Trellix was announced on January 21, 2022, after Symphony Technology Group (STG) acquired McAfee’s enterprise-security business and FireEye’s products business in separate 2021 transactions. The result was a new enterprise-security company—not a replacement for McAfee’s consumer antivirus business and not a simple absorption of all FireEye operations. Trellix’s “unified XDR” label described its integration strategy and roadmap; it did not mean every inherited product instantly shared one console, agent, or data plane.
What actually happened to McAfee Enterprise and FireEye?
“McAfee and FireEye merged” is understandable shorthand, but it is legally and operationally imprecise. STG bought the enterprise-security business from McAfee Corp. for a reported $4 billion and separately acquired FireEye’s products business for approximately $1.2 billion in 2021. STG then combined those assets under the Trellix name, announcing the company on January 21, 2022. CSO Online’s contemporaneous report describes the transactions and launch.
- McAfee Enterprise: the business serving corporate, government and other institutional customers.
- McAfee consumer security: the consumer antivirus and identity-protection operation was not the subject of this combination.
- FireEye products: the detection, analytics and security-product assets acquired by STG.
- Mandiant services: FireEye’s incident-response and consulting business was not simply folded into Trellix. Buyers must distinguish product entitlements from a separate Mandiant services relationship.
The practical story is therefore a private-equity-led consolidation of two enterprise portfolios, followed by a new brand and an XDR-oriented product strategy.
Why create the Trellix name?
A neutral name separated the enterprise portfolio from McAfee’s consumer identity and gave STG a single brand for products inherited from two companies. Trellix also positioned the name around “living security”—security that adapts through machine learning, automation and threat intelligence. That language was part of the launch positioning, not independent proof that every product already behaved as one system. The 2022 announcement coverage also reported industry speculation about the branding; speculation should not be treated as the company’s confirmed rationale.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What McAfee Enterprise contributed
McAfee Enterprise supplied breadth, a large installed base and mature enterprise-management infrastructure. Its inherited capabilities included:
- Endpoint protection and management.
- ePolicy Orchestrator (ePO) for centralized deployment, policy and event administration.
- Data-loss prevention and broader data-security controls.
- Email and web security.
- Cloud and workload security.
- Security-management and SIEM-related capabilities.
- Secure Service Edge technologies such as cloud access security broker (CASB), secure web gateway (SWG) and zero-trust network access (ZTNA), described at launch as a related direction rather than proof that every component sat in Trellix’s core XDR platform.
Trellix’s current endpoint page describes a single-agent endpoint approach for endpoint protection, EDR-related functions, application control and cloud-workload security across on-premises, cloud and disconnected environments, with ePO as centralized management. That “single agent” claim applies to the endpoint offering; it should not be extended to the entire Trellix portfolio. Trellix Endpoint Security
What FireEye contributed
FireEye added the advanced-detection and threat-response side of the combination:
- Network detection and response.
- Advanced threat detection and malware analysis.
- Threat intelligence.
- Security-operations analytics.
- FireEye Helix, described in the launch coverage as a software-as-a-service security-operations platform.
- Incident-response expertise associated with the FireEye heritage, while Mandiant’s services business must be treated as a separate corporate and commercial question.
Strategically, this gave Trellix a way to connect McAfee’s prevention and management footprint with FireEye’s investigation, intelligence and response capabilities. It did not automatically convert every FireEye product or service into a Trellix SKU.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
What “unified XDR” means in practice
XDR is not a universally standardized product category. It generally connects detections and response across multiple security domains rather than limiting analysis to one sensor type.
| Technology | Primary focus |
|---|---|
| EDR | Endpoint telemetry, investigation and containment. |
| NDR | Network activity, traffic analytics and network response. |
| SIEM | Collection and analysis of security events from many systems and vendors. |
| SOAR | Automated investigation and response workflows. |
| XDR | Correlation and coordinated response across several security domains, ideally producing a shared incident view. |
For Trellix, the intended model was to combine telemetry from native products with data from third-party applications, then apply analytics to correlate alerts and coordinate response. When evaluating that promise, separate the layers:
- Telemetry: Which endpoints, servers, networks, email systems, cloud workloads, identities and data stores are covered?
- Ingestion: Which sources are native, and which require connectors, APIs or extra licenses?
- Correlation: Do separate alerts become one incident with useful context, or are they merely displayed together?
- Investigation: Can analysts pivot across domains without exporting data to another tool?
- Response: Can a detection quarantine an endpoint, block a network indicator, disable an account or trigger a playbook?
- Management: Is there a shared policy, case-management and reporting layer, or do administrators still operate product-specific consoles?
The original launch reporting described successive releases and continuing integration work, with analysts warning that moving customers across product families could take years. “Unified” was therefore an architectural ambition and delivery program, not evidence of an instantly finished single platform. See the launch account for the original roadmap context.
Trellix’s current product landscape
As of August 16, 2026, Trellix presents itself as a broad enterprise-security vendor rather than merely the name of the 2022 transaction. Its current categories include:
Recommended Free Tools
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Endpoint security: endpoint protection, EDR-related capabilities, application control, cloud-workload security and ePO management.
