# ThreatDown Advanced

ThreatDown Advanced is an endpoint detection and response (EDR) product from ThreatDown (Malwarebytes). Source: Endpoint Index product report, https://endpointindex.com/products/threatdown-advanced/ (data verified 2 Oct 2026, licensed CC BY 4.0).

## SMB Fit Score

ThreatDown Advanced scores 51 out of 100 on the SMB Fit Score (fit-v1), ranked #10 of the 17 products tracked as of 2 Oct 2026. The score measures fit for a small-business buyer from public evidence, not absolute protection.

- Efficacy: 0 of 35
- Price transparency & level: 16 of 25
- SMB operability: 25 of 25
- Coverage breadth: 10 of 15

## Price

List price, per seat per year, from ThreatDown (Malwarebytes)'s own pricing page (https://www.threatdown.com/pricing/), verified 2 Oct 2026:

| Seats | Per seat per year | Total per year |
|---|---|---|
| 10 | $79.00 | $790.00 |
| 25 | above the online maximum of 20; sold via sales | not a store price |
| 100 | above the online maximum of 20; sold via sales | not a store price |

## Independent test results

- AV-Test protection: no public result.
- AV-Comparatives protection rate: no public result.
- MITRE ATT&CK Evaluations: 23.7% analytic coverage, round 2024 (older than 18 months; scores zero). Source: https://evals.mitre.org/results/enterprise?view=cohort&evaluation=er6&result_type=DETECTION&scenarios=1,2,3

## What it includes

- EDR: included
- 24/7 managed response: not offered
- Ransomware rollback: included
- Device control: included
- Patch management: included
- Email security: paid add-on
- Identity protection (ITDR): paid add-on
- Mobile: paid add-on
- Linux: included
- macOS: included
- SIEM integration: included
- RMM / PSA integration: included
- MSP multi-tenant: included

## Buying and running it

- Buy online without sales: yes
- Minimum seats: 5
- Needs in-house security staff: no
- Setup time estimate: about 1 hours

## Who it suits

- small no it: ThreatDown Advanced packs a lot into a self-serve licence: EDR, patching, device control and ransomware rollback, from a minimum of five devices. It suits an office with one technically minded person willing to read alerts, because no managed SOC is included. Two caveats: rollback works only on Windows, and ThreatDown has no AV-Test business result since October 2023 and no AV-Comparatives one since 2022.
- msp managed: MSPs with their own SOC get good tooling from ThreatDown Advanced: Splunk, Sentinel and Chronicle feeds, and 11 named RMM and PSA integrations running from Syncro and SuperOps to Datto and Kaseya. The online store stops at 20 devices; larger quantities are sold by quote through ThreatDown or partners rather than online. MSPs who want ThreatDown's analysts watching should sell Elite instead.
- regulated: Pick ThreatDown Advanced for PCI DSS environments, where Malwarebytes holds an Attestation of Compliance, and avoid it for HIPAA. Malwarebytes will not sign a BAA, stating that the product is not designed to handle ePHI. No CMMC or FedRAMP position is published.

## Not for, or worth knowing

- Businesses under 5 endpoints: the ThreatDown online store enforces a 5-device minimum purchase quantity; a cart opened for 3 devices is raised to 5. (source: https://www.threatdown.com/pricing/, verified 2026-09-30)
- Organisations needing 24/7 managed detection and response: Advanced includes EDR only; MDR requires an upgrade to ThreatDown Elite. (source: https://www.threatdown.com/pricing/, verified 2026-09-30)
- Regulated buyers that require a signed HIPAA Business Associate Agreement: Malwarebytes does not sign BAAs because it is not designed to receive, store, process, or transmit ePHI. (source: https://support.threatdown.com/hc/en-us/articles/40223444237843-ThreatDown-and-Health-Insurance-Portability-and-Accountability-Act-HIPAA, verified 2026-10-02)
- No AV-Test business result since October 2023 and no AV-Comparatives business result since 2022. (source: https://www.av-test.org/en/antivirus/business-windows-client/manufacturer/malwarebytes/, verified 2026-10-02)
- Ransomware rollback (7-day) is Windows-only; not available on macOS or Linux. (source: https://www.threatdown.com/products/endpoint-detection-and-response/, verified 2026-10-02)
- 24/7 managed detection and response (MDR) requires an upgrade to ThreatDown Elite. (source: https://www.threatdown.com/pricing/, verified 2026-10-02)

Full report with evidence screenshots: https://endpointindex.com/products/threatdown-advanced/