As previously announced, support for all Business Suite products older than version 16 has ended at the end of 2024.

Part of this end of life process for the older versions is for WithSecure to remove old backend services for delivering updates. This is due to our demerger from F-Secure.

This means that all engine and definition updates for these older non-supported versions have ended. For continued protection, you should ensure that ALL your devices are using WithSecure branded Business Suite products. These upgrades are free for customers with valid subscriptions, there is no need to purchase anything new.

For more details, please refer to the official announcement.

Important Actions needed

If you are experiencing issues with Business Suite updates and are using Business Suite products older than version 16, the following actions MUST be taken.

• Upgrade to Policy Manager 16 immediately
  • Windows: See
    
    https://www.withsecure.com/userguides/product.html?business/policy-manager/16.10/en/upgrading_pm_on_win_server-16.10-en
    
    
  • Linux: See
    
    https://www.withsecure.com/userguides/product.html?business/policy-manager/16.00/en/task_47E46A07F34F4B39B06BD428A858AD2A-16.00-en
    
    
• After Policy Manager has been upgraded to version 16, ALL endpoint clients MUST be upgraded to the supported version 16.

For customers who are using “golden images” or other tooling to deploy the Business Suite software, these methods MUST be updated to use the latest installers.

Pre-requisites for using WithSecure Business Suite software

Supported Operating Systems

The computer MUST be using a supported version of the operating system

Please note: WithSecure ONLY supports versions that are still supported by the Operating System vendor. Check with the OS vendor to see if the version you are using is still supported.

Policy Manager (Windows)

• Windows Server 2012 R2; Essentials, Standard or Datacenter editions
• Windows Server 2016; Essentials, Standard or Datacenter editions
• Windows Server 2019; Essentials, Standard or Datacenter editions (Server Core is not supported)
• Microsoft Windows Server 2022; Essentials, Standard, or Datacenter editions
• Microsoft Windows Server 2025

Policy Manager (Linux)

• Alma Linux 8: Please note that version 9 is not yet supported
• CentOS 7, 8
• Debian GNU Linux 10, 11, 12
• openSUSE Leap 15
• Oracle Linux 8: Please note that version 9 is not yet supported
• Red Hat Enterprise Linux 7, 8: Please note that version 9 is not yet supported
• SUSE Linux Enterprise Server 12, 15
• SUSE Linux Enterprise Desktop 12, 15
• Ubuntu 20.04, 22.04, 24.04 LTS
• Rocky Linux 8: Please note that version 9 is not yet supported

Client Security (Windows)

• Microsoft Windows 10 (all 32-bit and 64-bit editions, including Windows 10 IoT Enterprise)
  • Please note there is limited support for Windows 10 LTSB. The WithSecure local user interface is not available on this version, other functionality works normally.
• Microsoft Windows 11 (all editions)

Client Security (Mac)

• macOS 15 “Sequoia”
• macOS 14 “Sonoma”
• macOS 13 “Ventura”

Server Security (Windows)

• Microsoft® Windows Server 2016 Standard
• Microsoft® Windows Server 2016 Essentials
• Microsoft® Windows Server 2016 Datacenter
• Microsoft® Windows Server 2016 Core
• Microsoft® Windows Server 2019 Standard
• Microsoft® Windows Server 2019 Datacenter
• Microsoft® Windows Server 2019 Core
• Microsoft® Windows Server 2022 Standard
• Microsoft® Windows Server 2022 Datacenter
• Microsoft® Windows Server 2022 Core
• Microsoft® Windows Server 2025 Standard
• Microsoft® Windows Server 2025 Datacenter
• Microsoft® Windows Server 2025 Core

Linux Security

• AlmaLinux 8, 9
• Amazon Linux 2
• Debian 10, 11, 12
• Oracle Linux 8, 9
• RHEL 8, 9
• Rocky Linux 8, 9
• SUSE Linux Enterprise Server 12 (Service Pack 5)
• SUSE Linux Enterprise Server 15 (Service Pack 2 or newer)
• Ubuntu 18.04, 20.04, 22.04, 24.04

Microsoft ACS compatibility

Since February 2023, WithSecure products for Windows REQUIRE that the operating system has been patched to support ACS signed files. Please read this article for more information.

We have released a new version of Client Security for Mac.

This version fixes an issue which caused product initialisation sometimes to fail.

Please refer to the Changelog for further information on features and supported platforms.

The installation package can be downloaded from the link below and selecting the “macOS” tab.

