| Feature | Details | |---------|---------| | | Signature-based + heuristic (Bloodhound), SONAR behavioral analysis | | Proactive Threat Protection | Machine learning (AdvML), reputation-based (Insight) | | Firewall | Stateful, application-aware, location-aware policies | | Intrusion Prevention (IPS) | Network-based exploit prevention | | EDR (Optional) | Requires separate EDR license and SEP Mobile for full visibility | | Management Console | On-prem (SEPM) or Cloud (SES Cloud) | | Platform Support | Windows 7–11, Server 2008 R2–2019/2022, Linux, Mac |
Build 558 was the first production release to fully officially support integration and VBS enclaves. It can run its "Advanced Machine Learning" (AML) model inside the isolated VBS environment, making it nearly impossible for kernel-mode rootkits to tamper with the SEP agent. symantec endpoint protection 14.3 build 558