ThreatDown Powered by Malwarebytes Ultimate Corporate

What is included in ThreatDown Powered by Malwarebytes Ultimate Corporate?

Nebula console – Cloud console for policies, endpoints, quarantine and reporting.
Endpoint protection and EDR – Blocks malware and records suspicious process activity for later analysis.
Ransomware Rollback – Reverts file changes on Windows for up to seven days.
Patch and encryption management – Deploys application updates and enforces BitLocker on Windows endpoints.
MDR Plus and ITDR – 24/7 analysts, notification SLA and identity monitoring included.
Important – Server, mailbox and mobile protection are separate products.

What are the main benefits of ThreatDown Powered by Malwarebytes Ultimate Corporate?

Ultimate is the top bundle of the ThreatDown endpoint security family and is operated entirely from the cloud-based Nebula console, with no management server to run in your own data centre. ThreatDown replaced the Malwarebytes business product line in November 2023, so buyers still searching for Malwarebytes Endpoint Protection or Malwarebytes for Business arrive at this same product family.

One agent – One installer covers prevention, EDR, patching and encryption.
Recovery without backup – Rollback restores Windows files when no recent backup exists.
Cover outside office hours – Analysts respond at night, at weekends and on holidays.
Contractual notification SLA – Critical incidents notified within 45 minutes under MDR Plus.
Root cause report – Written post-incident analysis for management, auditors and insurers.
Fewer separate tools – Patching, encryption and identity monitoring in one console.

Best antivirus? Why Windows Defender alone is not enough
Explains where the built-in Windows protection stops and what a managed endpoint product adds on top of it.

Which company size is ThreatDown Powered by Malwarebytes Ultimate Corporate suitable for?

The deciding factor is not headcount but whether anyone in your company is available to read and triage security alerts at three in the morning. Ultimate is built for organisations that answer no to that question, because the MDR Plus service takes over that shift instead of a person.

Does ThreatDown Powered by Malwarebytes Ultimate Corporate meet the requirements of Swiss cybersecurity legislation?

In Switzerland the reporting duty under the revised Information Security Act applies to operators of critical infrastructure, not to every company, and those operators must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering it. The parts of that deadline this product actually helps with are detection and evidence: EDR records the process, registry and network activity behind an incident, MDR analysts under the MDR Plus service level attempt to notify your designated contact within 45 minutes of confirming a critical incident, and the post-incident root cause analysis produces a written timeline with affected hosts and accounts. What the product does not do is file the report or decide whether one is due. ThreatDown states in its own MDR service description that regulatory reporting remains solely the customer's responsibility, and that a root cause analysis is an operational review rather than a forensic investigation, with no chain of custody and no determination of whether a legal or regulatory breach occurred. Anything that needs evidence preservation for litigation, memory forensics or malware reverse engineering has to come from a separate incident response provider. This is not legal advice, and whether your company falls under the reporting obligation must be assessed for your specific case.

Does ThreatDown Powered by Malwarebytes Ultimate Corporate meet the requirements of European cybersecurity legislation?

No software product makes a company compliant with the NIS 2 Directive, because the directive addresses organisational risk management and not a purchased tool. NIS 2 requires measures in categories such as incident handling, business continuity and crisis management, supply chain security, vulnerability handling, cryptography, access control and staff training. This bundle covers incident handling through EDR and the 24/7 managed service, vulnerability handling through vulnerability assessment and patch deployment, cryptography through centrally enforced BitLocker with recovery key escrow in the console, and access control for the management platform itself through role-based access, single sign-on and mandatory multifactor authentication. It does not cover business continuity: ransomware rollback caches file changes locally and is not an off-site backup, so a separate backup and restore process is still required. Supply chain security, staff awareness training, network segmentation beyond the endpoint firewall, and mailbox protection are outside the scope of the bundle as delivered.

Does ThreatDown Powered by Malwarebytes Ultimate Corporate help with security questionnaires from large customers?

