Solution overview

WithSecure Elements
Endpoint Protectiontm

WithSecuretm Elements – Reduce cyber risk,
complexity and inefficiency.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Contents
Executive summary................................................................. 3
Flexibility to build resilient cyber security with
WithSecure™ elements .......................................................... 3
1. Solution overview............................................................ 5
1.1 Solution packages ......................................................... 6
1.2 Solution components..................................................... 8
1.3 Solution deployment...................................................... 8
2. Elements security center..................................................... 9
3. Computer protection.......................................................... 11
3.1 Combining all required endpoint protection
stack into one.............................................................. 11
3.2 Heuristic and behavioral threat analysis...................... 11
3.3 Real-time threat intelligence........................................ 12
3.4 Designed specifically for macos.................................. 12
3.5 Protection for linux endpoints...................................... 13
3.6 Integrated patch management.................................... 13
3.7 Multi-engine anti-malware........................................... 13
3.8 Location based profiles................................................ 13
3.9 Flexibility by assigning automated tasks..................... 13
3.10 Extensive and proactive web protection.................... 14

4. Mobile protection............................................................... 16
4.1 Mobile vpn................................................................... 16
4.2 Security cloud.............................................................. 16
4.3 Application protection.................................................. 17
4.4 Browsing protection..................................................... 17
4.5 Faster browsing and less data use............................... 17
4.6 Third-party mdm deployment ...................................... 17
5. Server protection............................................................... 18
5.1 Heuristic and behavioral threat analysis...................... 19
5.2 Real-time threat intelligence........................................ 19
5.3 Integrated patch management.................................... 19
5.4 Multi-engine anti-malware........................................... 19
5.5 Proactive web protection............................................. 20
5.6 Server share protection............................................... 20
5.7 Citrix and terminal servers........................................... 20
5.8 Linux............................................................................ 20
5.9 Multi-engine anti-malware ........................................... 20
5.10 Integrity checking .................................................... 20
6. Integration with siem/rmm................................................. 21
7. Professional services......................................................... 22
8. Data security...................................................................... 23

January 2023
DISCLAIMER: This document gives a high-level overview of the key security components in WithSecure™ Elements Endpoint Protection. Details are omitted inorder to prevent targeted attacks against our solutions. WithSecure™ is constantly improving its services. WithSecure™ reserves the right to modify features orfunctionality of the Software in accordance to its product life cycle practices.

2WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3

Executive summary
WithSecuretm Elements Endpoint Protection helps companies stop threats like ransomware
and proactively avoid data breaches on their workstations, laptops, mobiles and servers. The
solution has everything businesses need for endpoint protection, including fully integrated patch
management capabilities to effectively prevent attacks that leverage vulnerabilities in installedsoftware. Elements Endpoint Protection outperforms competing products, consistently earning
top marks for providing the best protection in the industry.

Flexibility to build resilient cyber security
with WithSecure™ Elements
In today's agile business environment, the only constant ischange. WithSecure™ Elements offers companies all-in-one
security that adapts to changes in both the business and thethreat landscape, growing along with the organization. It offers
flexibility in licensing models and in its pick-and-choose security technologies. WithSecure™ Elements integrates a full rangeof cyber security components, including vulnerability management, patch management, endpoint protection, and detection
and response, into a single lightweight software packagethat is managed in one unified, cloud-based management
console. Using the same console companies can manage
the security of their Microsoft 365 collaboration services. The
solution is available as a fully managed subscription service
through our certified partners or as a self-managed cloud

solution. Customers can easily shift from self-managed toa fully managed service, so companies that struggle to findemployees with cyber security skills can stay protected amid
the ever-developing attack landscape.
WithSecure™ Elements consists of four solutions that are all
managed with the same console, WithSecure™ Elements
Security Center.
WithSecure™ Elements Endpoint Protection: WithSecure's multiple AV-TEST Best Protection winner, cloud-native,
AI-powered endpoint protection can be deployed in easy andflexible ways, and manage the security of all your endpoints,
keeping your organization fenced in from attacks. WithSecure™ Elements Endpoint Protection covers mobiles, desktops, laptops and servers.

