Last week's posts were about email: buying the Check Point license on its own through cAIberOps, the six steps before a renewal, and how to choose between license only and managed. The license-only promise in the first of those posts has applied to endpoint protection from the start; this post spells it out for endpoint and adds a second shape, the license with Check Point's own managed service. If your laptops and servers run CrowdStrike, SentinelOne, Sophos or another endpoint product, the renewal is coming, and you would consider Check Point for the same job at a lower price, here is how buying Harmony Endpoint through us works: the price beat, on the license alone or on the license with Check Point's own managed service, Check Point's 30-day trial first, what is in the package, and what the switch involves.
A note on the name
Check Point renamed the product this year. Check Point's proof-of-concept guide now states that "Harmony Endpoint is now referred to as Check Point Endpoint Security," and that "No functional changes were made"; the administration guide carries the same note, with the shorter name Endpoint Security. The management console that older pages call the Infinity Portal is called the Check Point Portal in the current documentation. We use Harmony Endpoint in this post because that is the name on the quotes you have seen and the one you would search for; the product on your quote from us will read Check Point Endpoint Security.
Who this is for
A business that already pays for a dedicated endpoint product, has a renewal in the next few months, and wants to know what the Check Point equivalent would cost, with proof on its own machines before signing. There are two versions of that business, and the promise covers both. One runs the product with its own admin or IT provider and wants the license alone, in its own Check Point Portal account. The other pays the vendor for the product and the vendor's own managed service on top, and wants the same arrangement from Check Point: the license plus Check Point's managed service, with Check Point's team watching and responding. If you would rather have us operate it, that is a third arrangement, covered at the end.
The price promise, applied to endpoint
The terms are the ones we published for email, with devices in place of mailboxes. Send us a written, current quote from another vendor or reseller for the same type of product: the same product category and protection tier as the Check Point package we would quote, the same number of devices or seats, the same term, dated within the last 30 days, issued to your business for a paid standalone license or subscription. Apples to apples, we will beat that price. Guaranteed, on those terms. A beat, not a match.
Apples to apples has two shapes here. License against license: your quote for the product alone, beaten with the matching Check Point Endpoint Security package alone. And license plus managed service against license plus managed service: your quote for the product with the vendor's own MDR service, whatever it is called on your quote, beaten with the matching Check Point package plus Check Point's managed service, MDR 360°, which Check Point describes as "24/7 expert monitoring" and says "Automated containment and proactive threat hunting reduce dwell time." The same tier, the same devices, the same term, and the same kind of service on both sides. We do not beat a license-only quote with a managed quote or the other way around; that is not a comparison.
It applies to the renewal quote for the product you hold today. It also applies to a quote for a higher tier you want to step up to; we beat that quote with the matching Check Point package. If your current tier is lower than the Check Point package you have in mind, we beat the quote with the package that matches your current tier and quote the higher one separately, so you can see what the step up costs. We do not publish a price list for either shape, because the number depends on the package, the service, the count and the term. Bring the quote and we come back with the comparison, usually within two business days.
What is in the package
Check Point sells Harmony Endpoint in packages, and matching your tier to the right one is the first thing we do with your quote. On the current solution brief we work from, there are three. Endpoint Security Advanced covers ThreatCloud and IOC Management, Firewall, Application Control, Endpoint Compliance, Remote Access VPN, Anti-Ransomware, Anti-Malware, Anti-Bot, Anti-Exploit, Behavioral Guard, Port Protection, Zero Phishing, URL Filtering, Corporate Password Reuse and Safe Search, plus EDR, which the brief describes as "Forensics collection & automated reports, MITRE Mapping, and Threat Hunting." Endpoint Security Complete adds Full Disk Encryption and Removable Media Encryption. Endpoint Security Elite adds Infinity XDR for Endpoint, Posture Management and DLP. Threat Emulation and Threat Extraction, the sandboxing and file sanitizing engines, sit in Advanced on the current brief. We confirm on the quote itself which package carries each component, because Check Point revises its packaging.
A few of those in Check Point's own words, because the names are shorthand. Anti-Ransomware "Constantly monitors for ransomware specific behavior and identifies illegitimate file encryption, signature-less." Threat Emulation is "Threat sandboxing capability to detect and block new, unknown malware," and Threat Extraction "Removes exploitable content, reconstructs files" and "delivers sanitized content." Zero Phishing is "Real-time protection from unknown zero-day phishing sites." If your current product includes disk encryption or removable media encryption, that is the Complete package, while plain device or port control is already in Advanced; if the quote you are leaving includes an XDR add-on, that is where Elite comes in. We map your tier line by line before we quote, so the comparison is the same protection on both sides.
