Kaspersky Embedded Systems Security Base Plus

What is included in Kaspersky Embedded Systems Security Base Plus?

Application Launch Control – Default deny allowlisting that blocks any unapproved executable.
Device Control – Governs which USB storage devices may connect to hardware.
Optional anti-malware engine – Signature and cloud-assisted scanning that can be switched off.
Windows Firewall management – Configures the local firewall from Kaspersky Security Center.
SIEM and syslog export – Converts application events into formats your SIEM can read.
Important – File Integrity Monitor and Log Inspection require the Compliance Edition.

What are the main benefits of Kaspersky Embedded Systems Security Base Plus?

Kaspersky Embedded Systems Security Base Plus is a hardening-first security product for low-power embedded devices such as ATMs, payment terminals, self-service kiosks and medical equipment. It is managed centrally through the on-premises Kaspersky Security Center console, and can also be driven from a local GUI or the command line on devices that sit in isolated network segments.

Runs on unsupported Windows – Protects devices whose operating system stopped receiving patches.
Low resource footprint – Designed for hardware that cannot run standard endpoint agents.
Trusted installer updates – Software updates run without manual re-approval of each file.
Works in isolated networks – Local console manages agents where no domain exists.
Exploit prevention – Guards process memory on systems that cannot be patched.
Evidence for audits – Exports device and application events for auditor review.

Best antivirus? Why Windows Defender alone is not enough
Explains where the built-in Windows protection stops and which control layers a dedicated security product adds.

Which company size is Kaspersky Embedded Systems Security Base Plus suitable for?

The deciding factor is not headcount but whether you operate purpose-built devices that cannot be patched or replaced, and whether a Kaspersky Security Center installation already exists to manage them. A retailer with a handful of tills and no server room will find the console requirement heavier than the protection is worth; an operator with distributed terminals across many sites is exactly the intended case.

Does Kaspersky Embedded Systems Security Base Plus meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act has applied since 1 April 2025 and concerns operators of critical infrastructure, for example energy and drinking water supply, transport companies, listed hospitals and cantonal and communal administrations, not every Swiss company. Affected organisations must report a significant cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, with 14 days to complete the report. Kaspersky Embedded Systems Security Base Plus supports the detection side of that duty: it records application launches, device connections and blocked actions per device and forwards those events to a syslog server or SIEM, which shortens the time needed to describe what actually happened on a terminal. It does not correlate an attack across your network, does not reconstruct root cause, and does not produce or submit the BACS report, so the reporting workflow itself has to exist in your incident response plan. The two components most often used as after-the-fact evidence, File Integrity Monitor and Log Inspection, are not part of this licence. This is a product description and not legal advice; have a qualified adviser confirm whether your organisation falls under the reporting obligation.

Does Kaspersky Embedded Systems Security Base Plus meet the requirements of European cybersecurity legislation?

No software product makes a company NIS 2 compliant, because the directive addresses organisational measures that entities in scope must implement across processes and responsibilities, not only through tools. NIS 2 names measure categories including risk analysis and information system security policies, incident handling, business continuity, supply chain security, security in the acquisition, development and maintenance of systems including vulnerability handling, access control and asset management, basic cyber hygiene, cryptography, and multi-factor authentication. This product contributes to a narrow part of that list: technical hardening of individual devices, access control for removable media, and event logging that feeds incident handling. It contributes nothing to multi-factor authentication, cryptography and key management, vulnerability and patch handling, backup and business continuity, or staff training, all of which the directive names explicitly. Integrity monitoring, which assessors frequently expect as evidence under the acquisition and maintenance category, requires the Compliance Edition rather than this licence.

What should you know about official assessments of Kaspersky?

