WithSecure Elements in Practice: Endpoint Protection for SMEs

By Tobias Massow · May 28, 2024 · 4 min read

We tested WithSecure Elements for three months in a mid-sized IT environment with 180 endpoints. The result: fast deployment, strong EDR functions – but the documentation could be better.

TL;DR

We tested WithSecure Elements for three months in a mid-sized IT environment. Strengths: fast deployment, good cloud integration, strong EDR functions. Weaknesses: the learning curve for advanced features and the documentation could be better.

WithSecure Elements promises modular cloud security from a single source. We wanted to know if the platform delivers on what the marketing materials promise – and used it for three months in a real corporate environment with 180 endpoints.

Setup and Deployment

The setup went surprisingly smoothly. The cloud-based management server was configured in under an hour. The endpoint agents could be distributed via GPO or SCCM. After two days, all 180 endpoints were connected. Particularly positive: the migration from the previous antivirus product ran without significant compatibility issues.

Endpoint Protection in Daily Use

The basic protection functions work unobtrusively and are resource-efficient. Compared to the predecessor product, support tickets for performance complaints decreased by about 40%. The DeepGuard component (behavior-based detection) produced some false positives with industry-specific software in the first two weeks but could be quickly optimized through targeted exceptions.

EDR: Strongest Feature

The EDR functions are the highlight. Broad Context Detection (BCD) correlates events across multiple endpoints and visually displays attack chains. In the test, the system detected a simulated lateral movement attack within 90 seconds and graphically displayed the complete attack path.

Vulnerability Management

The integrated vulnerability management scans endpoints and network devices for known vulnerabilities. Prioritization based on exploit probability (not just CVSS score) is practical. However, for larger environments, stronger integration with patch management tools would be desirable.

What Was Missing

The documentation for advanced response actions is thin. Those who want to write custom detection rules have to work through community forums. Additionally, there is a lack of native integration with common SOAR platforms – the API is available, but pre-built playbooks would be helpful.

Key Facts

Test Environment: 180 endpoints (Windows 10/11, Server 2019/2022)

Deployment: 2 days for full rollout

False Positive Rate: less than 0.5% per week after tuning

EDR Detection: Lateral Movement in under 90 seconds

Resource Consumption: approx. 120 MB RAM, minimal CPU load

Fact: The average cost of a data breach in 2025 was $4.88 million, according to IBM.

Fact: 95 percent of all cybersecurity incidents are due to human error, according to IBM.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

Who is WithSecure Elements suitable for?

Best for mid-sized companies (100-2,000 endpoints) with a small security team looking for an all-in-one platform. Large enterprises with their own SOC might miss more flexibility in detection engineering.

What is the licensing model?

Modular per endpoint and year. EPP, EDR, and VM can be licensed individually or as a bundle. The prices are mid-range – cheaper than CrowdStrike, more expensive than Sophos.

NIS2 Directive: What Companies Need to Know

Cyber Insurance 2026

Zero Trust: The 7 Most Common Mistakes

Does Every Company Need a CISO?

Not every company needs a full-time CISO, but every company needs clear accountability for IT security at the executive level. SMEs can rely on an external CISO (Virtual CISO). With NIS2, management responsibility is legally anchored.