Yes, for the endpoint and identity sections, and not at all for several others. It answers, with evidence exportable from the console: EDR deployed on all workstations, 24/7 human monitoring with a contractual notification target, patch status per device and per application, disk encryption state with escrowed recovery keys, multifactor authentication on the administrative console, and monitoring of privileged account behaviour in Entra ID or Okta. It does not answer questions on backup and restore testing, email filtering and phishing simulation, mobile device management, network segmentation, penetration testing, awareness training, or organisational certification such as ISO 27001. It also does not answer data residency questions favourably by default, because most accounts are provisioned in the standard data centre rather than the European one. Where the gaps sit inside this vendor's own catalogue, filling them from the same family is usually the cheaper route than adding a second vendor: Email Security, Mobile Security and DNS Filtering are add-ons to the same console and the same agent, and server coverage comes from Ultimate for Servers. Backup, awareness training and certification have to be sourced elsewhere regardless.

What is the difference between ThreatDown Elite and ThreatDown Ultimate?

The decisive difference is contractual rather than technical: Elite gives you the 24/7 managed service with non-binding response targets, while Ultimate upgrades that to MDR Plus, which carries an actual service level agreement for notifying you of a critical incident within 45 minutes and includes post-incident root cause analysis. Ultimate also adds identity threat detection for Entra ID and Okta accounts, and Premium Support with extended hours. Everything below that line is identical across Advanced, Elite and Ultimate, so if you already have staff who read alerts during the day, the step from Advanced to Elite buys night cover and the step from Elite to Ultimate buys accountability and identity visibility. Note that DNS Filtering sits outside all four bundles and is purchased separately, which is a change from how Ultimate was previously marketed.

Test: Antivirus program: Best antivirus programs for Windows 2025
Compares the detection results and practical differences between the main Windows security products currently on the market.

Which limitations should you know before buying?

Two of the headline features are Windows-only: ransomware rollback reverts file changes on Windows endpoints, and Drive Encryption enforces BitLocker on Windows, while macOS and Linux devices receive prevention and EDR telemetry and their FileVault or LUKS status is only displayed in the endpoint inventory, not enforced. Server protection is not part of this product and comes from the separate Ultimate for Servers item, so a company with two file servers and a database server needs to plan for those in addition. Mailbox protection, mobile devices and DNS-level web filtering are add-ons rather than bundle components, which matters particularly for DNS Filtering because earlier marketing material presented it as the feature that distinguished Ultimate from Elite. The management platform is cloud-only through Nebula or the multi-tenant OneView console for service providers, with no on-premises or air-gapped option, and while a European data centre exists, it applies only to a limited set of accounts provisioned after 3 August 2026 — most accounts run in the standard data centre, so confirm placement before signing if data residency is a contractual requirement. Finally, the ITDR component needs at least one connected cloud identity source such as Entra ID or Okta, so an environment running purely local Active Directory will not benefit from it until such a source is connected.

Data loss is expensive: How backups help you avoid outages
Explains why a rollback function inside a security product does not replace a proper backup and restore process.

Frequently asked questions about ThreatDown Powered by Malwarebytes Ultimate Corporate

Does ransomware rollback replace a backup solution?

No. Rollback keeps local copies of files changed by untrusted processes for a period that is configurable between one and seven days, with three days as the default, and only after a 14-day learning phase in which the agent establishes which applications are trusted. It restores a device to its pre-attack state, but it stores nothing off-site and protects nothing beyond that window.

Can the management console be operated on your own server?

No. Nebula for single organisations and OneView for service providers are both cloud services, and there is no on-premises or air-gapped deployment of the management platform. The endpoint agent itself keeps protecting a device while it is offline and syncs its events once the connection returns.

What does the managed service expect from your own team?

The service description requires EDR to be deployed and healthy on every endpoint in the environment, multifactor authentication on console access, and named emergency contacts who can be reached and who are authorised to approve containment actions. If escalations go unanswered or coverage gaps are left unresolved, ThreatDown reserves the right to limit or suspend the service.