- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Heimdal
XDR, endpoint prevention, patching, privileged access, email, DNS filtering and remote desktop sold module by module on one agent and one dashboard— what each Heimdal module does, which operating systems it really covers, and how it is counted and quoted. This hub covers twelve Heimdal products.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Twelve intel pages. Unified XDR, endpoint protection, patching, privileged access, email, DNS security and remote desktop.
Heimdal’s line, module by module — every linked card is a full intel page, from XDR, Managed XDR and Next-Gen Antivirus to Patch & Asset Management, PEDM, PASM, Email Security, the two DNS Security products and Remote Desktop. The EDR bundle, ITDR, AI Wingman and the folded line items are listed below the cards.
Heimdal XDR
One console that scores and fixes the estate.
The Threat-hunting & Action Center ranks risk across modules, watches Microsoft 365 sign-ins and fixes in one click; ITDR folds in.
Heimdal Managed XDR
Heimdal analysts watching Heimdal’s own stack.
Monitoring, investigation, threat hunting, forensics and incident response on Heimdal modules; no third-party EDR intake documented.
Heimdal Next-Gen Antivirus & Firewall
Four scanning layers plus a Windows firewall.
Local, behavioural and cloud scanning plus XTP mapped to MITRE ATT&CK, with Remote Access Protection against brute-force logins.
Heimdal Ransomware Encryption Protection
Watches for malicious encryption beside any AV.
Signature-free engines flag encryption as it happens and block tampering with shadow copies; it guards copies, it does not roll back.
Heimdal Patch & Asset Management
Tested, repackaged updates for three OS families.
OS and app patches for Windows, macOS and Ubuntu with CVE-based rollout and inventory; in-house installers go via Infinity Management.
Heimdal Privilege Elevation & Delegation
Admin rights only when a task needs them.
Role-based, time-limited elevation approved from the dashboard or a phone, on Windows and macOS, and paired with Application Control.
Heimdal Privileged Account & Session
A credential vault you host on your own VM.
An Ubuntu appliance for Hyper-V, VMware, Proxmox, Nutanix and more: vaulted passwords, approved access, RDP and SSH session recording.
Heimdal Email Security
Filters mail both ways, with fraud checks on top.
Spam, phishing, sandboxing and SPF/DKIM/DMARC checks; Fraud Prevention adds 125 analysis vectors, only for mail routed through it.
Heimdal DNS Security – Endpoint
Checks each lookup a laptop makes, on any network.
DarkLayer Guard runs a local resolver on Windows and macOS; it blocks by domain, without TLS inspection; private resolvers bypass it.
Heimdal DNS Security – Network
Covers BYOD and IoT behind your own DNS server.
Your DNS servers forward to two Heimdal resolvers that know the site by public IP; Hybrid DNS adds a filtering LogAgent on your server.
Heimdal Application Control
Decides which programs may run, and what they do.
Rules by path, MD5 hash, publisher or certificate, approved by user or AD group; AppFencing then limits child processes and movement.
Heimdal Remote Desktop
Remote control from the same security dashboard.
Attended, unattended and invite sessions with 2FA and three months of recordings, run on ISL Online’s infrastructure for Windows PCs.
Endpoint Detection & Response (bundle)
Platform & engineA package, not a SKU: Heimdal’s EDR page lists eleven modules delivered from one agent and one platform. There is no EDR line on the pricing calculator, so TechBag covers the pieces on their own pages, with the detection layer on the XDR page
Identity Threat Detection and Response (ITDR)
Platform & engineDetects account takeover, privilege abuse, business email compromise, odd sign-ins and mailbox-rule changes. Heimdal places it inside its unified platform with no price line of its own, so it is explained on the Heimdal XDR page
AI Wingman
Platform & engineListed on Heimdal’s product index as the AI layer of the platform. It has no line on the pricing calculator and no published licensing, so TechBag does not give it a page of its own
Infinity Management
Platform & engineA priced line item that deploys custom and in-house software by silent install, taking EXE, MSI, ZIP and MSP packages on Windows and Ubuntu only. It only makes sense next to patching, so it is covered on the Patch & Asset Management page
Threat-hunting & Action Center and Email Fraud Prevention
Platform & engineTwo more calculator line items that depend on a parent: the Action Center is the console that turns the modules into XDR, and Fraud Prevention reads only mail passing through Heimdal Email Security. Each sits on its parent’s page
Platform features
Platform & engineBitLocker management, USB control, operating-system updates, System Restore, network OS deployment over PXE and Remote Access Protection each have a knowledge-base article but no price line; they come with the modules TechBag pages
Heimdal sells across 5 of the products TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Also sold in Endpoint Management (2 products) · Identity & Access (2 products) · Network Security & SASE (2 products).