We have now released the following new service releases for Business Suite 16

• WithSecure Policy Manager 16.03
• WithSecure Policy Manager for Linux 16.03
• WithSecure Policy Manager Proxy 16.03
• WithSecure Policy Manager Proxy for Linux 16.03
• WithSecure Client Security 16.01
• WithSecure Client Security Premium 16.01
• WithSecure Client Security for Mac 16.01
• WithSecure Server Security 16.01
• WithSecure Server Security Premium 16.01

These releases bring security enhancements, vulnerability fixes, new minor features and improvements across Policy Manager, Client Security for Windows and Mac, and Server Security products. Please refer to the corresponding Changelog for further information:

Business Suite Policy Manager Changelog

Business Suite Client Security and Server Security Changelog

Business Suite Client Security for Mac Changelog

All products are available for downloads via the WithSecure Download Center

For security reasons, we recommend that you always upgrade to the latest product versions.

WithSecure Policy Manager 16.03 and WithSecure Policy Manager Proxy 16.03

Changes in this release

Bug fixes:

• Policy Manager alerts: Fixed an issue where the Policy Manager was not receiving alerts from endpoints if the URI scheme in alerts could not be resolved.
• Isolated environment: Resolved DNS issues in ultimate proxy mode when the Policy Manager host had no direct access to DNS.
• Upgrade installation: Addressed a problem where upgrading the Policy Manager Proxy from version 16.01 to 16.02 removed a required registry key.

Other changes:

• LDAPS connections: Extended the list of supported security groups in LDAPS connections.
• New Installation Launcher version: Updated to ilaunchr.exe version 13.6.174.
• Security enhancements: Added the includeSubDomains directive in the Strict-Transport-Security header for admin and host interface ports.
• File exclusions: Client products’ locally added file exclusions can now be found with Policy Manager Data Mining.
• Improved indexing: Enhanced indexing for long lists of exclusions.
• Vulnerability fixes: CVE-2024-22262, CVE-2024-38809.

WithSecure Client Security 16.01 and WithSecure Server Security 16.01

Changes in this release

New features:

• Added a warning tray icon if UlCore is not installed due to an ACS issue.
• Added removable SCSI drives (UAS) detection to the following features:
• write/execute access control in the Device Control.
• device access rules in Device Control.
• automatic scan of removable drives in Manual scanning settings.
• To avoid accidents on misconfigurations Device Control now enables devices back to avoid system devices to be blocked on boot, if attempt to block was not allowed by the operating system.
• Added a delay to network information (i.e. IP addresses) upstream to PM – wait for a network configuration to stabilize.

Bug fixes and improvements:

• Issue with a lost connection to the Policy Manager after upgrade from 14.xx to 16.xx is now fixed.
• Possible issue with a delayed alert is now fixed.
• Cancel for scheduled scanning is now also available on hosts with UAC disabled.
• The managed client now checks for policies right after the system start.
• Issue with the Firefox triggering Tamper protection alerts is now fixed.
• IPv6 loopback (::1) for the localhost address is not added into Firewall config anymore.
• Policy Manager Datamining directory is now automatically excluded from the Realtime scanning for the better performance.
• Support tool result filename is changed from fsdiag.zip to wsdiag.zip.
• Always wrap path to fsscan.exe into quotes in the Windows scheduler to avoid possible abuse.
• Connectivity Tool improvements:
• proxy and custom endpoint are automatically added if the user forgot to add them and clicked “Next”.
• the option to copy the URL to the clipboard is now added.

WithSecure Client Security 16.01 for macOS

What’s new in this version

• Support for macOS 15 (Sequoia)
• Vulnerability fixes
• Scanning performance improvements

UPDATE 2024-09-18: Clarification that it is not necessary to purchase a new license for the WithSecure branded versions

Previously, we have announced that support for older versions of our on-premises products will soon be ending.

After September 30th 2024, ONLY versions 16.x will be supported, with support for older versions coming to an end. Version 16.x are branded as WithSecure products, with earlier versions being branded as F-Secure.

This change affects:

• Policy Manager, including Policy Manager Proxy, for both Windows and Linux operating systems, version 15.x and earlier
• Client Security for Windows, including Premium, version 15.x and earlier
• Server Security for Windows, including Premium, version 15.x and earlier
• Email and Server Security for Windows, including Premium, version 15.x and earlier
• Client Security for Mac, version 15.x and earlier

Version 16.x of these products are not affected. WithSecure Elements is not affected.

Installers for version 16.x of all of these products are available from our Download Center.

What happens if I do not update my installations before September 30th?

Support for these older versions officially ends on September 30th, and any customers reporting issues with these versions will be advised to install a supported compatible product.