WithSecure™ Elements Endpoint Detection andResponse: Gain full visibility to advanced threats with our
endpoint detection and response. With our unique Broad
Context Detection, you can minimize alert noise and zero in on
incidents, and with automated response you can effectively stop breaches around the clock. WithSecure™ Elements
Endpoint Detection and Response covers desktops, laptops
and servers.
WithSecure™ Elements Vulnerability Management:
Discover and manage critical vulnerabilities in your network
and assets. By exposing, prioritizing and patching vulnerabilities you can reduce your attack surface and minimize entry
points for attackers.
WithSecure™ Elements Collaboration Protection:
Complement the native email security capabilities of Microsoft
365 by providing advanced security to prevent attacks via
email and URL’s. Cloud-to-cloud integration makes the solution easy to deploy and manage.
WithSecure™ Elements Endpoint Protection, Endpoint
Detection and Response, and Vulnerability Management are
packed into a single automatically updated software packet,
saving your time and money in software deployment andadministration.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Benefits of the integrated solutions
The modular WithSecure™ Elements solution adapts to yourcompany changing needs. Unified cyber security means
easier licensing, fewer security management tasks and moreproductivity without sacrificing your company’s cyber security
posture. The cloud-based console – WithSecure™ Elements
Security Center - provides centralized visibility, insights andmanagement across all endpoints and cloud services. It is fully
managed by one of our certified Managed Service Providers,or self-managed with on-demand support from WithSecure™
for tough cases. The Security Center provides a single viewto the security status combining the Endpoint Protection,
Endpoint Protection and Response, Vulnerability Management, and Microsoft 365 protection.
All the endpoint solutions (Elements Endpoint Protection,
Endpoint Detection and Response, and Vulnerability Management) are using a single software agent that is required to
deploy only once. The add-on solutions can then later be
activated without having to deploy additional solutions.
WithSecure™ Elements Collaboration Protection is a cloudbased solution that does not require installations to company
endpoints.
In addition to deployment and management benefits, the
WithSecure™ Elements solutions are designed to work
together maximizing the security benefits for the company.
By combining security events and alerts the XDR capabilities

WithSecure™ Elements can provide holistic security breaking
down the silos of disconnected solutions.
WithSecure™ Elements Endpoint Protection is favored bybusinesses that want:• Broader endpoint and service coverage than what common
solutions on the market can provide, at a much more attractive total cost of ownership (TCO)• Achieve excellent protection level with minimum resource
requirements with an option to completely outsource themanagement of the solution to a certified service provider• A straightforward and scalable way to provide visibility andprotection for multiple geographically dispersed sites fromone location• To avoid investing time and resources into maintaining local
server environments
By merging the protection of various endpoints and value-added security tools into one unified solution, Elements Endpoint
Protection offers:• Broader security coverage and capabilities than mostendpoint security solutions• Unified and streamlined cloud-based management thatsaves time and resources from security management andmaintenance, further reducing TCO.

4

The solution is designed to be delivered as a cloud-based
service; either as a self-managed service, managed service bya certified service provider, with an option to integrate it with
3rd party systems.
Our ability to provide better, more consistent protection thanour competitors is proven year-by-year by testing done byindependent industry experts and analysts.
WithSecure™ has demonstrated its consistency in independent tests by being the only vendor with prestigious annual
AV-TEST 'Best Protection' awards for business products in 6
years since its inception. AV-Test is making comparison tests
continuously throughout the year so in order to reach this
precious award one needs to consistency show good results inprotection tests.
To meet these demanding standards, the solution utilizes
a multi-layered approach to security and leverages various
modern technologies, such as heuristic and behavioral threat
analysis, and real-time threat intelligence provided via the
WithSecure™ Security Cloud.
This ensures that you're at the forefront of security.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

1. Solution overview
Companies are facing challenges in minimizing the business risk brought on by
cyber threats like ransomware. WithSecure™ Elements Endpoint Protection isdesigned from the ground up to solve challenging business security needs withminimum maintenance and management overhead. It offers award-winning
best protection for Windows and Mac computers, iOS and Android devices
and a variety of server platforms. With integrated patch management, layered
protection, and advanced behavior and heuristic analysis, Elements Endpoint
Protection stops tomorrow’s cyber threats – today.

WithSecure™ Elements Endpoint Protection delivers:• Best protection in the industry improves business continuity and saves timein incident recovery• Proactively minimizes business risk of cyber breaches with fully integrated
patch management• Cloud-native solution saves time in deploying, managing and monitoring
security

WithSecure™ Elements Endpoint Protection solution is also available as a fully managed
service. WithSecure™ certified service providers can use Partner Managed or SaaS
version of the solution to leverage many unique service provider features, like multi-company dashboard, reporting and subscription management. The SaaS version of thesolution allows service providers to utilize flexible business models, e.g. Usage Based
Invoicing for all the WithSecure™ Elements products.

5

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

1.1 Solution packages
Elements Endpoint Protection solution’s Computer andServer Protection for Windows and Mac are available asstandard and premium packages. Standard features include
advanced anti-malware, patch management and many otherendpoint security capabilities. Premium features add better
protection against ransomware and application control. Bothendpoint packages can be complemented with Elements
Endpoint Detection and Response, and Elements Vulnerability Management solutions. The detection and responsefeatures bring improved visibility, detection and automatedresponse into advanced threats and breaches. The vulnerability management helps to discover and manage criticalvulnerabilities in the endpoints. In addition, WithSecure™
Elements Collaboration Protection can be deployed using
cloud-to-cloud integration without any middleware or software to be installed on endpoints.