Why “one agent, many line items” is the whole story
Heimdal does not sell one security product; it sells a dozen modules that switch on in the same agent and the same dashboard — DNS filtering, antivirus, patching, privilege control, email and more, so a small IT team can replace several point tools with one console while paying only for the modules it uses. The catch is that coverage differs module by module: some are Windows-only, and none keep data in India.
Heimdal Dashboard
One dashboard sets policy for every module; each tenant is hosted in Europe, the US or the UK, and email customers can also choose the UAE.
The Heimdal agent
Covers Windows 10/11 and Server 2016–2025, macOS 10.15+ and Ubuntu 16+, though which modules run depends on the OS; Windows 7 gets no fixes.
Extended Threat Protection
XTP maps detections to MITRE ATT&CK and feeds both the antivirus module and the Threat-hunting & Action Center that sits behind XDR.
API and integrations
A REST API plus listed integrations with ConnectWise RMM, Autotask PSA, HaloPSA, Cisco Meraki and Palo Alto Networks.
Start with the job — DNS, endpoint, detection, patching, privilege, email or remote support — then check each module’s operating systems before you buy.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
4.8/5 review rating
a customer review score shown on Heimdal’s awards page, not an analyst placement; no Magic Quadrant includes Heimdal
100% detection certification
listed without a year on Heimdal’s own awards page; TechBag found no AV-Test or AV-Comparatives result to set beside it
SOC 2 Type II and ISAE 3000
shown on the awards page with no report year or scope, so ask for the reports before relying on them
Acquired by Marlin Equity Partners
from CSIS Security Group, which sold Heimdal Security A/S on undisclosed terms
Entered the Indian market
with operations run from Mumbai, announced on 31 August 2023 with Pramod Sharda as CEO India & Middle East at the time
Three 2023 CVEs, all disputed
CVE-2023-29485, 29486 and 29487 concern the old Thor agent and are marked disputed, with Heimdal’s rebuttals on record
The company in six figures
See the platform, hear the pitch
Heimdal - The Ultimate Cybersecurity Game Changer for Your Company
A September 2025 film in which Heimdal partners say what the platform did for them; testimony, not a product demo.
Heimdal - The Security Partner MSPs Can Trust
A 26-second September 2025 pitch aimed at managed service providers, the channel through which much of Heimdal sells.
Heimdal® Customer Spotlight - How Össur Built an Effective End-to-End Cyber Strategy
An October 2022 interview with Össur, the Icelandic prosthetics maker and the one customer Heimdal names on its channel.
Where Heimdal sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Heimdal Across Its Solution Areas
Each dot is a Heimdal solution area: competitive position vs category momentum.
Sold as an endpoint agent and as agentless forwarding, both once called Threat Prevention; it filters by domain, with no proxy or TLS inspection.
Breadth Beyond the Endpoint × Detection Depth
How far each vendor reaches past antivirus — DNS, patching, privilege, email, remote support — vs how deep its detection and response goes.
DNS filtering, patching, privileged access, email and remote desktop beside its antivirus and XDR, all on one agent; every module is quoted.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Heimdal?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What problem is forcing the decision?
2. Where must it run?
3. Who will own it?
Twelve modules, one agent
Heimdal sells each module as its own line item; buy only the ones you need and switch them on in the same agent and dashboard.
Read →DNS on the device or the network?
The endpoint agent follows laptops anywhere; network forwarding covers phones, guests and IoT without an agent. Many sites need both.
Read →Old names you may meet
Older quotes may say Heimdal Thor or Threat Prevention; today those are the agent and DNS Security, and REP is sold as REP X.
Read →XDR yourself or MXDR?
XDR gives your team the Action Center console; MXDR adds Heimdal’s 24x7 analysts on the same modules, acting or only alerting as you set.
Read →Data location and CERT-In
Tenants live in Europe, the US or the UK, with no India region, and DNS log retention is undocumented, so plan an export for CERT-In’s 180 days.
Read →Where Heimdal DNS fits
The Network Security & SASE category’s Secure Web & DNS guide sets DNS-layer filters beside proxies and SSE suites, the market where both Heimdal DNS products compete.
Read →The acronym decoder
Every term on these pages, in one place- DNS filtering
- Blocking a site at the name lookup, before any connection to it is made.
- DoH
- DNS over HTTPS: name lookups sent encrypted inside ordinary web traffic.
- DarkLayer Guard
- The Heimdal engine that runs a filtering DNS server on the endpoint.
- NGAV
- Next-generation antivirus: behaviour and cloud analysis beyond signatures.
- XTP
- Extended Threat Protection, Heimdal’s engine mapped to MITRE ATT&CK.
- REP X
- The current marketing name of Ransomware Encryption Protection.
- XDR
- Extended detection and response: one view of signals from several layers.
