What is included in Trend Micro Deep Security Network Security?

Intrusion prevention (IPS) – Inspects inbound and outbound server traffic and blocks exploit attempts.
Virtual patching – Shields known operating system and application vulnerabilities until patching is possible.
Host-based firewall – Filters incoming and outgoing server traffic and logs events for audits.
Web application protection – IPS rules block SQL injection and cross-site scripting attempts.
Deep Security Manager – Central web console for policies, rule updates and event review.
Important – No anti-malware, integrity monitoring or log inspection in this package.

Best antivirus? Why Windows Defender alone is not enough
Looks at where built-in Windows Defender protection falls short and when dedicated malware protection is worth adding.

What are the main benefits of Trend Micro Deep Security Network Security?

Trend Micro Deep Security Network Security is the firewall and intrusion prevention package of Deep Security, which has been sold under the TrendAI brand since Trend Micro renamed its enterprise business in March 2026. Protection runs through the Deep Security Agent on each server and is managed centrally from the Deep Security Manager, which you host and operate yourself.

Time-to-patch buffer – Vulnerable servers stay shielded while maintenance windows are still pending.
Fast rule delivery – New vulnerability rules can arrive automatically within hours of disclosure.
Recommendation scans – Suggests IPS rules matching the operating system and applications found.
Safe rule testing – Detect mode logs matching traffic without blocking production connections.
Encrypted traffic inspection – IPS can inspect SSL/TLS traffic on supported Windows and Linux servers.
SIEM-ready events – Firewall and IPS events can be forwarded to syslog or SIEM.

Which company size is Trend Micro Deep Security Network Security suitable for?

Deep Security Network Security pays off where servers cannot always be patched immediately and where someone is available to operate the Deep Security Manager. A small business with a few servers and no IT staff rarely needs granular IPS tuning and usually lacks the capacity to run a self-hosted console. Medium-sized and large companies with change-controlled maintenance windows, legacy applications or customer-facing web servers benefit most from virtual patching.

Does Trend Micro Deep Security Network Security meet the requirements of Swiss cybersecurity legislation?

Since 1 April 2025, the revised Information Security Act has required operators of critical infrastructure in Switzerland, such as energy and water suppliers, hospitals, financial institutions and public authorities, to report certain cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Most other companies are not directly subject to this obligation, but they can be affected as suppliers to such operators. Deep Security Network Security supports the reporting process by recording firewall and intrusion prevention events centrally in the Deep Security Manager, which helps reconstruct when and on which server an attack attempt occurred. It does not detect malware on the server, does not provide endpoint detection and response, and does not submit reports to BACS, so the report itself remains an organisational task. This information is not legal advice; have your specific obligations assessed by a qualified specialist.

Does Trend Micro Deep Security Network Security meet the requirements of European cybersecurity legislation?

No software product makes an organisation compliant with the NIS 2 Directive, because the directive requires risk management measures that combine technology, processes and governance. Among other things, Article 21 of the directive names incident handling, business continuity, supply chain security, vulnerability handling during the maintenance of systems, access control, cryptography and staff training. Deep Security Network Security contributes to vulnerability handling through virtual patching, to network-level server protection through the host firewall, and to incident handling through centrally stored IPS and firewall events. It does not cover backup and business continuity, multi-factor authentication, encryption, malware protection or staff awareness training. The directive's reporting deadlines, starting with an early warning within 24 hours, must still be met through your own incident process.

Does Trend Micro Deep Security Network Security help with security questionnaires from large customers?

Yes, for the network protection part of a typical supplier questionnaire. With this package you can answer questions about host firewalls on servers, intrusion detection and prevention, how quickly known vulnerabilities are mitigated, and whether security events are logged centrally. It does not answer questions about malware protection on servers, endpoint detection and response, file integrity monitoring, log review, patch deployment, backup, encryption or multi-factor authentication. If a customer requires malware protection, integrity monitoring and log inspection on servers, moving to Deep Security Enterprise closes those gaps in the same manager and agent, which is usually simpler than adding a second vendor's server agent. Backup, encryption and multi-factor authentication require separate products, whichever Deep Security package you choose.

What is the difference between Deep Security Network Security and Deep Security Enterprise?

The decisive difference is malware protection: Network Security contains only the firewall and intrusion prevention modules, while Deep Security Enterprise adds anti-malware and the system security modules. Both editions use the same Deep Security Agent and the same Deep Security Manager, so additional modules can be activated without replacing the deployment. Network Security suits servers that already have separate malware protection, or cases where virtual patching is the specific requirement. Enterprise suits servers that need the full Deep Security protection set from one console.

Which limitations should you know before buying?

Deep Security Network Security does not include anti-malware, so every server still needs malware protection from another Deep Security package or a separate product. The Deep Security Manager is self-hosted, which means you operate, update and back up the console and its database yourself. Legacy systems such as Windows Server 2008 and Windows 7 receive IPS rule updates only through the older 20.0.0 agent, and Trend Micro has set 31 December 2026 as the end of that extended support. Agentless protection through the Deep Security Virtual Appliance for VMware NSX reaches end of life on 31 December 2027 at the latest, and Trend Micro recommends agent-based protection for new deployments. No country-specific restrictions on the firewall and intrusion prevention features were found.

End of Support for Windows Server 2022: Windows Server 2025 vs. 2022 vs. 2019: Is It Worth Upgrading?
Compares the three Windows Server versions and helps you decide whether upgrading your existing servers is worthwhile.

Frequently asked questions about Trend Micro Deep Security Network Security

Is Trend Micro Deep Security Network Security a cloud service?

No, Deep Security Software uses a Deep Security Manager that you install and operate on your own infrastructure or in your own cloud account. The vendor's cloud-hosted workload protection formerly offered in Trend Cloud One has moved to the TrendAI Vision One platform after Cloud One reached end of life.

Does Deep Security Network Security replace a perimeter firewall?

No, the firewall and IPS run on each protected server and inspect only the traffic that reaches that server. A perimeter or network firewall is still needed to control traffic between network zones and the internet.