: Standard memory-based exploit protections may be limited.
Most standard protection features are functional on ARM64, but several legacy and advanced policies are currently unsupported: Unsupported Features (ARM64) Core Anti-malware & Scans Custom Application Behavior Network Threat Protection Threat Defense for Active Directory Device Control Application Control Exploit Protection LiveUpdate (Native Updates) Legacy Browser Protection (IE/Firefox) Implementation Considerations
While Windows 11 handles x64 emulation, kernel-level drivers (like those used for real-time scanning) are difficult to emulate stably.
| Feature | Status | |--------|--------| | Real-time file scanning | ✅ Works | | Scheduled scans | ✅ Works | | LiveUpdate (definitions) | ✅ Works | | Network Threat Protection | ✅ Works (emulated) | | SONAR (behavioral detection) | ✅ Works | | Performance impact | Slightly higher CPU than native, but acceptable | | Tamper Protection | ⚠️ May be less reliable under emulation | | Full disk encryption (EDE) | ❌ Not supported on ARM64 |
Before diving into SEP’s status, it’s critical to understand Windows on Arm’s two operating modes: symantec endpoint protection arm64 work
: To successfully deploy SEP on ARM64, administrators must use the Symantec Endpoint Security (SES) cloud console .
: Support includes Windows 11 GA builds (21H2 through 25H2).
Symantec Endpoint Protection ARM64 Work: Compatibility, Setup, and Policy Guide
Modern SES agents are designed to run natively on ARM64, providing full functionality, including behavioral analysis, ransomware protection, and network firewall, without relying on x64 emulation. : Standard memory-based exploit protections may be limited
: Fine-grained tracking of unusual process-to-process interactions is disabled.
SEP on Arm64 is a workable solution today, but a native one tomorrow. Plan accordingly.
: Support is focused on Windows 11 (builds 21H2, 22H2, 23H2, and 24H2).
Symantec Endpoint Protection ARM64 Support: Compatibility, Setup, and Features : Support includes Windows 11 GA builds (21H2 through 25H2)
Symantec’s ARM64 support is currently focused on specific management models:
Windows on Arm is arguably the most dynamic space for SEP deployment right now. The ecosystem has matured significantly with the introduction of powerful Snapdragon processors.
The story on the Windows side is more nuanced. Broadcom began experimenting with ARM support from version but with a major caveat: it was limited to unmanaged or cloud-managed clients only.
Currently, there is no support for managing ARM64 endpoints via the on-premises Symantec Endpoint Protection Manager (SEPM). Operating System & Platform Support