The clones are within a network (ie they are multisite subsites).
ie main site is example.com
subsites are xyz.example.com , abc.example.com etc
Wordfence is installed and network-activated, so it appears in the Network admin plugins, but not in the subsites' plugin lists.
Is installing it individually for each network site required, in order for it to protect them?