WithSecure™ Elements
Endpoint Protection
standard

Endpoint Protection
premium

Detection andResponse

Advanced anti-malware andpatch management

Additional anti-ransomware
protection with DataGuardand application control

Advanced threat protection

Vulnerability management
and prioritization

Advanced cloud-based
email and collaboration
security for Microsoft 365

The different protection feature packages can be activated without having to re-install client software.
More information on WithSecure™ Elements.

Vulnerability
Management

Collaboration
Protection

6

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Software Updater
Automated patch management to update Microsoft and Mac
and 2500+ 3rd party software apps.

Multi-engine anti-malware
Provide unmatched protection with highly advanced, multi-engine anti-malware.

DeepGuard
An intelligent, heuristic anti-malware engine offering 0-day
detection capability. Read WithSecure™ DeepGuard white
paper.

Firewall
Additional rules and management functionality integrated with
Windows Firewall.

Web content control
Improve security and productivity with controlled access to
websites. Prevent access to websites based on categories
and enforce your corporate policy.
Connection control
Activate additional security for sensitive transactions such as
online banking.
Real-time protection
WithSecure™ Security Cloud protects against new malware
as it utilizes threat details seen by other protected machines,
making responses far more efficient.

7

Application Control
Blocks execution of applications and scripts according to rules
created by our penetration testers, or as defined by the administrator. In addition, Application Control can be used to blockloading of DLL’s or other files for additional security.

Browsing protection
Proactively prevents employees from accessing harmful sitesthat contain malicious links or content.

XFENCE
Unique security capability for protecting Macs against
malware, trojans, back doors, misbehaving applications, andother threats by preventing applications from accessing files
and system resources without explicit permissions.

Device control
Device Control prevents threats from entering your system via
hardware devices such as USB sticks, CD-ROM drives, andweb cameras. This also prevents data leakage, by allowing
read-only access, for example.

Endpoint Encryption
Monitor and manage the status of your Window’s computers’
disc encryption status. You can turn Bitlocker encryption on
and off, and get recovery keys directly from WithSecure™
Elements Security Center.

DataGuard
Provides additional protection against ransomware, andprevents the destruction and tampering of data.

Outbreak Control
Outbreak Control provides ability to automatically change
EPP profiles to be more restricted, if they have open medium,high or critical severity EDR detections. Once the incident is
resolved, the endpoint returns to its original profile.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

1.2 Solution components
The solution is composed of four main components, each
described in this document:
1.

Elements Security Center as a cloud-based management portal
2. Computer Protection as dedicated security clients forworkstations (Windows, Mac, Linux*)
3. Mobile Protection for mobile devices (iOS, Android)
4. Server Protection a variety of server platforms (Windows,
Citrix, Linux)

1.3 Solution deployment
Endpoint security clients can be deployed by email, local
installation, batch script, enterprise management systems(SolarWinds, Kaseya, Datto) or with an MSI package via
domain-based remote installation tools. Similarly, Mac clientsare deployed as packages using macOS Installer or Mobile
Device Management tools and can be configured with additional deployment steps into custom signed packages.
For normal deployments, all endpoint security client deployments can be initiated from the portal via an email flow. The
subscription key is automatically included in the link or installer
so that the end-user need only click the link for the installation
process to start automatically.
* Conditions apply. Please contact your sales representative.

For larger environments, you can create an MSI package thatcan be deployed either with your own remote installation tools
or with ours. The Windows client also contains built-in program
flags, which can be used to automate client deployment via
batch scripting.
Whenever the Windows client is deployed on systems with aconflicting security solution, our sidegrade feature detects it
and automatically uninstalls it before continuing with the installation of WithSecure™ software. This ensures a much smoother and faster transition from one vendor to another.
When a new computer is added to Elements Endpoint Protection a default configuration (profile) can be assigned automatically based on its location in an Active Directory hierarchy.
This streamlines the deployment process and reduce risks for
misconfiguration.
Mobile Protection features are commonly deployed by using athird-party mobile device management (MDM) available with asubscription that support the use of external MDM solutions.
The patch management capabilities are fully integrated into
Windows server and workstation clients and can be controlled
via the management portal. As a hosted solution, there is noneed to install separate agents or management servers or
consoles, unlike with traditional patch management solutions.

WithSecure™ Elements Connector is provided by WithSecure™ in order to minimize the bandwidth usage while
downloading updates to Computer Protection clients. This
proxy caches malware signature database updates as well assoftware updates of the Computer Protection client itself andpatch management software updates, and in addition can beused as an interface between WithSecure™ Elements andyour SIEM systems.
Endpoint protection client software update malware signature
databases and the client software itself automatically without
administrator having to worry about the updates or upgrades
manually.
WithSecure™ partners can customize both the endpoint
protection client software and the Elements Security Centerwith their logo and support link.

