The biggest complaint about older Symantec versions was "My computer is slow." SEP 14 solved this with three technical improvements:

Real-world results: A typical Windows 10 build with SEP 14 adds less than 2% CPU overhead idle and under 5% during a manual scan. Boot time delay is approximately 3-5 seconds slower than with Defender alone.

SEP 14 maintains a robust two-way firewall and a network-based IPS. This layer inspects network traffic before it reaches the operating system, blocking attack traffic associated with known vulnerabilities and preventing command-and-control (C2) communication from compromised machines.

One of the most common complaints regarding endpoint protection is CPU usage during scans. SEP 14 is smarter than its predecessors, but it needs direction.

Best Practices for Performance:

  • Exclusions are Critical: Work with your application owners to exclude high-I/O directories (like SQL database files, Exchange logs, or heavy developer build folders). Scanning these in real-time will degrade application performance.
  • Randomize Scheduled Scans: If you have 500 endpoints, do not schedule a Full Scan for all of them at 12:00 PM on Friday. This will crash your storage network. Use the randomization feature in the scheduled scan settings.

    • Security solutions have historically been criticized for consuming high system resources, leading to user productivity loss. SEP 14 introduces Insight Optimizer, a feature designed to reduce scan times and CPU usage. By skipping files with established good reputations or files that have not changed since the last scan, SEP 14 significantly lowers the I/O overhead compared to traditional full-system scans.

    Network-based IPS stops drive-by downloads and exploit kits. Unlike a firewall, IPS inspects the payload of network traffic. If a user visits a malicious site but the IPS blocks the exploit, the endpoint never gets infected.

    Back To Top