A maintains a persistent connection to the Symantec Endpoint Protection Manager (SEPM). It receives policy updates, signature updates, and commands from the central server.

Without constant polling to a management server, they can be slightly lighter on network resources for remote users.