CyberIndexBeta

Product

Sangfor's endpoint detection and response (EDR) platform, now presented as its unified endpoint security system aES, combines antivirus, endpoint protection and EDR with central management for enterprises. Supported platforms are Linux, macOS and Windows. It is recorded as supporting behavioral detection, central management console, heuristic detection and malware detection. Its record also notes ransomware protection. The stated market is Enterprise and small and medium business.

Current Version
6.0.4EN
Market
EnterpriseSMB
Licence
Paid
Price
Quote
Record Created
2026-08-20
Last Updated
2026-10-10

Vendor

Sangfor is a Shenzhen company, founded in 2000 and listed in Shenzhen, that sells three things a Western buyer would usually buy from three different suppliers: network security, cloud infrastructure and the connectivity between sites. Its hyper-converged infrastructure and SD-WAN businesses are as large as its security one, and the products are designed to be bought together. On the security side, Sangfor NGAF is its next-generation firewall, Sangfor Endpoint Secure the endpoint agent, Sangfor Cyber Command the detection and response platform that correlates the two, and Sangfor Athena the more recent AI-driven line. Sangfor Access covers secure remote and branch connectivity. It is one of the larger Chinese security vendors with a deliberate international presence, selling across Southeast Asia in particular. Its products enter the Western public test cycles occasionally rather than routinely, so its laboratory record here is thinner than its size would suggest. Vendor page →

Country
China
Headquarters
Shenzhen, China
Year Established
2000
Customers
100K organisations
Users
12M devices protected
Revenue
≈ $1.1B (2025)

Platforms

Linuxnative
macOSnative
Windowsnative

Target Market

Enterprise secondarySMB secondary

Capabilities

Malware Detectionkeynative
Ransomware Protectionkeynative
Behavioral Detectionkeynative
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox AnalysisNot known
Cloud-Assisted ScanningNot known
Heuristic Detectionnative
Device ControlNot known
Vulnerability ShieldingNot known
Central Management Consolenative

7 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 6.0.4ENWindows

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

OESIS Framework SupportSupported1 activeSupported
OPSWAT Certified Security ApplicationGold1 activeGold

Change History

This record was created 2026-08-20. Everything below is what has changed since.

  • 2026-09-23Product updatedListed in Small Business Antimalwareevidence
  • 2026-09-23Capability addedCentral Management Console: built inevidence
  • 2026-09-23Capability addedHeuristic Detection: built inevidence
  • 2026-09-23Capability addedBehavioral Detection: built inevidence
  • 2026-09-23Capability addedRansomware Protection: built inevidence
  • 2026-09-23Capability addedMalware Detection: built inevidence
  • 2026-09-23Platform addedRuns on Linuxevidence
  • 2026-09-23Platform addedRuns on macOSevidence
  • 2026-09-22Product updatedListed in Home Antimalwareevidence
  • 2026-09-19Product updatedAlso sold to: SMBevidence
  • 2026-09-19Product updatedAlso sold to: Enterpriseevidence
  • 2026-09-19Pricing plan addedPrice: price on requestevidence
  • 2026-09-09New versionNew version: 6.0.4EN (Windows)evidence
  • 2026-08-20Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-08-20New versionNew version: 6.0.4ENevidence
  • 2026-08-20Platform addedRuns on Windowsevidence
  • 2026-08-20Certification addedCertified: OPSWAT Certified Security Application (Gold)evidence
  • 2026-08-20Product createdNew product listedevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.