a company are managed in Elements Security Center. Its Subscriptions view “lists every product subscription for the scope you’re viewing, along with keys, status, and expiration”.^[1]

Editions

The Endpoint Protection guide lists the software that one agent package can install, depending on the key.^[1]

Elements Agent for Computers	Elements Agent for Servers
EPP for Computers (Windows and Mac)	EPP for Servers (Windows and Linux)
EDR and EPP for Computers (Windows and Mac)	EDR for Servers (Windows only)
EDR for Computers (Windows, Mac, and Linux)	EPP for Servers Premium (Windows only)
EPP for Computers Premium (Windows only)	EDR and EPP for Servers Premium (Windows and Linux)
EDR and EPP for Computers Premium (Windows only)	Exposure Management (Windows only)
Exposure Management (Windows only)

Premium versions of EPP for Computers and EPP for Servers add “additional ransomware protection with DataGuard and application-specific restrictions via Application Control”.^[1] Elements Mobile Protection offers “protection for Android and iOS devices” and is deployed through an installation email sent from the portal or through third-party MDM software.^[1]

Outside the endpoint agents, Elements Collaboration Protection (formerly WithSecure Cloud Protection for Microsoft Office 365) protects Exchange Online email, SharePoint, OneDrive and Teams through a cloud-to-cloud connection.^[2] Elements Exposure Management is sold as separate for Business and for Cloud licences.^[4] Elements EDR is available in “Partner Managed and Company Managed versions”.^[3]

Subscription types. Elements Security Center filters keys by the types “Commercial, Evaluation, Governmental, Educational, or Not For Resale”. It flags keys expiring in 14 or 60 days.^[1] When computing a license position, Evaluation and Not For Resale keys are best kept apart from purchased keys. Evaluation rights under the Terms of Use are granted “for non-commercial purposes”, and continued commercial use requires a purchased subscription.^[7] Catalog: Subscription types: Commercial, Evaluation, Governmental, Educational, Not For Resale.

Metrics

Metric	Catalog row	Modules
Device	Device	EPP, EDR, Mobile Protection, Exposure Management for Devices
User identity	User identity	Collaboration Protection, Identity Security, Exposure Management for Identities

WithSecure’s pricing distinguishes “protected devices (workstations, servers, mobile devices)” from “protected digital identities (Entra ID; M365)”.^[5] In the Terms of Use, the customer may install and use the Solution “solely for the amount of users, seats or accounts that have been subscribed to”.^[7] Catalog: Use limited to the subscribed users, seats or accounts, Devices and identities are priced separately; one monthly invoice.

Counting / floors

Seats and device activation

A device can be added only when “you must have a subscription for an Endpoint Protection software with at least one free installation available”. The guide adds that “The number of free installations available to a company will determine the number of devices you can add to it.”^[1] Elements Security Center therefore enforces the seat count. A device with no free seat is not activated. It does not run as a silent overage. Catalog: A device needs a free installation in an Endpoint Protection subscription.

Removing devices and reclaiming seats

“Removing a device frees up the subscription.” If a removed device comes back online, it is re-added only when the subscription still has a free seat. Otherwise it “is left without protection”.^[1] At company level, administrators can have devices deleted automatically after they have been offline for a set number of days. “The minimum number of days is seven (7)”, and the feature does not apply to mobile devices.^[1] Catalog: Removing a device frees the seat; reconnection only if seats are free, Automatic deletion of offline devices: minimum seven days.

Reinstallation and duplicates

When the product is reinstalled on a device that was not removed first, it gets a new identifier by default, which creates a duplicate device. “If you use a new subscription key when you reinstall the product, a new device is created in Elements Security Center.”^[1] The installer can use the SMBIOS GUID or the Active Directory computer object GUID instead, which links the reinstalled product to the existing device record. A duplicate record occupies a seat until it is removed or auto-deleted, so rebuild programmes can inflate apparent consumption. Catalog: Reinstalling with a new subscription key creates a new device.

Upgrades and key changes

Subscriptions are upgraded “By changing the type of your subscription key (ordering a new one)” or “By changing to another subscription key on your device”.^[1] The published paths are:

EPP for Computers to EPP for Computers Premium, to EDR and EPP for Computers, or to EDR and EPP for Computers Premium;
EPP for Computers Premium, or EDR and EPP for Computers, to EDR and EPP for Computers Premium;
EPP for Servers to EPP for Servers Premium, and EPP for Servers Premium to EDR and EPP for Servers Premium.^[1]

Key changes that go downward are restricted. “A subscription key cannot be changed for Elements Connector or any EPP subscription variant if the change would require downgrading to a subscription that does not include EPP.”^[1] The EDR guide warns against using a key for “WithSecure Elements EDR only” on devices that run EDR for Computers, or the other way round.^[3] “All server products can be used with the same subscription key”. The former Server Security subscription is now named WithSecure Elements EPP for Servers.^[1] Catalog: Subscription upgrade paths: EPP to Premium and to EDR and EPP, Key change cannot downgrade away from EPP, All server products share one subscription key.

