It is SonicWall's all-in-one endpoint protection platform, engineered entirely by SonicWall and powered by its patented RTDMI engine. It combines next-generation antivirus (NGAV) and endpoint detection and response (EDR) on a single lightweight agent, so your laptops, desktops, and servers get real-time threat prevention plus the tools to detect, investigate, and roll back attacks that get past the first line of defense.

Both are SonicWall endpoint products, but they run on different technology. Capture Client is the established, SentinelOne-powered platform. SonicWall Endpoint Security is newer and built entirely by SonicWall on its own RTDMI engine, aimed at giving MSPs and small to mid-sized businesses enterprise-grade protection without enterprise pricing. If you are not sure which one fits your environment, talk to one of our SonicWall-certified reps and we will walk you through it.

Both editions include the lightweight NGAV plus EDR agent, multi-engine detection, cloud sandboxing, ransomware restore, device control, and live threat hunting. Premier adds historical threat hunting and 30 days of retained EDR telemetry, so you can trace an incident back through time instead of only seeing what is happening right now. Choose Advanced for strong day-to-day protection, and Premier when you need deeper investigation.

It is sold as a per-endpoint subscription in seat tiers, with one, three, and five year terms, and monthly or annual billing on the managed option. Pricing depends on the edition you choose and how many endpoints you are covering. Tell us your seat count and term and we will get you a quote.

No. SonicWall Endpoint Security is cloud-based and protects your endpoints whether they are in the office or remote, with or without a SonicWall firewall. If you do run SonicWall firewalls, the two work better together, sharing threat intelligence and giving you network and endpoint visibility from one place.

Everything runs from one cloud-based, multi-tenant console. You deploy a single lightweight agent to each endpoint, then set policies, monitor alerts, and run threat hunts from that one view. For MSPs, the multi-tenant hierarchy lets you manage every client from the same place, and it integrates with the PSA, RMM, and SIEM tools you already use.

Yes. If ransomware does encrypt files, ransomware restore uses VSS shadow copies to roll the affected files back to their pre-attack state, and device isolation contains the compromised machine so the attack cannot spread while you investigate. Behavior-based detection and the RTDMI engine are designed to catch it before it runs in the first place.