It comes with the basic protection, called Endpoint Security (which can be another thing to review).
If you want to go more granular, like Firewall, Web-Control, it has to be decided before buying the license.
But all those products [are] worth the investment.
Lacking on some compatibility, ex. WEBControl can be disabled from the Browsers (except IE), still place for improvement.
Hardware resources can use all endpoint resources if not configured properly.
It's great for managing a large company with a lot of endpoints. It's a great way to feel confident that your environment is secure. It gives a great perspective of what is happening in your environment and helps to pinpoint any suspicious activity that is going on.
It's not very appropriate for smaller organizations. Unless there is a dedicated person working through it all day it could become overwhelming for a small team.