EDR managed versions

Elements EDR is normally delivered by a partner. The guide states: “The solution is available with options for 250+ seat end-customers to self-manage it.”^[3] The 250-seat figure is the published threshold for the Company Managed version. It is not an order minimum for EDR as such. Catalog: EDR is sold as Partner Managed or Company Managed (self-managed for 250+ seats).

Collaboration Protection

Each Microsoft 365 cloud service connection is tied to a subscription. When there are several, the administrator must “select the proper subscription key from the drop-down menu”.^[2] Renewals need care. When an expired subscription is replaced by a new one instead of being extended, “The cloud service that uses the expired subscription is then disconnected automatically”, and protection resumes only after reconnection.^[2] Advanced SharePoint protection and OneDrive protection are “included in the product and can be used with no additional charge”, and Teams file protection is part of the same product.^[2] Protection stops at the licensed size. A WithSecure knowledge-base answer states that a mailbox that “can’t be protected by ECP because exceed license size” is not covered.^[6] Catalog: Collaboration Protection: a replacing subscription disconnects the cloud service, Collaboration Protection includes SharePoint and OneDrive protection at no additional charge, Collaboration Protection covers only mailboxes within the licence size.

Exposure Management

“Scans for cloud integrations are included in the WithSecure Elements Exposure Management for Cloud license, while the other scan types are included in the WithSecure Elements Exposure Management for Business license.” Collecting device service data also “requires a license for WithSecure Elements Endpoint Protection”.^[4] Exposure Management therefore depends on EPP seats already being in place on the devices it analyses. Catalog: Exposure Management for Business vs for Cloud licence scope.

Virtualization & partitioning

WithSecure publishes no host-level or per-core virtualization rule. Virtual workstations and servers are counted as devices. The Endpoint Protection guide describes two VDI patterns.^[1]

Persistent VDI (golden image). The product is installed on Citrix, VMware Horizon and other VDI servers from a golden image prepared with the target company’s key. Each server deployed from the image registers as a separate device under its own SMBIOS GUID. “This subscription key must be the same as you used when you installed the product for the image. We do not allow switching subscriptions with this installation method due to security reasons.”
Non-persistent VDI. The SMBIOS GUID changes every time an image is launched, so WithSecure recommends the Active Directory GUID as the device identifier. In VMware Horizon pools, turning on “Allow Reuse of Existing Computer Accounts” stops clones from being created as new devices.

The guide also warns that the SMBIOS GUID option sits “behind a special flag as there are a lot of cases in the world where the SMBIOS GUID of multiple computers has been the same”.^[1] If identity collisions are not controlled, a VDI estate can show many more devices than there are concurrent desktops. For how other vendors treat this pattern, see Virtualization and partitioning. Catalog: VDI golden images keep the same subscription key; non-persistent VDI uses the AD GUID.

Cloud / BYOL

The Elements modules are WithSecure-hosted services with local agents, so bring-your-own-license rules do not apply. The Linux product needs a connection to WithSecure cloud services “for the subscription validation”, and “If the subscription cannot be validated for two weeks, the product stops working.”^[1] Catalog: Linux Protection stops working if the subscription cannot be validated for two weeks.

Programs

Subscription keys are issued through partners. “Company users must request for a subscription key from their partner”, and partners order either a “New SaaS Order” or a “New Yearly Order” in the WithSecure Partner Portal.^[1] Under the lifecycle policy, product updates are free of charge “to all customers with valid licenses”. Agent versions reach end of life three months after the next version becomes generally available.^[8] See WithSecure partner and MSP licensing. Catalog: Subscription keys and billing come through the partner, Elements agent versions reach end of life three months after the next version.

Out of scope

Mailbox-level metric definitions for Collaboration Protection beyond the identity pricing on the MSP page: WithSecure does not publish a definition of which Microsoft 365 objects count.
Identity Security onboarding guide and Entra ID identity counting rules: not retrieved.
Elements Vulnerability Management as a separately sold product: the Endpoint Protection guide still names it, but current pricing pages use Exposure Management.
Business Suite (on-premises Policy Manager, Client Security, Server Security): see WithSecure licensing.
Co-Security services: see WithSecure Co-Security services licensing.