8

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

2. Elements Security Center
WithSecure™ Elements Endpoint Protection makes it easy todeploy, manage, and monitor the security of your endpoints
from a single, intuitive console. It gives you excellent visibility
into all of your devices.
The Security Center was designed from the ground up to
simplify and accelerate security management in demanding, multi-device and multi-site environments. Below aresome examples of how the solution considerably reduces theamount of time and resources needed for security maintenance and management:• Endpoint clients automatically receive client, security, anddatabase updates, minimizing the time needed for updates
and maintenance• By consolidating the security management of various
endpoints and tools into one portal, the overall management
is streamlined considerably, saving time
• Patch Management can be set to deploy missing security
patches automatically as soon as they are available, saving
time from manual software updates• As a hosted service, there is no server hardware or software
to install or maintain – all you need is a browser• The portal has been designed by a dedicated User Experience team to utilize the most optimal user journeys, greatly
increasing user efficiency
The console-endpoint communication works in real time. This
allows IT admins to manage and monitor the security of theenvironment without disruptions or delays caused by pollingintervals.
In essence, it allows IT admins to configure, deploy, and validate changes in one go. And if there is a security incident thatneeds to be solved ‘right now’, you can remediate and deploy
a fix immediately.

9WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

You can create and customize individual security policies(profiles) and assign them either individually or in groups tocomputers, and servers by using labels. All settings and policies can be enforced down to the individual level if needed sothat end-users cannot change them. Policies can be created
e.g. per Active Directory group and assign the policies automatically to devices attached to the group.
The management portal gives you a complete overview ofthe security status of your entire environment. This includes
potential software vulnerabilities, missing security updates,
and the status of security features like real-time scanning andfirewall. By using Security Events IT admins can easily see allalerts in one central location.
For example, you can track the number of blocked infections
and pay closer attention to the devices that are attacked themost. You can set automatic email alerts so that specificinfection parameters get your attention first. If you need more
information on any particular infection, you can obtain it directly from our security database.
The management portal delivers a wide range of graphicalreports in an intuitive format, making data easier and faster todigest and understand—and more appealing for stakeholders
to read. Device security details can also be exported as CSV
files if required.

10

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3. Computer protection
Endpoint protection for computers forms the cornerstone ofany secure environment. And in today's security landscape, it
is vital to ensure that protection goes well beyond traditionalanti-malware. With WithSecure™ Elements Endpoint Protection, it is simple to deliver powerful, resource-friendly security
for Windows, Mac, and Linux computers.

3.1 Combining all required endpoint
protection stack into one
Modern endpoint protection suites employ a multi-layered
approach to providing security. Technologies such as network
filtering and scanning, behavioral analysis, and URL filtering
augment traditional file scanning components. These different
protection features are built into WithSecure™ Ultralight ina multi-layered design, so that if a threat escapes one layer,
there is still another layer that can catch it. And as the threat
landscape changes, some layers may be removed, or newones may be added both in the endpoints and in the cloud.
Ultralight combines all of the technologies present in WithSecure's full endpoint protection stack into a single package. It
consists of a number of drivers, engines, and system services
that provide mechanisms to protect both a device and its
users. Ultralight provides traditional anti-virus functionality,
such as real-time file scanning and network scanning. In addi-tion, it includes modern, proactive protection technologies that
aim to stop zero- day exploits and stay ahead of new attacks.
WithSecure's Security Cloud provides Ultralight components
with real- time information as the threat landscape changes.
For more information on the integrated protection technologies done by Ultralight, see the technical whitepaper.

3.2 Heuristic and behavioral threat
analysis
Heuristic and behavioral threat analysis, done by DeepGuard,is critical in identifying and blocking the most sophisticatedmalware prevalent today. DeepGuard provides immediate,
proactive, on-host protection against new and emerging
threats by focusing on malicious application behavior rather
than through static identification of specific, known threats.
This shift in focus allows it to identify and block previously
unseen malware based on their behavior alone, neatly providing protection until security researchers are able to analyze
and issue a detection for that specific threat.
By communicating with WithSecure's Security Cloud, DeepGuard is also able to use the latest reputation and prevalence
information available for any previously encountered object

11

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

to fine-tune its security evaluations, reducing the risk of false
positives or redundant analyses that can interfere with the user
experience.
The on-host behavioral analysis also extends to intercepting attacks that attempt to exploit vulnerabilities in popular
programs in order to install malware onto the machine. DeepGuard is able to identify and block routines that are characteristic of an exploit attempt, preventing exploitation – and in turn,infection. Exploit interception safeguards users from harmeven when vulnerable programs are present on their machine.
For more information about the heuristic and behavioral threat
analysis done by DeepGuard, see the technical whitepaper.

