Symantec Endpoint Protection Arm64 Work May 2026
The story of Symantec Endpoint Protection (SEP) on ARM64 is a tale of a slow but steady transition from traditional x64 architecture to the specialized world of Windows on ARM devices like the Microsoft Surface Pro X. The Compatibility Milestone
As of April 2026, Symantec Endpoint Protection does work on ARM64, but with specific caveats regarding how it is managed. Support was officially solidified starting with version 14.3 RU7. The Core Conflict: Managed vs. Unmanaged
The "twist" in the story is that while the ARM64 client (the software on the computer) is fully functional, it cannot be managed by a traditional, on-premises Symantec Endpoint Protection Manager (SEPM).
The Cloud Path: To successfully deploy SEP on ARM64, administrators must use the Symantec Endpoint Security (SES) cloud console.
The Lone Wolf Path: Users can also run "unmanaged" packages (self-managed) on ARM64 devices if they don't require centralized corporate oversight. Known Limitations in the ARM World
While the protection is "native" and compatible, the ARM64 version isn't a mirror image of the x64 version. Several high-level features remain unsupported on ARM64 as of early 2026:
Threat Defense for AD: Active Directory-specific defenses are unavailable.
Exploit Protection: Standard memory-based exploit protections may be limited.
Browser Protection: Specific protections for older versions of Firefox or legacy Internet Explorer do not apply.
Application Control: Granular control over which apps can run is not yet supported for ARM64 clients. System Requirements for Success To get SEP running on an ARM64 device, ensure you have: symantec endpoint protection arm64 work
OS: Windows 11 (21H2 through 24H2) is the primary target for ARM support.
Dependencies: Installations often require the Microsoft Visual C++ 2022 Redistributable specifically for ARM64.
Hardware: Compatibility is focused on Qualcomm Snapdragon platforms (7c and later) and Ampere Altra processors.
For further technical details, you can refer to the official Broadcom Knowledge Base which details current ARM limitations.
Are you looking to deploy this to individual devices or as part of a larger enterprise fleet?
Symantec Endpoint Protection (SEP) now provides robust support for ARM64 architecture, specifically catering to the growing use of Windows on ARM devices and Linux-based ARM servers. This expansion ensures that organizations can maintain high security standards across a diverse hardware fleet, including Microsoft Surface Pro models and AWS Graviton instances. Compatibility and Management Requirements
Support for ARM64 is available starting with SEP 14.3 RU7. However, there are specific management constraints:
Management Options: ARM64 support is limited to cloud-managed clients (via Symantec Endpoint Security/SES) or unmanaged (self-managed) clients.
On-Premises Limitation: Currently, the on-premises Symantec Endpoint Protection Manager (SEPM) cannot manage ARM64 devices directly. The story of Symantec Endpoint Protection (SEP) on
Operating Systems: Supported environments include Windows 11 GA builds (21H2, 22H2) and various Linux distributions such as RHEL 8/9 ARM64 and Amazon Linux 2023. Feature Support and Limitations
While the ARM64 client offers comprehensive protection, certain legacy and advanced features are not supported on this architecture:
Supported Features: Core antivirus, firewall, and intrusion prevention policies. Unsupported Features: Custom Application Behavior. Threat Defense for Active Directory (AD). Exploit Protection and Application Control.
Legacy browser protection for Internet Explorer or Firefox-based browsers. Installation on Windows ARM64
To deploy SEP on a Windows ARM64 device, such as a Surface Pro 9 (5G), users must download the specific architecture package:
Cloud-Managed: Select the Windows ARM architecture option when generating the installation package from the Broadcom Cloud Management console.
Unmanaged: Use the Full_Installation download of SEP to locate the unmanaged ARM package.
Dependencies: The Microsoft Visual C++ 2022 Redistributable is required for first-time ARM64 agent installations. ARM64 Support for Linux
Symantec has recently extended its Linux agent support to include ARM64 (aarch64) architectures. Q3 2025: Native Windows ARM64 driver (Sylink) –
Linux Distributions: Support includes Amazon Linux 2023, RHEL 8/9, and Ubuntu.
Deployment: Administrators can use the seplpkg tool to create installable packages for specific ARM64 Linux platforms.
Part 6: Future Roadmap – What Broadcom Has Planned
In Q2 2025, Broadcom announced a renewed focus on ARM64 due to enterprise demand. According to internal roadmaps (shared at the 2025 Symantec Partner Summit):
- Q3 2025: Native Windows ARM64 driver (Sylink) – beta expected.
- Q1 2026: SEP Mobile + ARM64 unified agent for Surface Pro ARM devices.
- End of 2026: Deprecation of Rosetta 2 dependency for SEP on Mac.
For now, the safest “works” scenario for SEP on ARM64 is:
- ✅ Mac ARM64: Works great (native).
- ✅ Linux ARM64: Works perfectly (native).
- ⚠️ Windows ARM64: Works slowly (emulated) – use only for basic user endpoints.
- ❌ ARM32 (32-bit): Not supported at all.
C. Permissions and Provisioning
Because of the ARM64 security model, simply installing the software is not enough. The user (or MDM administrator) must approve the System Extension loading.
- Full Disk Access: The SEP client requires "Full Disk Access" in macOS System Settings > Privacy & Security to scan files created by other applications (like Documents or Downloads).
- System Extension Approval: macOS will prompt the user to allow the "Symantec Endpoint Protection" system extension to load. Without this approval, the real-time protection engine remains inactive.
Symantec Endpoint Protection on ARM64: Making It Work in a Non-x86 World
For decades, the cybersecurity industry has been dominated by the x86 and x64 architectures. Most endpoint protection platforms (EPPs), including Symantec Endpoint Protection (SEP), were engineered to run on Intel and AMD processors. However, the computing landscape is shifting dramatically. With the rise of energy-efficient, high-performance ARM64 (also known as AArch64) processors—championed by Apple’s M-series chips, Qualcomm’s Snapdragon X Elite, Amazon’s Graviton, and various IoT devices—security teams now face a critical question: How well does Symantec Endpoint Protection work on ARM64?
The short answer is that Broadcom (the current owner of Symantec) has made significant strides, but "making it work" still requires careful planning, the right version, and an understanding of where native support ends and emulation begins.
This article provides a comprehensive guide to deploying, managing, and troubleshooting Symantec Endpoint Protection in an ARM64 environment.
2. Linux on ARM64 (The Success Story)
If your ARM64 environment is Linux-based (common in data centers running AWS Graviton or Oracle Ampere A1 instances), the news is excellent.
- Native Support: Symantec Endpoint Protection for Linux has supported native ARM64 (aarch64) since SEP 14.3 RU2 (released in 2020).
- Full Feature Set: Kernel modules compile cleanly for ARM64. Real-time file scanning, memory protection, and firewall filters run without emulation.
- Recommendation: For server workloads, SEP on ARM64 Linux is production-ready.
When to Use SEP on ARM64 (And When to Run Away)
B. Compatibility
- Autoupgrade: Broadcom has updated the SEPM (Management console) upgrade packages to ensure that when an ARM64 Windows device checks in, it receives the correct installation payload compatible with its architecture.