WithSecure Client Security is endpoint protection for Windows computers managed by a business IT team. It combines malware scanning, application behavior monitoring and controls for web access and removable devices, with security policies supplied through Policy Manager.
Policy Manager
Policy Manager gives administrators a central place to distribute protection settings and monitor managed computers. They can lock selected settings so that users cannot change them locally. This affects which options are available in WithSecure Client Security: a user may be able to run a scan or review a detection while the IT team retains control over exclusions and protection settings.
The client displays its protection status and recent events on the computer. Its event history identifies detected threats, their locations and the actions taken, while status indicators draw attention to disabled features, outdated protection updates or subscription problems.
How WithSecure Client Security scans for malware
Real-time scanning checks files as applications access them and blocks access when it finds malware. WithSecure Client Security also provides a targeted malware scan for memory and common infection locations, a full scan of internal and external drives, and scans of individual files or folders through Windows Explorer.
Manual scans can inspect files inside compressed archives. Real-time scanning does not unpack ZIP archives. Scan settings can concentrate on file types likely to contain harmful code, and scheduled scans can run daily, weekly or at four-week intervals. A low-priority option lets scheduled scanning yield more resources to other activity, at the cost of taking longer.
Detection results offer actions such as cleaning, quarantine or deletion, depending on the item. Quarantine keeps suspicious files apart from normal use and records their original locations; authorized users can review them and restore an item if appropriate. A completed scan produces a report showing its results and the number of items cleaned.
Script and macro scanning through AMSI
The Windows AMSI interface provides another inspection route for scripts and macros. Applications and Windows services can submit content to the security client for scanning, including code that is loaded into memory rather than saved as a conventional file. These detections also appear in the event history.
DeepGuard
DeepGuard checks an application’s reputation through a cloud service. When its safety cannot be established, it monitors behavior for potentially harmful changes, such as altering important system files, changing registry settings or trying to disable security programs. It can stop the application and prevent suspicious internet access.
A blocked-application list lets an authorized user review a DeepGuard decision and allow an application they trust through an exclusion, subject to the organization’s policy.
DataGuard
DataGuard, available in the Premium edition, restricts access to selected folders to protect their contents from ransomware and other destructive software. Users can add or remove protected folders, and the client reports attempts by unsafe applications to access them. An application that is trusted can be permitted to use the folder.
DataGuard requires DeepGuard to be enabled. Its protected-folder list also informs DeepGuard’s monitoring, linking the files the organization wants to protect with checks on the applications trying to reach them.
Browsing Protection
Browsing Protection blocks websites rated harmful and can also block suspicious or prohibited sites. Reputation icons beside search results help distinguish known safe, suspicious, harmful and unclassified destinations before a link is opened. The browser extension supports these functions in Chrome, Edge and Firefox.
Web Content Control applies a different kind of restriction: administrators can block selected categories of websites or allow access only to specified addresses. A local allowed-site entry cannot override an explicit administrator block. The search result filter can enforce strict SafeSearch settings, though it cannot remove every explicit result. Browsing Protection’s extension is required for content filtering to work properly.
WithSecure Client Security can also block applications from downloading harmful files through Advanced Network Protection. This extends checks beyond links opened directly in a browser.
Connection Control
Connection Control activates when a supported browser opens a recognized banking website. During that session, it limits network connections to destinations considered safe for banking, reducing the connections that other applications can maintain alongside the transaction.
Its settings cover untrusted applications, command-line and scripting tools, remote access during banking, and clearing clipboard data when the session ends. An on-screen indicator shows when Connection Control is active and lets the user end the session to restore other connections.
Windows Firewall
WithSecure Client Security uses Windows Firewall to filter network traffic and control incoming connections. The client provides access to Windows Firewall settings, where applications can be allowed through the firewall when their network functions require it. DeepGuard separately monitors applications for suspicious internet access.
Device Control
Device Control lets the IT team govern removable storage and other hardware through Policy Manager. A blocked device is disabled when connected. Rules can block a class of devices while allowing a particular device as an exception.
For permitted removable drives, write access and execution permissions are separate choices. A USB drive can remain readable while copying files onto it is prohibited, and executable files on that drive can be prevented from running. Hardware-ID exceptions can grant write and execution access to specifically approved devices.
Application Control
Premium Application Control gives administrators explicit rules for allowing, blocking or monitoring applications. These rules can restrict execution, installation and script activity, independently of DeepGuard’s assessment of suspicious behavior.
Rules can identify a target file version to prevent a vulnerable application build from running. Application and download-folder paths can also be used to prevent programs from automatically launching downloaded files. Administrators manage these decisions through application control profiles and exception rules.
Software Updater and protection updates
Premium Software Updater checks supported installed applications for missing updates. Administrators can deploy updates automatically, select individual patches, exclude particular updates or permit users to manage available updates locally. The client shows installation progress for selected updates; coverage depends on the supported applications and products.
Protection updates are handled separately and are retrieved automatically while the computer is connected. For isolated Client Security computers, Policy Manager can prepare an update archive on a connected machine for import into the isolated environment.
