Endpoint security has spent a decade fighting over the kernel. Who gets the driver. Who gets the telemetry. Who gets blamed when a bad update bricks the fleet. Absolute Security just placed a bet one floor down.
Absolute announced it acquired FirmGuard from Phoenix Technologies, a UEFI BIOS firmware security, management and networking service. FirmGuard adds integrity verification, posture management, continuous patching and compliance enforcement below the OS. The first phase promises broader below-the-OS management, continuous firmware integrity and patching, expanded data-wipe options and one firmware-to-cloud console. Price: Undisclosed. Boston Meridian Partners advised FirmGuard (Absolute).
The distribution moat is the story. Absolute says its Persistence technology is embedded in the firmware of 600 million endpoints through OEM partnerships with Dell, HP and Lenovo (Absolute). Most security vendors fight for every agent install. Absolute is already there when the laptop leaves the factory. Turning it on is a license decision, not a deployment project.
That changes how you should read a small tuck-in. FirmGuard isn’t a new market for Absolute. It’s depth in the market Absolute already owns. Same layer, more control.
Why firmware matters more now. Firmware runs before the OS. Whatever controls it controls the boot. ESET’s 2023 analysis of BlackLotus showed a UEFI bootkit could bypass Secure Boot on fully patched Windows 11 and then disable BitLocker, HVCI and Windows Defender (ESET). Once code runs that early, the EDR agent is just another thing it can switch off.
The patching side is worse. Absolute cites research that 60% of organizations delay firmware updates and more than half fear making them (Absolute). That fear is rational. A bad firmware update can brick a machine, and most IT teams have no clean rollback. So firmware sits unpatched, quietly, for years.
The platform angle nobody is pricing. The big endpoint platforms want to own everything from the kernel up: EDR, identity, data, now AI agents on the device. Absolute is positioning as the layer they can’t reach without OEM deals. That’s a classic best-of-breed wedge, except the wedge is physical. You can consolidate your EDR. You can’t easily consolidate what’s burned into the BIOS.
The recovery case is the strongest part. Absolute says it can restore devices to an operational state at boot even when the OS is corrupted or crashing (Absolute). Every IT leader who lived through a fleet-wide boot loop knows what that’s worth. Resilience, not detection, is the budget line this sells into.
Where we’re skeptical. The release says the combined product will help “prevent agents from going rogue.” Firmware integrity is real security. Stopping a misbehaving AI agent is mostly an identity and authorization problem several layers up. Treat that line as marketing until it ships with specifics.
The other skeptic case is the OEMs themselves. Dell, HP and Lenovo all sell their own firmware protection and management tools, often bundled with the hardware. Absolute has to prove it’s worth paying for on top of what the laptop already includes.
What buyers should ask. When do continuous BIOS integrity checks and firmware patching show up in your SKU, and at what price? Can firmware integrity findings feed your SIEM and EDR, or do they stay in another console? What’s the rollback story when a firmware patch goes bad? And who owns firmware in your org today: IT, security, or nobody?
The read. The endpoint market isn’t done consolidating. But consolidation stops at layers you can’t reach with software alone. Absolute’s bet is that the boot layer is one of them, and that its OEM footprint makes it the default owner. It’s a narrow bet. It might be a good one.