ManageEngine Malware Protection What It Adds Over Patching and How to Roll It Out

It helps to keep the two jobs separate, because they fail in different ways:

1. Patch management removes known weaknesses — the unpatched SMB service, the old Office build. It works before an attack, and only against holes that have a fix.
2. Malware protection watches behaviour at run time — a normal-looking program suddenly encrypting hundreds of files, or a script running code straight from memory (a fileless attack, where no suspicious file ever lands on disk for a signature scan to find).
3. A fully patched PC can still run a brand-new malicious file a user downloaded an hour ago. A protected PC can still be attacked through an unpatched hole. You need both layers; neither replaces the other.

In ManageEngine's own product documentation, the Malware Protection add-on bundles two things:

1. Next-Gen Antivirus (NGAV) — signature scanning plus behaviour analysis and machine-learning models, aimed at known and unknown malware including fileless attacks.
2. Anti-Ransomware — a behaviour analytics engine that watches for encryption-style activity and can respond when it fires.
3. Around those sit the response tools: instant quarantine of infected files and devices (cutting off lateral movement), real-time alerts by email or the mobile app, and incident forensics mapped to the MITRE ATT&CK framework so you can see which technique an attack used.
4. ManageEngine also states the agent keeps monitoring without an internet connection, so laptops off the office network are not blind spots.

Read those as vendor descriptions of how the product is designed to work — this guide repeats no independent lab score, because we quote only what ManageEngine publishes.

ManageEngine's own FAQ is blunt on this: Malware Protection is always a separate add-on licence. It is not bundled with any Endpoint Central edition — not Standard, not Professional, not Enterprise. Two practical consequences:

1. Check before you plan: in the console, open the Profile icon → License and look at the Malware Protection – Add-on managed-computers count. If it shows 0, the add-on is not purchased, no matter which edition you own.
2. The one exception ManageEngine documents: the Free edition includes Malware Protection for up to 25 devices at no extra cost — useful for a genuine trial on real machines.
3. After purchase, the add-on switches on during the next agent refresh cycle (about 90 minutes). If it does not appear, wait for a refresh before raising a ticket.

Enabling behaviour protection on every PC at full strength on day one is how false positives turn into angry phone calls. Use this order instead:

1. Pilot group first: IT machines plus a handful of normal user PCs, for at least a few days.
2. Watch the detections daily during the pilot. Note every false positive by exact file and path — you will need them for step 3.
3. Add narrow exclusions only for confirmed business software (the art of this is covered in our exclusions guide — never whole drives or whole folders like Downloads).
4. Expand in waves — one department at a time — keeping the same watch-and-tune habit for each wave.
5. Turn on email/app alerts to a person who will actually read them. An alert nobody sees is not protection.