Cisco Secure Endpoint (AMP for Endpoints)

Next-generation antivirus / endpoint protection platform (EPP)

Secure Endpoint is an endpoint protection platform that prevents malware from running on the host, going beyond signature matching to include reputation, machine learning, and behavioral engines. A single agent installed on the endpoint enforces the protection, and the resulting convictions and quarantines are reported to a cloud console. It serves as the primary anti-malware control on the machine rather than an add-on to another product.

Endpoint detection and response (EDR) with continuous activity monitoring and recording

The agent continuously records endpoint activity — file executions, process launches, network connections, and file movement — and sends that telemetry to the cloud rather than only alerting on convictions. Analysts use the recorded history to investigate what happened before and after a detection, including activity that looked benign at the time. Detection and response actions such as investigation, containment, and remediation are driven from the same console holding that data.

Signature-based malware detection engine (including offline protection)

The agent includes a signature-based detection engine with a definition set stored locally on the endpoint. Because the definitions are local, this engine keeps scanning and convicting known malware while the endpoint is disconnected from the cloud. It runs on file access and on scheduled or on-demand scans, quarantining files that match.

Cloud-based file reputation lookups (1-to-1 hash, fuzzy fingerprinting)

When a file is seen on an endpoint, the agent computes its hash and queries the cloud for a disposition, receiving a clean, malicious, or unknown verdict. In addition to exact one-to-one hash lookups, fuzzy fingerprinting matches files that are structurally similar to known malware so minor modifications do not evade the lookup. A malicious disposition results in the file being blocked and quarantined, and the lookup result is recorded against the endpoint.

Machine learning-based malware detection (pre-execution and runtime)

Machine learning models classify files as malicious or benign without needing a matching signature. Analysis is applied before a file executes, based on its static attributes, and during execution based on what the running code does. This is what allows previously unseen samples and variants to be convicted, and convictions from these models are reported alongside other engine detections.