3.3 Real-time threat intelligence
The security client uses real-time threat intelligence provided by WithSecure's Security Cloud, ensuring that all newor emerging threats are identified, analyzed, and prevented
within minutes.
A cloud-based threat analysis service affords many benefits
over traditional approaches. WithSecure™ gathers threat
intelligence from tens of millions of client nodes, building areal-time picture of the global threat situation.

12

For example, if heuristic and behavioral threat analysis identifies a zero-day attack on another endpoint on the other side of
the world, the information is shared with all protected devices
via Security Cloud—rendering the advanced attack harmlessmere minutes after initial detection.
For more information on the functions and benefits of WithSecure's Security Cloud, see our technical whitepaper.

3.4 Designed specifically for macOSWithSecure™ Computer Protection for macOS includes
XFENCE, a unique security capability for Macs. The producttakes advantage of modern macOS security capabilities
enhancing the protection against malware, trojans, backdoors, misbehaving applications, and other threats without
sacrificing usability and performance. The powerful XFENCE
protection prevents errant processes, ransomware and othermalware from accessing your files and system resources
without explicit permission.
WithSecure™ Computer Protection for macOS leverages
advanced rule-based analysis to monitor apps that attempt
to access confidential files and system resources, enhancedby the threat intelligence provided by Security Cloud to minimize false positives and user interaction through allow/disallow prompts.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

In addition, WithSecure™ Computer Protection for macOS
provides application layer firewall that can configure andcontrol network access on application level. It can be used toisolate hosts, to allow network access only to trusted singed
applications, and to blacklist/whitelist applications bybundle id.
WithSecure™ Computer Protection for macOS comes withadmin tools for easy deployment and management of the
Mac clients.

3.5 Protection for Linux endpoints
WithSecure™ Elements Endpoint Protection includes protection for Linux in WithSecure™ Server Protection. The productcan be used to protect endpoint devices as well.*commonly serve as attack vectors due to their popularity andlarger number of vulnerabilities.
Administrators can define detailed exclusions for the automatic mode based on software names or bulletin IDs. Some
updates are excluded by definition, such as Service Packs.
Administrators can also flexibly define the day and time when
installations should be performed, as well as how restarts
are forced and the grace time before forcing a restart after
installation.

Patch management is a critical security component. It's the first layerof protection when malicious content reaches endpoints and canprevent up to 80% of attacks simply by installing software security
updates as soon as they become available.

3.6 Integrated patch management

3.7 Multi-engine anti-malware

Windows and Mac endpoints include an automated patch
management feature that is fully integrated with the clients.
There is no need to install separate agents, management
servers, or consoles.

Our computer component utilizes a proprietary, multi-engine
security platform to detect and prevent malware. It offers
superior protection compared to traditional signature-based
technologies:

It works by scanning for missing updates, creating avulnerability report based on missing patches, and thendownloading and deploying them automatically. You can alsochoose to install updates manually if needed. Security patches
include Microsoft and Mac updates and 2500+ third-party
applications such as Flash, Java, OpenOffice, and others that

• Detects a broader range of malicious features, patterns, andtrends, enabling more reliable and accurate detections, evenfor previously unseen malware variants• By using real-time look-ups from WithSecure's Security
Cloud, it can react faster to new and emerging threats inaddition to ensuring a small footprint

13• Emulation enables detection of malware that utilize obfuscation techniques, and offers another layer of security before afile is run

3.8 Location based profiles
WithSecure™ Elements Endpoint Protection can be configured to trigger different configurations based on the endpoint’s
location. As an example the admin can set up network locations and rules so that when a device is at home, the PatchManagement and firewall are on, but when at the office, both
Patch Management and firewall are off.

3.9 Flexibility by assigning automatedtasks
WithSecure™ Elements Endpoint Protection can be configured to run certain automated tasks on a very granular manner.
As an example, product updates can be configured to be run
at a specific time, install missing critical and other security
updates immediately, scan for missing security updates on
every day, and run a full system scan for malware on every
weekday. By using the automated tasks you can configure
endpoint protection to fit into your company’s security needs
with minimum performance impact.

* Conditions apply. Please contact your sales representative.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.10 Extensive and proactive web
protection
Furthermore, the solution offers extensive and proactive web
protection, ensuring the most exploited attack vector is welldefended.
• Proactively prevents access to malicious and phishing sites
even before they are accessed (e.g. on Google search andwhen clicking on a web link). This is particularly effective, as
early intervention greatly reduces overall exposure to malicious content and therefore to attacks.
• It prevents the exploitation of active content such as Javaand Flash, which are utilized in the vast majority of online
attacks. These components are automatically blocked on
unknown and suspicious sites based on their reputation
data, with the option of setting exclusions.
• The solution can also be used to restrict inappropriate web
usage, granularly denying or allowing access to non-work-related destinations, such as social media sites and adult sites,
to maximize efficiency and avoid malicious sites.

