WithSecure

What Is WithSecure?

European enterprises have more cybersecurity options than ever — but most of the headline players are American, with US data residency as a default. WithSecure is the exception: a Finnish company with over 35 years of cybersecurity heritage (originally founded as Data Fellows in 1988, rebranded F-Secure, then spun out as WithSecure in 2022) and a platform built from the ground up to serve regulated European businesses through an MSP-first channel.

The core product is Elements Cloud — a modular cybersecurity platform covering Endpoint Protection (EPP), Endpoint Detection and Response (EDR), Extended Detection Response (XDR), Exposure Management, and Cloud Security for Microsoft 365 and Salesforce. Every module feeds into a single management console, the Elements Security Center, which is used by 6,000+ MSP and MSSP partners worldwide.

In November 2025, WithSecure was taken private by a consortium led by CVC Capital Partners — a Luxembourg-headquartered European private equity firm — alongside founder Risto Siilasmaa. The deal was structured as a European transaction, retaining Finnish HQ, EU data hosting, and the existing compliance posture. For customers, the ownership change means deeper investment without a US parent's data-access obligations.

Key Features

How Does WithSecure's EPP Compare to Traditional Antivirus?

Endpoint Protection in the Elements stack goes well beyond signature-based malware scanning. WithSecure EPP combines real-time file and behaviour analysis, DeepGuard behavioural analytics, network traffic monitoring, and automated patch management for Windows operating systems and third-party applications. Windows, macOS, Android, iOS, and Linux servers are all supported under a single licence.

Where traditional antivirus reacts to known threats, EPP's DeepGuard layer watches for anomalous process behaviour — lateral movement, privilege escalation, suspicious script execution — that characterises modern ransomware and fileless attacks. The result is a first layer that blocks a significantly wider range of attacks than signature lists alone.

What Does Elements EDR Add on Top of EPP?

EDR is where WithSecure's heritage in threat intelligence shows. The module adds continuous behavioural monitoring, endpoint telemetry collection, and a dedicated threat investigation interface. Security analysts can query device timelines, explore process trees, and trace lateral movement across the estate.

Elements Connector forwards security events to third-party SIEMs — Microsoft Sentinel, Splunk, Elasticsearch — using standard Syslog formats, so EDR data integrates cleanly into existing security operations workflows. Cortex XSOAR and Shuffle are also supported for automated response playbooks.

MITRE ATT&CK alignment is embedded throughout: detections are mapped to the framework, meaning analysts can correlate WithSecure alerts with the broader threat intelligence picture their team already uses.

What Is Elements XDR and Who Needs It?

XDR extends detection from the endpoint outward — correlating signals from cloud collaboration tools (Microsoft 365, Salesforce), network traffic, and identity events alongside endpoint telemetry. This cross-layer correlation catches attacks that stay beneath any single tool's detection threshold, such as credential-based lateral movement or slow-burn data exfiltration.

The XDR tier suits organisations with a dedicated security operations function or those working with an MSSP. For businesses without in-house SOC capacity, WithSecure's Co-Security service provides analyst-backed MDR, blending the platform with human expertise.

How Does W/Luminen AI Change Incident Investigation?

WithSecure's W/Luminen layer applies generative AI to the investigation workflow. Analysts can query incidents in plain language, get natural language summaries of what happened and why, and receive multilingual reports for stakeholder briefings. For MSPs managing multi-tenant environments across different countries, the multilingual output is genuinely useful rather than a marketing feature.

The AI capability runs inside the Elements platform — it does not route data to third-party AI APIs, keeping the EU data boundary intact.

What Does Exposure Management Cover?

Exposure Management is a continuous attack surface assessment module: it identifies unpatched vulnerabilities, misconfigured cloud resources, and software with known CVEs across the estate. Prioritisation is risk-weighted so security teams address the vulnerabilities attackers are actively exploiting before moving to theoretical risks. Automated patch management handles Windows OS and common third-party applications, reducing manual remediation overhead.

Pricing

WithSecure operates a partner-first pricing model — specific per-device rates are negotiated through certified MSPs and resellers rather than published on the website. This is standard practice for B2B endpoint security at this market tier, but it does create friction for buyers trying to run competitive analysis without engaging sales.

