eset Endpoint Encryption Pro

What is included in ESET Endpoint Encryption Pro?

Full disk encryption – AES-256 with pre-boot authentication on Windows 10 and 11.
Removable media encryption – USB and external drives in file or full-disk mode.
File and folder encryption – Encrypted folders, virtual disks and password-protected archives.
Outlook email encryption – Plugin encrypts messages and attachments for external recipients.
Encryption Server console – Central users, policies, encryption keys and recovery workflows.
Important – ESET PROTECT cannot manage it, no Android or iOS coverage.

What are the main benefits of ESET Endpoint Encryption Pro?

ESET Endpoint Encryption Pro is the top edition of ESET's standalone encryption line, sold for years under the earlier name DESlock, and it is the only edition that unlocks full disk encryption in addition to removable media and granular file encryption. It is a base product administered from the separate ESET Endpoint Encryption Server, not from the ESET PROTECT console used for ESET's endpoint protection products.

Lost device response – Encrypted disks reduce a stolen notebook to a hardware loss.
USB policy control – Block, force encryption or allow read-only access per user.
Remote key management – Issue or revoke keys without VPN or inbound firewall rules.
Password recovery workflow – The server reissues key material instead of reimaging the machine.
Shared team keys – One key group lets colleagues open the same encrypted files.
Legacy hardware support – BIOS systems are covered, which ESET Full Disk Encryption drops.

Which company size is ESET Endpoint Encryption Pro suitable for?

Encryption obligations follow sector and customer contracts far more than headcount. A ten-person engineering office that supplies a utility often faces stricter data-at-rest requirements than a hundred-person retailer. The table below shows where this product lands.

Does ESET Endpoint Encryption Pro meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act has applied since 1 April 2025, and it targets operators of critical infrastructure such as energy and water supply, transport companies and cantonal and municipal administrations, not Swiss companies in general. Affected organisations must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, with a further 14 days to complete the report. ESET Endpoint Encryption Pro supports the preparatory side of that obligation: the console records which workstations are encrypted, keys can be revoked centrally when a device disappears, and the Encryption Server and its database run on your own Windows server, so key material and workstation records stay in your infrastructure. It does not help you meet the 24-hour deadline, because the product contains no threat detection, no alerting and no incident telemetry and will therefore never tell you that an attack happened or that a report is due. Closing that gap needs endpoint protection, a detection and response product or a monitored log pipeline, none of which is part of this licence. This is general product information and not legal advice.

Does ESET Endpoint Encryption Pro meet the requirements of European cybersecurity legislation?

No software product makes an organisation NIS 2 compliant, because the directive addresses risk management at organisational level. The measure categories it requires include risk analysis and security policies, incident handling, business continuity and backup, supply chain security, vulnerability handling, access control and asset management, staff training, multi-factor authentication, and policies on the use of cryptography and encryption. ESET Endpoint Encryption Pro maps directly onto the cryptography and encryption category, because encryption policy is defined centrally and enforced on the endpoint instead of being left to each user to switch on. It contributes partially to asset management and access control, since the console records which devices are encrypted and which users hold which keys. It contributes nothing to incident handling, business continuity and backup, vulnerability handling, supply chain security, staff training or multi-factor authentication, so organisations in scope will need at least an endpoint protection product, a backup solution and an authentication layer alongside it.

Data loss is expensive: How backups help you avoid outages
Why encryption protects confidentiality but not availability, and how backups cover the continuity requirement that encryption leaves open.

Does ESET Endpoint Encryption Pro help with security questionnaires from large customers?

Yes, for the data-at-rest block, and not for anything else. It answers, with evidence from the console rather than a written assurance: are company notebooks encrypted at rest, is encryption enforced by policy rather than left to the user, is removable media encrypted or restricted, are encryption keys centrally managed and recoverable, and can you show per-device encryption status on request. It answers none of the following, and questionnaires almost always ask them in the same section: malware protection and endpoint detection and response, patch and vulnerability management, multi-factor authentication, centralised logging or SIEM export, backup and restore testing, mobile device management, and data loss prevention. For those items an ESET PROTECT subscription tier is usually cheaper than adding a second vendor, but check the overlap before ordering both: several ESET PROTECT tiers already include ESET Full Disk Encryption, and ESET Endpoint Encryption cannot be installed on a machine that runs ESET Full Disk Encryption. Decide which of the two encryption engines you want first, then buy the protection tier around it.

Best antivirus? Why Windows Defender alone is not enough
What the malware-protection section of a supplier questionnaire actually asks for, which an encryption product cannot answer.

What is the difference between ESET Endpoint Encryption Standard and Pro?

The single decisive difference is full disk encryption: Pro is the only edition that encrypts the system disk with pre-boot authentication, and it is also the only edition that can switch on and monitor FileVault on Macs. ESET gates the three editions through exactly two features, which is why the licence wizard shows the Removable and Full Disk icons crossed out on lower editions. Essential covers granular encryption only, Standard adds removable media, and Pro adds the system disk. A single installer serves all three, so an upgrade from Standard to Pro is a licence change rather than a redeployment.

Which limitations should you know before buying?

The most important point is lifecycle status: ESET moved ESET Endpoint Encryption into its Maintenance stage on 1 January 2025, which means bug fixes, vulnerability fixes and compatibility updates for supported operating systems, but no guaranteed new features. ESET states that no termination is planned and that new purchases and renewals remain unrestricted, so this is a stability decision rather than an end-of-life warning. Platform coverage is uneven: full disk, removable media, file, archive, virtual disk and Outlook encryption are Windows features, while macOS support consists of switching on and monitoring Apple's native FileVault from the same console. The product cannot be installed on a machine that already runs ESET Full Disk Encryption, and it is not administered from ESET PROTECT, so organisations already running that console will operate a second administration environment for encryption. Windows on ARM is not supported, full disk encryption is unavailable on dual-boot and software RAID systems, and there is no Android or iOS client, so phones and tablets need a separate solution.

Cloning an SSD Without Reinstalling Windows
How disk migration and drive replacement work in practice, and why an encrypted system disk changes the procedure.

Frequently asked questions about ESET Endpoint Encryption Pro

What happens if a user loses their encryption password?

ESET is explicit about this: a Key-File password cannot be retrieved, and data encrypted with that Key-File cannot be decrypted without it. In a managed installation the Encryption Server holds the user's key material and posts a new Key-File at the next synchronisation, which is the main operational argument for running the server rather than standalone installations.

Can Windows servers be encrypted with this product?

Yes. ESET lists Windows Server 2016, 2019, 2022 and 2025 as supported for the Endpoint Encryption client, alongside Windows 10 and Windows 11 on 64-bit systems. Windows Server Core installations are not supported.

Can a recipient open an encrypted USB stick without the software installed?

In file mode, yes. When you encrypt removable media in file mode you can enable ESET Endpoint Encryption Go, which allows the drive to be opened on a Windows machine that does not have the client installed, protected by a password. The option is offered for file mode encryption, not for full disk mode.