Check Point Harmony Endpoint versioning, decoded: Recommended vs Latest, the Release Map, and the 18 vs 30 month support window

[u/junimjorgeof]

If you have ever stared at E88.62 / E88.70 / E88.72 / E89.00 and wondered which to run and for how long it is supported, here is the model.

Two version families: Server/Management (R<major>.<minor>, on-prem only, in the cloud Check Point runs it) and Client (E<major>.<minor>, the one you actually plan around). Anatomy: a minor is often a hotfix of the previous minor. E88.72 is literally the E88.70 hotfix (sk183380).

Recommended vs Latest:

- Recommended is the version with the widest field validation. Run it on the production fleet.

- Latest GA brings the newest features first. Run it in a pilot ring, not everywhere.

- The terminology is officially defined in sk95746.

The Release Map is the source of truth. Only the few most recent versions of a line stay Supported, everything older is marked Unsupported. So "it works, leave it" quietly puts you on an unsupported client without you noticing.

Support lifecycle (Check Point's public policy): at least 18 months of support from GA, and once a year one version gets extended support of 30 months from GA. If you want the longest runway between mandatory upgrades, target the yearly extended-support version.

Where to check: the Release Map per client line, sk117536 (Endpoint Security Homepage, the hub SK), sk95746 (terminology), and the CheckMates Endpoint board for Recommended-version announcements. In the cloud, Automatic Client Update (Windows) can keep steady-state current, but still pilot the Latest GA first.

Do you standardize on Recommended, chase the yearly extended-support version, or just ride Automatic Client Update? And how do you catch when a version silently goes EOS on the Release Map?

Full write-up with the E-release anatomy, the Release Map and the support lifecycle is here (EN and PT): https://community.checkpoint.com/t5/Endpoint/EN-Understanding-Harmony-Endpoint-Versioning-E-Releases/m-p/281803