On 20 June 2024 the US Department of Commerce Bureau of Industry and Security issued a Final Determination prohibiting Kaspersky from providing anti-virus and cybersecurity products or services in the United States or to US persons, citing risks arising from Russian jurisdiction over the company. New sales were barred from 20 July 2024 and signature and codebase updates, along with operation of the Kaspersky Security Network, from 29 September 2024; three Kaspersky entities were also added to the Entity List. The determination remains in force and is specific to the United States and US persons. Germany's Federal Office for Information Security issued a warning in March 2022 recommending that Kaspersky products be replaced, and confirmed after the US action that this warning still stands, without any German sales ban; Italy and the Netherlands restricted use in government procurement rather than in the private sector. Kaspersky rejects the allegations, states that the decision reflects the geopolitical climate and theoretical concerns rather than a technical evaluation of its products, and has proposed independent third-party verification of its software and updates. Independent laboratory testing by AV-TEST and AV-Comparatives has continued throughout. In practice this matters most if you bid for public sector contracts, supply organisations with US ownership or US customers, or answer supply chain questionnaires that ask about country of origin; for a privately held Swiss or EU operator with no such obligations, it is a documentation question rather than a blocker.

Norton vs. Kaspersky – Which antivirus program offers the best protection?
Compares detection results and feature scope of both vendors, useful if procurement rules push you towards an alternative supplier.

Does Kaspersky Embedded Systems Security Base Plus help with security questionnaires from large customers?

Partly, and it is worth knowing in advance which boxes stay empty. It answers questions on malware protection for endpoints, application allowlisting and default deny, removable media control, host firewall configuration, centralised policy management, and forwarding of security events to a SIEM. It does not answer questions on file integrity monitoring, log inspection, multi-factor authentication, disk or removable media encryption, patch and vulnerability management, endpoint detection and response, mobile device management, or backup and recovery, and it will not satisfy a country-of-origin or sanctions-screening question about the vendor. The cheapest way to close the integrity monitoring and log inspection gap is the Compliance Edition of the same family rather than adding a second product, because it uses the same agent and the same console; the remaining gaps in encryption, patch management and detection and response genuinely require separate products, so budget for them rather than assuming the embedded licence covers them.

Test: Best antivirus programs for Windows
Reviews current Windows protection products and the criteria worth weighting when a questionnaire asks you to justify your choice.

What is the difference between Kaspersky Embedded Systems Security and the Compliance Edition?

The single decisive difference is system integrity monitoring. Kaspersky sells the two as separate licences for the same application, and the Compliance Edition unlocks File Integrity Monitor, Log Inspection and Registry Access Monitor, which the standard licence leaves disabled. Protection components are otherwise identical, so the choice comes down to whether an auditor or a card scheme expects you to evidence unauthorised changes to files, registry keys and event logs. If PCI DSS or SWIFT assessments apply to the devices you are protecting, the standard licence will leave a documented gap.

Which limitations should you know before buying?

Regional availability is the first thing to check: the product cannot be sold to or used by US persons under the US Department of Commerce determination, and updates and Kaspersky Security Network access are blocked there, so a Swiss or EU operator with US subsidiaries or US-based devices cannot deploy it group-wide. Platform coverage is limited to Windows and Linux embedded devices through two separate applications with different component sets; there is no macOS agent, no mobile device management, and the Windows-specific components described above belong to the Windows application. The most common follow-up purchases are the Compliance Edition for integrity monitoring and log inspection, a separate product for endpoint detection and response, and separate products for patch management and encryption, none of which this licence contains. Central management also assumes a Kaspersky Security Center installation you host and maintain yourself, which is real administrative work rather than a checkbox, and the local GUI and command line are the fallback where a console is not reachable.

End of support for Windows 10: what happens next
Sets out the options once an operating system stops receiving security updates, the situation most embedded devices are already in.

Frequently asked questions about Kaspersky Embedded Systems Security Base Plus

What does Base Plus mean in the product name?

Base identifies a new licence rather than a renewal or an add-on to an existing product, so it does not require you to already own anything. Plus identifies the support level: under Kaspersky's licensing scheme the Plus licence types include the premium support tier instead of standard support. The licence type does not change which protection components you get.

Can the product run without a central management console?

Yes. It can be operated from a local graphical console or the command line on the protected device, which is how it is usually run on segmented or offline networks. Central policy management, update distribution and consolidated reporting require Kaspersky Security Center.

Does it also protect Linux-based embedded devices?

Kaspersky ships the solution as two applications, one for Windows and one for Linux embedded systems, and updated both in a codebase overhaul released in late November 2025 that added a behavioural analysis engine and Automatic Exploit Prevention. Component names and available features differ between the two, so confirm which application your devices need before ordering.