The client runs on Windows 7 SP1 through Windows 11 25H2, Windows Server 2008 R2 through 2025 and macOS 11 through 26 (the oldest server versions and macOS 11 through 13 only on older client builds, per Check Point's notes), and Linux including Ubuntu, Debian, RHEL, AlmaLinux and SLES, per Check Point's supported operating systems page. Management is cloud-hosted: per Check Point, "The cloud-based Check Point Portal console enables real-time monitoring, policy management, and response to security events, simplifying endpoint protection at scale." Check Point calls that service Endpoint Management as a Service.
Check Point's 30-day trial, before you sign
For email our trial is the two-week Monitor-only assessment. For endpoint, the trial is Check Point's own, and it is longer. Per the administration guide, "When you create an account in the Check Point Portal and access the service, you get a free 30-day trial," and "After the 30-day trial period, you must purchase a software license to use the product." We create the account with you, in your name, and we are on the call when the first client installs and again when the trial ends.
Thirty days is enough to install the client on a representative set of machines, including a server if you run one, watch the console, and see what the engines report on your own fleet. It is also enough to run the trial alongside your renewal timeline: started six weeks out, it ends with more than a week to spare and the quote already on the table. If you decide to buy, the license is attached to the account that is already running: per the guide, licensing is done through your Check Point User Center account, and activation is in the portal under Global Settings, Services and Contracts, where you sign in with those credentials and select the license. The license is applied to the account the trial already runs on, not to a new installation. The trial is Check Point's trial of the product; if you are buying the license with Check Point's managed service, we tell you before the trial how and when that service starts.
The switch: what to plan for
This is where endpoint differs from email, and we would rather you hear it from us than from the installer. Check Point's documentation is direct about it: with Harmony Endpoint installed, "Third-party AV engines are completely disabled or uninstalled," and running it side by side with another anti-virus product "is not supported." On Windows workstations the Anti-Malware component, per Check Point, "automatically sets Windows Defender to Passive or Disabled mode"; on Windows servers Defender is uninstalled by hand. The installer removes some products on its own by default (Check Point names Symantec, McAfee and Kaspersky). CrowdStrike, SentinelOne and Sophos are not on that list, so uninstalling them is a step you or your IT provider schedule, with the old vendor's uninstall tool or the removal options Check Point documents, on the day you choose. That is also why the trial runs on a representative set rather than your whole fleet: those machines move to Check Point for the trial, the rest stay on what you have.
Rollout itself is the standard pattern. Check Point's guide describes installing an Initial Client and then assigning components through deployment rules in the portal, or exporting a package for your own deployment tool. You run that; we are on the call when it starts. We do not uninstall your old product and we do not touch your devices.
What comes with the license
Licenses bought through us are Check Point licenses: your own Check Point Portal account, your own User Center account, and Check Point's technical support under the support plan on your quote; we tell you which plan it is and who to call before you buy. For the term of a license bought through us, once a month, you get a short written report and the offer of a call: a review of the product's report with you (exported, or read-only access you choose to grant), what Check Point released since the last check-in and whether we think you should turn it on, and a renewal heads-up, typically about 30 days out, with the device count confirmed with you. Think of it as a customer success manager for the product, not an operator.
What it is not
On the license-only route, license only means license only. We do not monitor your console day to day, triage your alerts, run forensics or respond to incidents on your fleet; that work is either yours, Check Point's under MDR 360°, or ours under the managed service below. This is not a penetration test or a vulnerability scan, and we do not sell either. We do not write your policies or certify compliance; the product supports the relevant parts of frameworks such as HIPAA, the FTC Safeguards Rule, NIST 800-171 and CMMC, not the whole framework.
If you would rather hand it off
The third arrangement is ours. Managed Endpoint Protection on Check Point Endpoint Security, the license and our managed service together, starts at $8 per endpoint per month; what sits above the starting price depends on the coverage you need, and we scope it with you on the call. Managed Email Security starts at $6.40 per user per month on the year-end offer ($5.60 for registered 501(c)(3) nonprofits; $8 list). The offer is 20% off (30% for registered 501(c)(3) nonprofits) on a 12-month Managed Email Security agreement signed by December 31, 2026, new customers only, no onboarding fee. The two license routes above are priced against your quote; the managed services are priced on our published starting prices.
How to start
Send the endpoint renewal quote you have, with the tier, the device count, and whether it includes the vendor's managed service, or tell us the product you run and when it renews. We come back with the Check Point package that matches, with or without MDR 360° to match your quote, the price against your quote, and a date to open the 30-day trial. We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start, book a free 15-minute call, or see the services page.
Sources: Check Point Endpoint Security administration guide (revision history; Introduction; Managing Licenses; Activating the License; Uninstalling Third-Party Anti-Virus Software Products; Deploying Endpoint Clients; Supported Operating Systems); Check Point Endpoint Security proof-of-concept guide (Installation and Deployment; revision history); Check Point Endpoint Security solution brief (packages and capabilities); Check Point support plans page; Check Point MDR 360° / MXDR 360° solution brief and product page; the price promise terms as stated in this post and in the Check Point license post on caiberops.com; the Managed Email Security offer terms as stated in the Managed Email Security post on caiberops.com.
