What is included in Trend Micro Cloud One Endpoint Security Corporate?

Anti-malware – Detects and removes malware, spyware and trojans using cloud threat intelligence.
Web Reputation – Blocks access to malicious domains and known command-and-control servers.
Firewall and desktop IPS – Filters traffic and shields known desktop vulnerabilities with intrusion prevention rules.
Device Control – Regulates access to USB drives and other external storage devices.
Application Control – Logs software changes and lets you block or allow new programs.
Important – No EDR, patch management, encryption or mobile protection in this licence.

What are the main benefits of Trend Micro Cloud One Endpoint Security Corporate?

Trend Micro Cloud One Endpoint Security Corporate is the endpoint tier of Trend Cloud One – Endpoint & Workload Security, a SaaS service in which Trend Micro hosts and maintains the management console. Since March 2026, Trend Micro's enterprise business has operated under the TrendAI brand, so the console and documentation now show the name TrendAI Cloud One.

No server to maintain – Trend Micro operates the console, security database and platform updates.
One console, two tiers – Endpoints and servers share one console; Workload modules can be licensed later.
Scripted agent rollout – Deployment scripts install the agent, activate it and assign a policy.
Automatic IPS rule updates – Core endpoint rules are assigned automatically whenever rule updates arrive.
Role-based access – Console permissions can be limited per administrator through role-based access.
Firewall event logs – Firewall events are recorded centrally and can support audit evidence.

Best antivirus? Why Windows Defender alone is not enough
This article explains which protection gaps remain when a device relies only on the security built into Windows.

Which company size is Trend Micro Cloud One Endpoint Security Corporate suitable for?

The product suits organisations that want centrally managed prevention on Windows, macOS and Linux devices without running their own management server. Small businesses without IT staff benefit from the hosted console. Medium-sized companies get policy-based control over USB media and software changes. Large companies that expect detection and response, server integrity monitoring or log inspection need the XDR add-on or the Workload Security tier in addition.

Does Trend Micro Cloud One Endpoint Security Corporate meet the requirements of Swiss cybersecurity legislation?

Under the revised Information Security Act, operators of critical infrastructure in Switzerland must report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Examples include energy and water suppliers, hospitals, transport companies and public authorities. Most private SMEs outside these sectors are not directly affected, but contracts with such operators can pass comparable duties on to them. Trend Micro Cloud One Endpoint Security Corporate supports the detection side: anti-malware, firewall and intrusion prevention events are collected centrally, which helps establish when and on which device an incident started. It does not include the Activity Monitoring telemetry needed for a detailed attack timeline, it does not submit reports to BACS, and it offers no Swiss hosting region. This information does not constitute legal advice; whether your organisation is subject to the reporting obligation should be assessed by a qualified legal specialist.

Does Trend Micro Cloud One Endpoint Security Corporate meet the requirements of European cybersecurity legislation?

No software product makes an organisation compliant with the NIS 2 Directive, because the directive requires organisational risk management and not just tools. The directive names measure categories such as incident handling, business continuity, supply chain security, vulnerability handling, access control, cryptography and the assessment of measure effectiveness. Trend Micro Cloud One Endpoint Security Corporate supports incident prevention and vulnerability handling through anti-malware, desktop intrusion prevention rules and device control. It also supports access control for its own console through role-based permissions. It provides no backup for business continuity, no encryption, no patch management and, without the XDR add-on, no endpoint detection and response data for incident handling. Choosing the Germany region keeps account and security data within the European Union.

Does Trend Micro Cloud One Endpoint Security Corporate help with security questionnaires from large customers?

Partly. The product answers questionnaire items on malware protection for managed endpoints, central policy management, USB and removable media control, application control, host firewall and role-based administrator access. It does not answer items on endpoint detection and response, disk encryption, patch management, backup, mobile device protection, or file integrity monitoring and log inspection on servers. Integrity monitoring and log inspection are available in the same console, but only with the Workload Security licence. For detection and response, the XDR add-on on the same Trend platform is usually the shorter route than adding an agent from a second vendor. Encryption, backup and patching still require separate products.

What is the difference between Cloud One Endpoint Security and Cloud One Workload Security?

The decisive difference is server depth. Workload Security adds integrity monitoring, log inspection, intrusion prevention for server applications and container protection, none of which Endpoint Security includes. Both tiers are managed in the same Cloud One console with the same agent, so mixed environments do not need two management tools. Modules marked WORKLOAD REQUIRED in the console are charged at the higher Workload Security rate if they are enabled under an Endpoint Security licence. Activity Monitoring, which feeds detection and response data to XDR, requires a separate XDR add-on.

We help you decide. Test: Antivirus program: Best antivirus programs for Windows 2025
This article compares current antivirus programs for Windows and the criteria that matter when choosing one.

Which limitations should you know before buying?

Trend Micro's enterprise business has operated as TrendAI since March 2026. Cloud One Endpoint & Workload Security instances can be upgraded to TrendAI Vision One Endpoint Security, but this is a one-way step with no return to the Cloud One console. No feature restriction to the United States or the United Kingdom was found. However, there is no Swiss hosting region: the nearest option is Germany, and an account's region cannot be changed after it is created. Module coverage also differs by platform. On macOS, Web Reputation relies on a browser extension that cannot be deployed automatically for Safari, and Device Control applies to USB mass storage. The most common follow-up purchases are the XDR add-on for detection and response and separate tools for patch management, encryption and backup.

Frequently asked questions about Trend Micro Cloud One Endpoint Security Corporate

Can a Germany-region account protect devices in Switzerland and other countries?

Yes. A Cloud One region only determines where account and security data are stored and processed. The account can manage devices located anywhere.

Can Workload Security modules be tested with an Endpoint Security licence?

Endpoint Security customers can use trial versions of the Workload modules. Long-term use requires the Workload Security licence, and enabling those modules otherwise triggers the higher Workload Security charges.

Is security data replicated to another region for disaster recovery?

No. Data stored in a Cloud One region is not moved to another region for backup or disaster recovery. Policies and configuration also cannot be migrated automatically between regions.