- MXDR
- Managed XDR: a vendor’s SOC runs detection and response for you.
- TAC
- Threat-hunting & Action Center, the Heimdal console behind XDR.
- PEDM
- Privilege elevation and delegation: temporary admin rights on request.
- PASM
- Privileged account and session management: a vault plus recorded sessions.
- AppFencing
- Heimdal’s limits on what an allowed application may launch or reach.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Pick modules, not a bundle
Each Heimdal module is its own line item. List the jobs you need done, then price only those modules instead of the EDR package as a whole.
Count devices and admin users
Most modules are counted per device per year; PASM and Remote Desktop are counted per admin user, with minimums of 1 admin plus 10 users and 10 admins.
Check each module’s OS coverage
The firewall, Application Control, Remote Desktop and the Action Center agent are Windows-only, and most modules have no Linux agent at all.
Settle the data region and logs
Choose a European, US or UK tenant, as no Indian region exists, and plan a log export so CERT-In’s 180-day requirement is met.
Run the four-week trial
Heimdal offers trials, and its UK G-Cloud listing describes a standard four-week proof of concept; test DNS filtering against your VPN first.
Get it priced in rupees
Heimdal publishes no prices. TechBag scopes the modules, devices and admin users, and quotes the total in INR with GST.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| DNS Security – Endpoint | Per device per year · own line item | Quote | Roaming DNS filtering |
| DNS Security – Network | Per device per year · forwarding or Hybrid DNS | Quote | Agentless site filtering |
| Next-Gen Antivirus & Firewall | Per device per year | Quote | Endpoint prevention |
| Ransomware Encryption Protection | Per device per year · runs beside other antivirus | Quote | Ransomware add-on |
| XDR | Per device per year · Threat-hunting & Action Center is a separate line | Quote | In-house detection |
| Managed XDR | Per device per year · service on Heimdal modules | Quote | Outsourced SOC |
| Patch & Asset Management | Per device per year · Infinity Management priced separately | Quote | Third-party patching |
| PEDM | Per device per year | Quote | Removing local admin |
| PASM | Per admin user per year · minimum 1 admin, 10 users | Quote | Vaulted server access |
| Application Control | Per device per year | Quote | Allowlisting |
| Email Security | Per device per year on the calculator · Fraud Prevention a separate line | Quote | Gateway or M365 filter |
| Remote Desktop | Per admin user per year · minimum 10 admin accounts | Quote | Helpdesk remote control |
Heimdal publishes no prices: every module is quoted, most per device per year, with PASM and Remote Desktop counted per admin user. Free trials are offered. TechBag scopes the modules, devices and admin users and quotes the total in INR with GST.
Five pitfalls that cost buyers quarters
Reading the CASB view as a CASB
The dashboard view labelled CASB lists apps seen in DNS lookups, which you can block by domain. There is no inline proxy and no SaaS API.
Planning PASM as a cloud service
The product page says cloud-native, but the knowledge base ships a VM appliance you host beside your servers. Budget the hypervisor and backups.
Adding Fraud Prevention to Microsoft 365
Heimdal’s knowledge base says Email Fraud Prevention inspects mail passing through Heimdal Email Security. Without that filter it has nothing to read.
Assuming an Indian data region
The Mumbai office handles sales and support. Tenant data is kept in Europe, the US or the UK, and the DNS resolvers name no Indian city.
Quoting the G-Cloud unit price
The £2.51 a unit on the UK G-Cloud listing is a reseller’s public-sector schedule with no period stated. It is not a Heimdal list price.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Four trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**TechBag’s illustrative estimate, not a quoted analyst figure. The takeaway: buyers are moving spend towards managed detection and privileged access — the two areas where Heimdal added Managed XDR and its PASM appliance.
One agent for many modules
Heimdal’s EDR page lists eleven modules delivered from one agent and one platform, each still licensed on its own.
What it means for you
Ask which modules share an agent before you add another tool.
Security sold through MSPs
Heimdal says 2,000 MSPs work with it, and it announced a DACH partnership with Elovade on 1 October 2026.
What it means for you
Check the partner’s skills as closely as the product’s.
Managed detection with a veto
MXDR ADAPT lets a customer set each module to let analysts act or only notify, and resellers can be notified too.
What it means for you
Decide up front what an outside SOC may change.
Identity attacks inside the XDR
Heimdal’s ITDR watches for account takeover, mailbox-rule changes and suspicious sign-ins without a separate SIEM.
What it means for you
Treat Microsoft 365 sign-ins as part of endpoint security.
Questions buyers ask about Heimdal
Ready to shortlist Heimdal?
Open any of the twelve intel pages for the deep dive, or let a TechBag advisor build the case with you — which modules fit the job, which ones run on your operating systems, where your data will be stored, quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.