In this case, please install Dark network client (DNC). If a SC cannot connect to Internet, it really cannot detect those old virus. ESET Endpoint Security is ranked 14th in EPP (Endpoint Protection for Business) with 46 reviews while Symantec Endpoint Security is ranked 11th in EPP (Endpoint Protection for Business) with 47 reviews. Those are old virus that Symantec thinks less relevant nowadays. 712,554 professionals have used our research since 2012. Standard client (SC) really has less virus definition on disk. Overall I would still suggest the Darknet client for any system which cannot leverage the cloud-based definitions. For any threat where there is currently a major outbreak / concern (such as we saw with the Wannacry situation), that means we will be getting current telemetry for that threat, and therefore its signature would still be included in reduced size defs. (I cannot share specifics around these metrics.) Threats which have been active recently would still have signatures included in the reduced size definitions, or certainly major threats like Wannacry would have their detection included in these definitions. The reduced size definitions remove very old threat detections that we have not had telemetry for within a certain period of time. Endpoint protection suites combine a number of endpoint security and management capabilities to deliver an all-in-one solution for securing endpoint devices.

From the Symantec support staff Matt's answer:

Symantec endpoint protection 14 vs 15