• After the initial layers of web protection, the content in HTTP
web traffic is also subjected to analysis in order to provide
additional protection against malware, before it gets into
contact with the endpoint itself.
• IT admins can also designate business-critical web activities
that utilize HTTPS (like intranets or sensitive cloud services,for example CRMs) to use an additional security layer. When
active, it closes all untrusted network connections, preventing attacks and exfiltration of data from the services during
the session.
The security features vary depending on the chosen operating system. Below is an overview of the feature comparison
between Windows, macOS, and Linux.

14

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Windows

macOS

Linux**

Security

Windows

macOS

Linux**

Security

Anti-malware

Yes

Yes

Yes

Web traffic scanning

Yes

No

No

DeepGuard

Yes

No

No

Web content control

Yes

Yes

No

DataGuard

Yes

Yes*

No

Content type filtering

Yes

No

No

Security cloud

Yes

Yes

Yes

Connection control

Yes

Yes

No

Patch management

Yes

Yes

No

Firewall

Yes

Yes

No

Application control

Yes

No

No

Integrity checking

No

No

Yes

Browsing protection

Yes

Yes

No

Endpoint Encryption

Yes

No

No

* Part of the functionality provided by XFENCE** Conditions apply. Please contact your sales representative.

15

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

4. Mobile protection
Maintaining control over mobile devices is a fundamental aspect of modern cyber security. With Elements Mobile
Protection, IT admins have an easy way to secure and control
mobile devices, both Android and iOS.
The component delivered by WithSecure™ Elements Mobile
Protection includes everything that is needed for exceptional
mobile protection in one package: personal VPN, Wi-Fi security, and proactive App (Android) and web protection.

4.2 Security Cloud
The security client uses real-time threat intelligence provided by WithSecure's Security Cloud, ensuring that all newor emerging threats are identified, analyzed, and prevented
within minutes.

The mobile VPN automatically encrypts traffic between yourmobile device and a selected

A cloud-based threat analysis service affords many benefits
over traditional approaches. We gather threat intelligence fromtens of millions client nodes, building a real-time picture of
the global threat situation. For example, when an APK or fileis downloaded, it is scanned and additionally its reputationis checked in the Security Cloud. Malicious files are prevented from running and unknown files or apps are uploaded fordeeper analysis. Scan results benefit all users, for example byminimizing false positives and rendering new attacks harmlessin a matter of minutes.

WithSecure™ service node, allowing your employees to safely
use public Wi-Fi and mobile networks.

For more information about the functions and benefits of
WithSecure's Security Cloud, see our technical whitepaper.

The mobile client is also designed to complement and be
deployed via third-party MDM solutions.

4.1 Mobile VPN

It prevents the interception of emails, browser sessions, anduse of online services, in addition to providing an extra security
layer over HTTPS connections. It also enables you to change
your virtual location, hide your IP address, and access local
services when abroad.

16

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

4.3 Application protection
When the VPN connection is active, mobile devices are automatically protected against malware and malicious content.
WithSecure™ service nodes scan the traffic at the network
level, utilizing the full extent of available security analytics.
This allows us to provide better security than traditional mobile
security solutions:• Security is not hampered by limited mobile device resources• Resource-intensive processes do not impact device performance and battery life
• Network-level scanning prevents contact with malicious
content in the first place17

For example, Browsing protection prevents end-users frombeing tricked into accessing seemingly legitimate phishingsites, accessing malicious sites through an email link, or
getting infected through malicious third-party advertisements
on otherwise legitimate sites.

4.5 Faster browsing and less data use
The component is designed to have a minimal impact on
mobile performance and battery life. In fact, by using traffic
compression over VPN and preventing online tracking andadvertising with Anti-Tracking, it increases browsing speed.

4.6 Third-party MDM deployment

For Android devices, security is further enhanced with local
scanning—including real-time reputation checks from the
WithSecure™ Security Cloud—even when the VPN is notconnected.

The mobile client is also designed to complement and
be deployed via third-party Mobile Device Management(MDM) solutions, such as AirWatch, MobileIron, Intune, andMaaS360.

4.4 Browsing protection

By using a dedicated security component on top of the basic
capabilities provided by the MDM solution, IT admins cansignificantly increase the security against malware, data theft,and phishing attempts that target mobile devices.