Please note that a valid license always includes access to the latest version. No separate purchase is required to upgrade the product.

We anticipate that definition and engine updates will continue for a short period of time after this date, but these updates will stop latest on December 31st 2024.

In addition, after September 30th 2024, F-Secure (a completely separate company after our demerger) may publish browser extension updates which are incompatible with the products listed above. This is entirely outside WithSecure control, and we cannot fix any issues caused by such a change.

What are the best practices to avoid issues?

WithSecure strongly advises our partners and customers to ensure that they update all installations of the on-premises products to supported versions before September 30th 2024, to ensure continued protection.

Additionally, we recommend that these products are kept at the latest released versions at all times. From time to time we release updates that bring security fixes that need manually applying by the Security Administrator.

Administrators should always ensure that they use the newest possible installer, available from the Download Center, when deploying new installations.

Partners and customers can also consider moving over to WithSecure Elements Extended Detection and Response solution, which can keep the deployed software up to date completely automatically.

UPDATE 2026-01-12: The list of network addresses has been updated to reflect the current requirements

UPDATE 2024-09-06: Added a note to highlight that product functionality can be affected if access to these network addresses is not allowed

UPDATE 2024-01-25: Updated references to aspam.sp.f-secure.com

For many customers, WithSecure products will function correctly without needing to know which servers the products connect to.

However, some administrators tightly control which network addresses they allow their clients to connect to (“Egress control” or “outbound connections”), and it is mandatory that they allow connections to the following addresses. WithSecure cannot guarantee the functionality of the products if access to these addresses is blocked.

The product may not function correctly if access to these network addresses is not allowed.

In addition, WithSecure Linux Security 64 and WithSecure Atlant can use an offline mode, which can help in isolated environments. Please note that this will limit some functionality. Please check the user guides for more information

Please note that all the following require outbound connections to TCP/443 unless otherwise stated.

Additionally, any products listed in this document also includes F-Secure branded versions of the same products.

Recommendations

WithSecure recommends, where possible, that administrators allow outbound access to all address under the withsecure.com and fsapi.com domains. We do appreciate that this is not always possible due to firewall configuration limitations, or even from an operational perspective, so we are publishing an explicit list of server addresses.

Please note that we do not guarantee this list of addresses is complete or will stay unchanged, so we strongly recommend bookmarking these articles for future reference. We will update these articles whenever needed.

WithSecure Business Suite

Business Suite includes:

• WithSecure Policy Manager (Windows & Linux)
• WithSecure Policy Manager Proxy (Windows & Linux)
• WithSecure Client Security (including Premium, Mac)
• WithSecure Server Security (including Premium)
• WithSecure Linux Security 64

For environments that only connect to the internet via the Policy Manager, it is enough to ensure that the Policy Manager (or Policy Manager Proxy) can reach these services.

Business Suite 16 onwards

corp-reg.fsapi.com

• This server is used by Policy Manager for license registration. Blocking this server will prevent license validation.

guts2.fsapi.com (also TCP/80)

• This server is used to deliver updates for scanning engines and detection rules, and for some products updates to the software itself. Blocking this server will completely stop security updates.

a.karma.sc2.fsapi.com

restmc.mind.sc2.fsapi.com

mind-failover.sc2.fsapi.com

api.doorman.fsapi.com

• Backend services needed for Security Cloud functionality

api.prd.glb.us-prd.fsapi.com

• Used to control updates for Linux Security 64

download.fsapi.com

• Used for the hotfix update mechanism for Linux Security 64

WithSecure Email and Server Security

While WithSecure Email and Server Security is not part of Business Suite, the network addresses needed are the same as for Business Suite, with the addition of an extra address

ESS version 16 onwards

aspam.fsapi.com

• Used to check email content for Spam in the ESS product.

WithSecure Atlant

Versions 1.0.319 onwards

guts2.fsapi.com (also TCP/80)

• This server is used to deliver updates for scanning engines and detection rules, and for some products updates to the software itself. Blocking this server will completely stop security updates.

api.prd.glb.us-prd.fsapi.com

• Used to control updates for WithSecure Atlant

aspam.fsapi.com

• Used to check email content for Spam in the Atlant product.

a.karma.sc2.fsapi.com

restmc.mind.sc2.fsapi.com

mind-failover.sc2.fsapi.com

baseguard.doorman.fsapi.com

• Backend services needed for Security Cloud functionality

provisioning.ew1.entitlements.fsapi.com

api.disobus.fsapi.com

• These services are only used when license key is used for Atlant. They are not required when a license file is used

download.fsapi.com

• Used for the hotfix update mechanism