What is included in ThreatDown Powered by Malwarebytes Core Server Corporate?

Endpoint Protection – Multi-layer prevention against signature-based, fileless and zero-day attacks.
Incident Response – Linking Engine removes malware executables and all related changes.
Vulnerability Assessment – Scheduled or on-demand scans for operating system and application flaws.
Application Block – Prevents unauthorised programs from running on Windows servers.
Nebula Cloud Console – One browser console for servers, workstations and policies.
Important – Core has no EDR, ransomware rollback or patch management.

Windows Server 2025 vs. 2022 vs. 2019: Is It Worth Upgrading?
Compares the current Windows Server versions and shows which ones still receive support, useful before you decide which servers to protect.

What are the main benefits of ThreatDown Powered by Malwarebytes Core Server Corporate?

ThreatDown Core Server is the server-licensed variant of the ThreatDown Core bundle, the business line that Malwarebytes rebranded from Malwarebytes for Business in November 2023. Every protected server runs one lightweight agent and is managed centrally from the cloud-based Nebula console, together with any workstation licences in the same account.

Mixed Server Estates – Covers Windows Server and common Linux distributions in parallel.
Fast Rollout – Single agent installs without an on-premises management server.
Fewer Reinfections – Remediation removes associated files and changes to prevent re-infection.
Visible Vulnerabilities – Scan results show which servers need attention first.
Role-Based Policies – Separate policies per server role avoid performance conflicts.
Security Advisor –Scores the current configuration and lists concrete improvement steps.

Best antivirus? Why Windows Defender alone is not enough
Explains where the protection built into Windows reaches its limits and what an additional layer adds in practice.

Which company size is ThreatDown Powered by Malwarebytes Core Server Corporate suitable for?

The decisive question is not how many servers you run, but whether anyone has to reconstruct an incident afterwards. Core detects and blocks, and it records what it did, but it does not store the endpoint telemetry that an investigation or an audit answer usually needs.

Does ThreatDown Powered by Malwarebytes Core Server Corporate meet the requirements of Swiss cybersecurity legislation?

The reporting duty under the revised Information Security Act applies to operators of critical infrastructure, not to every company that runs a server. Since 1 April 2025, affected organisations must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. ThreatDown Core Server supports the first half of that duty: the agent detects and blocks malware on Windows and Linux servers, and the Nebula console keeps a dated record of detections and remediation actions that can be exported for the report. What it does not provide is the investigation depth a 24-hour report normally needs, because Core has no EDR telemetry, no suspicious activity monitoring and no root cause analysis, so reconstructing how an attacker entered and which systems were touched remains manual work. It also does not cover backup, encryption or identity protection, which are separate building blocks in most critical-infrastructure security concepts. This text describes product capabilities and is not legal advice.

Does ThreatDown Powered by Malwarebytes Core Server Corporate meet the requirements of European cybersecurity legislation?

No software product makes an organisation NIS 2 compliant, because the directive addresses governance, processes and evidence rather than tools. NIS 2 requires categories of measures: risk analysis and security policies, incident handling, business continuity including backup, supply chain security, vulnerability handling and disclosure, and basic cyber hygiene such as access control. ThreatDown Core Server contributes directly to two of them, namely malware prevention on servers as part of basic cyber hygiene, and vulnerability handling, because scheduled scans produce a documented list of missing operating system and application updates. It contributes partly to incident handling through detection alerts and console records of the remediation carried out. It does not cover business continuity and backup, supply chain security, access control or multi-factor authentication, and it stops halfway through vulnerability handling, since Core reports missing patches but does not install them.

Does ThreatDown Powered by Malwarebytes Core Server Corporate help with security questionnaires from large customers?

Partly, and it is worth knowing in advance which lines you can tick and which you cannot. It answers the questions about anti-malware on all servers, centrally managed protection with enforced policies rather than local settings, real-time protection on Windows and Linux servers, a defined remediation process, and a recurring vulnerability scan whose results can be exported as evidence. It does not answer the questions about continuous endpoint monitoring or an EDR capability, a documented patch process with installation deadlines, encryption of data at rest, multi-factor authentication, tested backup and restore, or 24x7 monitoring, because none of these functions is part of the Core bundle. If several of those lines block a contract, moving up within the same product family is usually the cheaper route than adding a second vendor: the Advanced bundle adds patch management, EDR and ransomware rollback under one agent, whereas a second security agent on the same server tends to create policy conflicts and performance problems.

What is the difference between ThreatDown Core and ThreatDown Advanced?

The single most decisive difference is what happens after a detection. Core prevents, removes and reports, while Advanced adds endpoint detection and response with seven-day ransomware rollback, so encrypted or modified files can be restored and the attack path can be examined. The second difference is remediation of vulnerabilities: the manufacturer states explicitly that Core provides vulnerability scanning but not patching, so Core tells you which updates are missing and Advanced installs them. Managed detection and response is not part of either bundle and only starts at the Elite level.

Test: Best antivirus programs for Windows
Shows how current protection solutions perform in independent tests and which criteria actually matter when comparing them.

Which limitations should you know before buying?

The agent does not install on Windows Server Core installations, and non-persistent VDI is not supported, while persistent VDI is. Management is cloud-only, because the Nebula console has no on-premises or air-gapped option, so an isolated server network cannot be administered with it. Most Nebula accounts are provisioned in the manufacturer's standard data centre; a European data centre exists but applies only to a limited set of EU accounts provisioned after 3 August 2026, so buyers with a data-location requirement should confirm the placement of their account before rollout. Older Windows Server versions such as 2012 R2 and 2008 R2 are covered by a legacy installer that still receives protection updates but no new features. Core also has no mail-server-specific scanning for Exchange, no encryption management and no mobile coverage, because mobile devices are a separate ThreatDown product.

Data loss is expensive: How backups help you avoid outages
Explains why a tested backup remains the recovery path when a security product prevents an attack but cannot roll it back.

Frequently asked questions about ThreatDown Powered by Malwarebytes Core Server Corporate

Does it run alongside Microsoft Defender on a server?

No, it replaces it. The manufacturer states that ThreatDown disables Windows Defender when it is installed, so you should plan the changeover as a replacement of the active protection layer rather than as an addition to it.

Are Windows and Linux servers protected by the same agent and console?

Yes. The same endpoint agent covers Windows Server 2016 to 2025 and the supported Linux server distributions, including Red Hat Enterprise Linux, Ubuntu LTS, Debian, SUSE Linux Enterprise Server 15, Rocky Linux and Alma Linux, on both x86_64 and ARM64. All of them appear in the same Nebula console with the same policy structure.

What happens on servers with special roles such as Exchange or SQL Server?

The manufacturer documents that certain protection layers should not be enabled for specific server roles, including domain controllers, DNS, Exchange, SQL Server and terminal services, because they can cause performance or network problems. In practice this means you create a separate policy per server role instead of applying the workstation policy to servers.