Browsing protection is a key security layer that proactively
prevents end-users from visiting malicious sites. This is particularly effective, as early intervention greatly reduces overall
exposure to malicious content - and therefore to attacks.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

5. Server protection
Servers are critical to a company's communication, collaboration, and data storage. Elements Endpoint Protection provides
security for servers while enabling them to run at peak performance. The solution provides security for Windows, Citrix, andLinux servers.
Below is an overview of the core capabilities for different server
platforms:

Windows

CitrixLinux

Anti-malware

Yes

Yes

Yes

DeepGuard

Yes

Yes

No

Security cloud

Yes

Yes

Yes

Patch management

Yes

Yes*

No

Browsing protection

Yes

Yes

No

Web traffic scanning

Yes

Yes

No

Firewall

Yes

No

No

Integrity checking

No

No

Yes

Core security

Remote management via portal
Security management

Yes

Yes

Yes

Security monitoring

Yes

Yes

Yes

18

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

5.1 Heuristic and behavioral threat
analysis
Heuristic and behavioral threat analysis, done by DeepGuard,is critical in identifying and blocking the most sophisticatedmalware prevalent today. DeepGuard provides immediate,
proactive, on-host protection against new and emerging
threats by focusing on malicious application behavior rather
than through static identification of specific, known threats.
This shift in focus allows it to identify and block previously
unseen malware based on behavior alone, neatly providing
protection until security researchers are able to analyze andissue a detection for that specific threat.
By communicating with WithSecure's Security Cloud, DeepGuard is also able to use the latest reputation and prevalence
information available for any previously encountered object
to fine-tune its security evaluations, reducing the risk of false
positives or redundant analyses that can interfere with the user
experience. The on-host behavioral analysis also extends tointercepting attacks that attempt to exploit vulnerabilities in
popular programs in order to install malware onto the machine.
DeepGuard is able to identify and block routines that are characteristic of an exploit attempt, preventing exploitation – andin turn, infection. Exploit interception safeguards users fromharm even when vulnerable programs are present on theirmachine.
For more information on the heuristic and behavioral threat
analysis done by DeepGuard, see the technical whitepaper.

5.2 Real-time threat intelligence
The security client uses real-time threat intelligence provided by WithSecure's Security Cloud, ensuring that all newor emerging threats are identified, analyzed, and prevented
within minutes.
A cloud-based threat analysis service affords many benefits
over traditional approaches. WithSecure™ gathers threat
intelligence from tens of millions of client nodes, building areal-time picture of the global threat situation. For example, if
the heuristic and behavioral threat analysis identifies a zeroday attack on another endpoint on the other side of the world,
the information is shared with all protected devices via Security Cloud— rendering the advanced attack harmless mere
minutes after initial detection.
For more information on the functions and benefits of WithSecure's Security Cloud, see our technical whitepaper.

5.3 Integrated patch management
The component includes an automated patch management
feature that is fully integrated with Windows server clients.
There's no need to install separate agents, management
servers, or consoles.
It works by scanning for missing updates, creating a vulnerability report based on missing patches, and then downloading
and deploying them automatically. You can also choose to19

install updates manually if needed. Security patches include
Microsoft updates and 2500+ third-party applications suchas Flash, OpenOffice, and others that commonly serve asattack vectors due to their popularity and large number ofvulnerabilities.

5.4 Multi-engine anti-malware
Our computer component utilizes a proprietary, multi-engine
security platform to detect and prevent malware. It offers superior protection to traditional signature-based technologies:• Detects a broader range of malicious features, patterns, andtrends, enabling more reliable and accurate detections, evenfor previously unseen malware variants• By using real-time look-ups from the WithSecure™ Security
Cloud, it can react faster to new and emerging threats inaddition to ensuring a small footprint• Emulation enables detection of malware that utilizes obfuscation techniques, and offers another layer of security before
a file is run

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

5.5 Proactive web protection

5.7 Citrix and Terminal Servers

Furthermore, the solution offers extensive and proactive web
protection for terminals, ensuring the most exploited attack
vector is well defended.

On top of the same core security capabilities as for Windows
servers, the Citrix component provides additional protection
for Citrix environments by extending the integrated patch
management capabilities for published applications. The
client is Citrix Ready-certified, ensuring that it works flawlessly
in Citrix environments. Similarly, Server Protection provides
protection for Windows terminal servers. Please note that
customers using Server Protection in remote desktop environments need a license for WithSecure™ Remote Desktop
Protection as well.

• Proactively prevents access to malicious and phishing sites
even before they are accessed. This is particularly effective,
as early intervention greatly reduces overall exposure to
malicious content, and therefore to attacks.
• After the initial layer of web protection, the content in web
traffic (HTTP) is also subjected to analysis, in order toprovide additional protection against malware, before it gets
into contact with the endpoint itself.

5.6 Server share protection
Sharing files on local file servers is exposing organizations torisks of ransomware attacks especially whenever devices outof the organization’s full control access the server shares andend up encrypting large amount of important files as unusable.
You can safely continue using Windows file shares by having
Server Share Protection as an additional ransomware protection designed to immediately identify and rollback any encryption or other unintentional destruction of files and safeguard
your organization from the spread of the ransomware.

