WatchGuard ThreatSync+ is a cloud-native threat detection and response platform. It comes in two editions: ThreatSync+ NDR, which monitors network traffic for signs of breach and lateral movement, and ThreatSync+ SaaS, which monitors Microsoft 365 and Google Workspace environments for suspicious user activity and data exposure. Both require no on-premises hardware and are managed entirely through the WatchGuard Cloud.

ThreatSync+ NDR focuses on your network. It analyzes traffic flowing in and out of your network (north-south) as well as traffic moving between devices inside your network (east-west) to detect threats like lateral movement and command-and-control activity. ThreatSync+ SaaS focuses on your cloud applications. It pulls activity logs from Microsoft 365 and Google Workspace to detect account takeover, unusual file access, and other SaaS-based threats.

No. Both ThreatSync+ NDR and ThreatSync+ SaaS are 100% cloud-native solutions. There is no sensor appliance or agent to install on-premises for most deployments. ThreatSync+ NDR integrates with your existing WatchGuard Firebox devices and WatchGuard Cloud to collect the network data it needs.

ThreatSync+ NDR monitors on-premises networks, cloud environments, and VPN connections. It analyzes both north-south traffic (entering and leaving your network) and east-west traffic (moving laterally between devices inside your network). It also monitors VPN activity, including third-party VPN devices, to detect login anomalies and suspicious connection patterns.

ThreatSync+ NDR is designed to integrate tightly with WatchGuard Firebox firewalls and WatchGuard Cloud. While it can collect some data from third-party platforms (such as Cisco Meraki and Fortinet FortiGate for DHCP monitoring), full network detection and response capabilities are best realized in an environment running WatchGuard firewalls.

Yes. Firewalls.com is a WatchGuard Gold Partner with certified engineers on staff. We can help you size the right ThreatSync+ license tier, pair it with the correct Firebox model if needed, and assist with deployment through our Remote Implementation and FireGuard Complete managed services. Call us at 317-225-4117 or request a quote online.

WatchGuard ThreatSync+ is sold as an annual or multi-year subscription. ThreatSync+ NDR is available in license tiers from 1 to 50 users up to 500 or more, with 1-year, 2-year, and 3-year term options. Monthly subscription options are also available for added flexibility. Firewalls.com can provide volume pricing and multi-year quotes on request.