What is known: billing is per device (workstation, server, or mobile), available on monthly subscriptions, annual contracts, or a usage-based model that removes renewal commitments. A 30-day free trial covers EPP and EDR modules with no credit card required.

For comparable platforms at this capability level, market pricing for EPP+EDR in the European mid-market typically runs €4–€8 per device per month, with XDR and MDR adding further cost. WithSecure sits within that range, with volume discounts available through the partner channel.

Enterprise buyers should budget for the XDR platform licence plus Co-Security MDR if analyst coverage is required. The modular structure means you can start with EPP and expand as security maturity grows — avoiding the upfront cost of capabilities you're not yet ready to operationalise.

EU Compliance & Privacy

WithSecure's compliance posture is among the strongest in the endpoint security market. The company holds ISO 27001, SOC 2 Type II, and ISAE 3000 certifications, and stores customer data in EU data centres. Finnish operations mean the company falls under EU jurisdiction by default — subject to GDPR, NIS2, and the Finnish Data Protection Act.

The 2025 privatisation by CVC Capital Partners (Luxembourg) does not introduce a US parent company. This distinction matters for organisations subject to data access obligations under foreign law: there is no American parent that could be compelled to hand over European customer data under CLOUD Act requests.

WithSecure also aligns with CIS Controls and publishes NIS2-relevant documentation, which helps procurement teams at critical infrastructure organisations meet their supplier security requirements without commissioning bespoke assessments.

Who It's Best For

Mid-market European enterprises wanting a single-vendor endpoint security stack with genuine EU data residency — particularly those in regulated sectors such as finance, healthcare, and public sector where compliance certification is a procurement requirement.

MSPs and MSSPs managing multi-tenant security at scale. The Elements multi-tenant console and per-device billing model is designed around the partner channel, not retrofitted for it.

Organisations scaling security maturity. The modular structure lets buyers start with EPP, add EDR when they have the operational capacity to act on alerts, and graduate to XDR or Co-Security MDR without switching platforms.

If your organisation needs a plug-and-play consumer antivirus or a US-based platform with the largest threat intelligence network in the industry, WithSecure is not the right fit. CrowdStrike and SentinelOne lead on raw global telemetry volume. WithSecure's advantage is EU sovereignty, MSP scalability, and a compliance depth that US-headquartered rivals cannot match structurally.

The Verdict

WithSecure is the obvious first call for European MSPs and regulated enterprises that need endpoint security without US data residency risk. The Elements Cloud platform is mature, modular, and backed by decades of threat intelligence. Opaque partner-channel pricing and a narrower third-party SOAR ecosystem are real trade-offs. For buyers where EU compliance is a hard requirement rather than a preference, those trade-offs are easy to accept.

Frequently Asked Questions

Is WithSecure data stored in the EU?

Yes. WithSecure stores customer data in EU data centres and holds ISO 27001, SOC 2 Type II, and ISAE 3000 certifications. The company is headquartered in Helsinki and operates under EU GDPR and Finnish data protection law, with no US parent company.

How does WithSecure compare to CrowdStrike?

CrowdStrike Falcon leads on global threat intelligence volume, third-party integrations, and brand recognition. WithSecure leads on EU data sovereignty, MSP-native pricing, and compliance certifications relevant to European regulated sectors. For organisations where GDPR and NIS2 compliance drive procurement, WithSecure's structural advantages are material — CrowdStrike's EU data centre option does not eliminate US parent company obligations.

Is there a free trial available?

Yes. WithSecure offers a 30-day free trial of the Elements platform covering EPP and EDR modules. No credit card is required. Partners can arrange assisted onboarding during the trial period.

Who owns WithSecure now?

WithSecure was taken private in November 2025 by a consortium led by CVC Capital Partners (Luxembourg-headquartered European private equity) and founder Risto Siilasmaa. There is no US parent company. The company remains operationally independent, headquartered in Helsinki.

What is the difference between WithSecure Elements EDR and Co-Security MDR?

Elements EDR is a product — it provides the tooling for your team to detect, investigate, and respond to threats. Co-Security is a managed service — WithSecure analysts use the Elements platform on your behalf, providing 24/7 human-backed coverage. Many customers run EDR in-house and engage Co-Security for overnight and weekend coverage, or for specific incident response engagements.