5.8 Linux
Linux Protection provides core security capabilities for Linuxclients: multi-engine on-access scanning, scheduled andmanual scans, and integrity checking. It is designed to detectand prevent both Windows and Linux-based attacks, making it
particularly useful in mixed environments, where an unprotected Linux machine can be used as an easy attack vector.

5.9 Multi-engine anti-malware
The clients utilize a proprietary, multi-engine security platform
to detect and prevent malware. It offers superior protection to
traditional signature-based technologies, with the added20

benefit of not being reliant on one technology alone. The platform detects a broader range of malicious features, patterns,
and trends, enabling more reliable and accurate detections,even for previously unseen malware variants.

5.10 Integrity checking
The component comes with a built-in integrity checker, which
detects and prevents attackers from tampering with kernels,
system files, or configurations. It is a vital security feature, as it
protects the system against unauthorized modifications, which
could otherwise go unnoticed.
Integrity checking can be configured to send alerts to theadministrator of any attempts to modify the monitored files.
This makes unauthorized changes easy to detect, ensuring that any incident response actions can be taken without
delay. If changes are needed on the baseline, for example
due to OS, security, and software updates, admins can use
a protected installation tool to make the necessary updates
without any hassle.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

6. Integration with SIEM/RMM
WithSecure™ Elements Endpoint Protection can be fully integrated with an SIEM, RMM, or any other third-party auditing,management, or reporting tool with WithSecure™ Elements
Connector. These include tools offered by Kaseya, Tableau,
N-Able, Splunk, among many others.
The integration helps to leverage an organization’s existing
investments and benefits from centralized tools, for example
by streamlining the administrator’s security and incident
response-related work.
By using the capabilities of the SIEM/RMM systems, the integration enables – for example – the creation of additional automation, customized workflows, and reports, further reducing
the workload and optimizing the solution towards your organization’s specific needs. The scope of the integration can be aslarge or as small as needed, as any operation can be accessedindividually via the API calls. For example, IT admins can opt
to only get relevant data to a reporting, logging, or auditing
system, rather than integrating the management capabilities
as well.

The integration is done via a REST API, called WithSecure™
Management API. It provides access to all the operations anddata available in the Management Portal.
For more information about the Management API and SIEM/
RMM integration, see the management API description fromconnect.withsecure.com.

21

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

7. Professional services
WithSecure's additional support packages offer a collection ofservices for more flexible and comprehensive support experience. Our support is available to you during business hours oreven in 24/7 service. We offer Advanced – or Premium Support
with different level of service to suit your need.

Advanced

Premium

Local business hours(English, Finnish, French,
German, Japanese andSwedish)24/7(English)Priority access to technicalsupportRespond to criticalincidents within an hour

Online tools for ticketing andfollow-up

Management levelescalation

Phone and call-backUpgrade consultation

Chat and remote

Advice on malware removal

22

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

8. Data security
WithSecure™ Elements Endpoint Protection platform uses
Amazon Web Services (AWS). This allows us to ensure highavailability and fault tolerance, in additional to better response
times and ability to scale as needed. Currently available
geographic regions are Europe, North America, and APAC.
AWS states that each of their data centers are in alignment
with Tier 3+ guidelines. For further information about the
AWS datacenters, please see: https://aws. amazon.com/
compliance/
WithSecure™ complies with the privacy regulations and laws
in all the countries where it operates.
We take the security of the data centers very seriously, and keepthem secure by using dozens of security measures, such as:• Security by design: Our systems are designed from theground up to be secure. We embed privacy and security inthe development of our technologies and systems from theearly stages of conceptualization and design to implementation and operation.
• Rigorous access controls: Only a small vetted group of
WithSecure™ employees have access to the customer data.
Access rights and levels are based on their job function androle, using the concept of least-privilege matching to defined
responsibilities.
• Strong operational security: Operational security is aneveryday part of our work, including vulnerability management, malware prevention and robust incident management
processes for security events that may affect the confidentiality, integrity, or availability of systems or data.

23

Who We Are
WithSecureTM, formerly F-Secure Business, is cyber security's reliable
partner. IT service providers, MSSPs and businesses – along with thelargest financial institutions, manufacturers, and thousands of theworld's most advanced communications and technology providers –trust us for outcome-based cyber security that protects and enables
their operations. Our AI-driven protection secures endpoints andcloud collaboration, and our intelligent detection and response are
powered by experts who identify business risks by proactively hunting
for threats and confronting live attacks. Our consultants partner withenterprises and tech challengers to build resilience through evidencebased security advice. With more than 30 years of experience in building
technology that meets business objectives, we've built our portfolio togrow with our partners through flexible commercial models.
WithSecureTM Corporation was founded in 1988, and is listed on NASDAQOMX Helsinki Ltd.