- Data security: controls for discovering, monitoring and protecting sensitive data.
- Network security: network protection and threat detection.
- Threat intelligence: intelligence used to enrich detections and investigations.
- Email security: protection against phishing, malicious attachments and other email threats.
- Security operations: analytics, investigation and response capabilities.
- Managed detection and response and professional services: deployment, integration, training, incident-response and operational assistance.
Current product pages emphasize enterprise deployment and sales-assisted evaluation rather than consumer self-service purchasing: Endpoint Security, Email Security and Network Security.
What existing customers should check before renewing or migrating
McAfee Enterprise customers
- Is the existing ePO deployment supported under the proposed Trellix entitlement?
- Will the project retain the current agent, or require a new agent or console?
- Can policies, exclusions, tags and custom rules be converted without manual recreation?
- Are previously purchased DLP, email, network or cloud modules included, or separately licensed?
- How are on-premises, air-gapped and disconnected systems updated, licensed and managed?
FireEye customers
- Which product is being renamed, replaced or moved to a different deployment model?
- Will existing detections, rules, integrations and historical data remain usable?
- Are Helix data, intelligence feeds and response workflows included in the renewal?
- Which services remain with Trellix, and which require a separate Mandiant agreement?
Mixed-vendor SOCs
- Can third-party alerts trigger Trellix response actions, rather than only appear in a dashboard?
- Are APIs and connectors bidirectional, and are they included in the quoted license?
- Are there data-ingestion limits or retention charges?
- Can enriched incidents flow back to the organization’s SIEM and case-management system?
- Is detection content portable if the organization later changes platforms?
For disconnected environments, Trellix explicitly markets endpoint support across on-premises, cloud and disconnected deployments. Verify update distribution, local management, policy synchronization, license validation and response behavior in a proof of concept—not just in a sales presentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Trellix compared with major XDR alternatives
| Platform | Often strongest fit | Key trade-off to test |
|---|---|---|
| Microsoft Defender XDR | Organizations standardized on Microsoft 365, Windows, Azure and Entra. | Value and integration can depend heavily on Microsoft licensing and ecosystem commitment. |
| Palo Alto Networks Cortex XDR | Enterprises already using Palo Alto firewalls, Prisma or Cortex products. | Compare agent requirements, data sources and licensing before committing to the broader Palo Alto ecosystem. |
| SentinelOne Singularity XDR | Buyers prioritizing cloud-delivered autonomous endpoint security that expands through integrations. | Test native email, network, data and SIEM coverage instead of relying on the XDR label. |
| CrowdStrike | Organizations seeking a major endpoint-led security platform. | Verify current 2026 product names, modules, packaging and pricing before making a direct comparison. |
The right comparison is architectural: telemetry coverage, correlation quality, response controls, agent and console count, deployment constraints, services and total licensing—not marketing terminology.
Who is Trellix designed to serve?
- Large enterprises with complex hybrid estates.
- Government agencies and regulated industries requiring on-premises or disconnected options.
- Existing McAfee Enterprise or FireEye customers seeking continuity from an incumbent supplier.
- SOCs trying to reduce alert volume and the number of disconnected security tools.
- Organizations that want one vendor relationship spanning endpoint, network, email, data and operations.
Trellix is less obviously suitable for consumers, small organizations seeking simple antivirus, or teams without staff to tune policies and investigate correlated incidents. Buyers already deeply standardized on Microsoft or Palo Alto Networks should calculate the switching cost and incremental coverage before adding another broad platform.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Commercial and operational questions to put in the contract
- Which modules, data sources, connectors and response actions are included in the subscription?
- Is pricing per endpoint, user, module, data volume or platform tier?
- What minimum quantities, renewal escalators, term commitments and partner discounts apply?
- What professional-services hours cover policy conversion, integrations and deployment?
- What support level applies to legacy products during migration?
- What are the rollback, export and termination procedures if the integration does not meet operational targets?
Trellix’s reviewed product pages do not publish list prices; purchasing is quote-based and varies with modules, endpoint count, deployment model, services, contract term, geography and partner arrangements. A pilot should measure analyst workflow time, false-positive handling, endpoint resource use, containment speed and the effort required to maintain integrations.
Frequently Asked Questions
Did Trellix replace McAfee antivirus?
No. Trellix came from McAfee’s enterprise-security business. McAfee’s consumer-security operation was not the subject of the STG combination.
Did all of FireEye become Trellix?
No. STG acquired FireEye’s products business. Mandiant’s services and incident-response operations should be evaluated separately.
Was Trellix already one unified platform in January 2022?
No. “Unified XDR” described the strategic direction and planned integration. The launch coverage described successive releases and continuing work rather than an instantly unified console and data plane.
The Bottom Line
Trellix is more than a name change: STG combined McAfee Enterprise’s scale and management heritage with FireEye’s detection, intelligence and analytics assets. But the commercial and technical value depends on the current SKU architecture, integrations, licensing, support and migration effort. Treat “unified XDR” as a claim to validate with product-level tests and contract language—not as proof that every inherited capability is already one seamless system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
