Malwarebytes Review

Malwarebytes is the name a help desk still types when a laptop is already infected, and that reputation is a removal tool, not the product a security lead should buy. The buy in 2026 is ThreatDown, four published bundles on a device cart that starts at five seats and stops at twenty.

The expensive mistake is treating Teams, on the consumer price page, as the company product. That pack has no ThreatDown console, and detection is not on the cheapest business seat, so a brand-only approval signs the wrong SKU.

This review prices every ThreatDown tier, then sets Core against CrowdStrike, ESET, Microsoft Defender for Business, and SentinelOne. The wider field is our business antivirus comparison.

A household comparison lives on Toolradar's Malwarebytes vs Norton note. That note answers a home-user question, not a fleet bill.

Toolradar data: the September 2026 antivirus guide names 8 products, and Malwarebytes is one of them.

Cyberpresso data: this newsletter had 26,600 active subscribers on September 20, 2026, with a 28% average open rate.

How we compared: ThreatDown, Malwarebytes, CrowdStrike, ESET, Microsoft, and SentinelOne pricing pages read on September 24, 2026. Prices below were verified on each vendor's US pricing page in September 2026. No vendor paid for a place in this review.

Founded in 2008 and based in Santa Clara, California, Malwarebytes still sells Standard, Plus, and Teams, plus a free antivirus download for removing an infection. That download is a cleanup tool, not a seat you can assign to staff.

ThreatDown is the business platform, sold as Core, Advanced, Elite, and Ultimate. Core is the prevention seat, enough only when the job is blocking malware and showing an agent is installed.

Advanced is the first bundle that can reconstruct an incident. Endpoint detection, 7-day ransomware rollback, patch management, a host firewall, Windows drive encryption, and managed threat hunting are not on Core, so a prevention order cannot show what changed.

Elite adds a 24/7 analyst service and ThreatDown AI, which drafts actions an admin approves before anything runs. The night shift belongs to Malwarebytes unless you already staff one, in which case you would be paying for coverage you have.

Ultimate adds MDR Plus (malware removal, root-cause analysis, threat intelligence, dark web monitoring, and a published SLA), plus identity threat detection and premium support. It is the only published bundle that includes identity detection, so that requirement changes the order you place.

The name Ultimate covers two products, and mixing them up approves the wrong spend. ThreatDown Ultimate MDR Plus is the managed endpoint bundle, while the consumer Ultimate plan is an identity bundle at $279.99 for three devices for a year. That consumer figure does not buy the business console.

DNS filtering, email security, server protection, and mobile security (Chromebook, Android, iOS, iPadOS) are add-ons on every tier, including Ultimate, and none prints a price on the card. A quote that assumes they sit inside the device rate will come in short.

Email, as its own control, belongs in an email security shortlist rather than an unchecked box. Treating that unchecked box as an email control leaves the company without one.

ThreatDown is a cloud cart and a single agent. You pick a bundle, a device count, and a one-year, two-year, or three-year term, then assign that bundle to the fleet.

The pricing page opens at five devices and will not accept a count under five or over twenty, so one laptop cannot buy the per-device rate on the card. Day to day, Core blocks malicious apps, controls USB devices, and flags vulnerable software, but it does not build an attack timeline.

That view arrives with Advanced, along with rollback of files encrypted or changed in the last 7 days. Elite is where Malwarebytes' own analysts watch the tenant overnight, which is the offer to compare with a dedicated MDR service if you want a vendor-neutral night shift.

The rough edge is the tier gate, not the installer. A quote that says "Malwarebytes" can be Core, and Core will not investigate, so the brand on the purchase order is not the control.

Identity threat detection is an add-on on Advanced and Elite and is included only on Ultimate. Servers are a separate license on every tier, so a file server is not covered by the workstation count you typed into the cart.

Above twenty devices the public cart stops and the page points you to a reseller or MSP. There is no zero-dollar business seat, and the free consumer download is a separate product, useful for one infected laptop and the wrong thing to standardize on.

ThreatDown prints a per-device USD rate, then multiplies it by the device count, so budget the cart total rather than the rate alone. Five Core devices are $345 for one year, the smallest order the page will sell. Five Advanced devices, the first seat with detection, are $395.

Five Elite devices are $495, and five Ultimate devices are $745. The twenty-device rows are the ceiling of self-serve, and a partner prices anything larger, so the page rate is not a commitment past that cap.

A two-year Core device is $124.20, which is 10% under two years at the one-year rate. A three-year Core device is $165.60, the 20% cut the card advertises. On that three-year term, five Core devices annualize to $276 a year, the figure to use in a multi-year budget.

The one-year Advanced, Elite, and Ultimate rates are $79, $99, and $149 per device. Servers, DNS filtering, email security, and mobile protection are extra, and the card does not print those rates, so any add-on breaks a total built from devices alone.

The consumer page is a different catalog, verified the same day. Standard is $44.99 a year for one device and will not administer a fleet. Plus, which adds the VPN, is $79.99 a year for three devices.

Teams lists at $119.99 for three devices, $399.99 for ten, and $799.99 for twenty, with a 35% discount on that twenty-device card through November 2031. Consumer plans include a 60-day money-back guarantee, and that guarantee is not a ThreatDown term, so a business pilot cannot lean on it.

Set the five-device Core year next to the alternatives, not next to Teams. ESET PROTECT Entry is $211 for five devices for the first term, and $718 for twenty devices, on the US business page, so the opening bill undercuts Core and the renewal is not the number on the card.

CrowdStrike Falcon Go is a per-device annual rate with a 100-device cap. Falcon Pro is $99.99 per device per year and Falcon Enterprise is $184.99, both on the US pricing page, so Go is the bottom of that list rather than the platform price.

Defender for Business is $3 per user per month, paid yearly, so five users are $180 a year before tax, and each user can cover five devices. Microsoft 365 Business Premium is listed at $22 per user per month on that same page, a broader suite rather than the standalone endpoint row.

SentinelOne lists Singularity Complete at $179.99 per endpoint per year and Commercial at $229.99, in US dollars, for 5 to 100 workstations. Core is $69.99 per endpoint per year on that same page.

An authorized partner sets the invoice, so the page is not the purchase order. For a longer look at detection pricing, use how much EDR costs and the Falcon pricing breakdown.

ThreatDown fits a security lead who wants a device price on a page and a fleet between 5 and 20 endpoints. Choose Core to block malware and prove an agent is installed, and Advanced when someone must reconstruct an incident.

Choose Elite when nobody is staffed overnight, and Ultimate when identity detection has to share the order. MSPs and larger fleets should not stop at the cart, because past 20 devices the page sends you to a partner and servers are a separate license.

A vulnerability program that must scan beyond the agent should stay on a vulnerability scanner shortlist. Browser phishing protection does not replace the habits in how to prevent phishing attacks.

Skip ThreatDown when the unit of purchase is wrong, which covers a company already on Microsoft 365 and under 300 users. Price Defender for Business first, because that license is per person and covers up to five devices each.

For detection inside 100 devices on a published rate, read the CrowdStrike review and the EDR comparison.

For GravityZone's calculator, which counts servers inside a share of the devices, read the Bitdefender review rather than assuming the carts match.

Skip Teams unless you need a handful of personal devices in one pack. It will not give you a console, a timeline, or a managed night shift.