Endpoint protection and EDR for business computers
Traditional antivirus looks for known bad files. Modern attacks often use no file at all, just stolen credentials and the tools already on your computers. Endpoint detection and response watches behaviour instead, isolates a machine that starts acting like it has been compromised and gives us the detail to work out what happened.
Endpoint protection & EDR for small and medium businesses
A lot of offices still run the antivirus that came with each laptop, or a consumer product someone bought years ago. It catches the obvious things, but nobody sees its alerts, half the machines are on different versions and the subscription on the server lapsed last year. Meanwhile ransomware groups have moved on to quieter methods: signing in with a stolen password, running legitimate admin tools and switching security software off before they start encrypting.
Endpoint detection and response, usually shortened to EDR, records what happens on each computer: which programs start, what they connect to and what they change. Unusual patterns, such as a word processor launching a command line or hundreds of files being renamed in a minute, raise an alert. The software can then cut the machine off from the network on its own while still letting us connect to it, which contains a problem before it spreads to the rest of the office.
Tools only help if someone acts on what they report. Every alert from your computers comes to our team, is checked and either closed with a note or followed up with you. Tamper protection stops the agent being switched off, attack surface reduction rules block common tricks used by malicious documents, and a monthly report shows any device that is missing protection. For businesses that want alerts watched outside business hours, we can add a specialist monitoring service and explain exactly what it covers.
What's included
EDR on every device
Business-grade endpoint protection installed on every laptop, desktop and server, managed from one console and kept on current versions.
Behaviour-based detection
Alerts based on what programs do, not only on known bad files, so new and fileless attacks are more likely to be noticed.
Automatic isolation
A computer showing signs of compromise can be cut off from the network straight away, while we keep remote access to investigate.
Alert review
Alerts checked by our team, with false alarms closed and real threats followed up with you and fixed.
Tamper protection
Settings that stop users, malware or attackers from switching off or uninstalling the protection.
Hardening rules
Attack surface reduction settings that block risky behaviour such as Office documents launching scripts or unknown USB programs running.
Coverage report
A monthly list of every device and its protection status, so a laptop that dropped out of management is noticed quickly.
Incident help
If something does get through, we contain it, clean or rebuild the device, reset affected accounts and explain what happened.
Who is endpoint protection for?
It is time to review endpoint protection if:
- Your computers run a mix of free and consumer antivirus products
- Nobody sees the alerts your current antivirus produces
- A cyber insurance form asks whether you use EDR
- Your servers or a few laptops have no protection at all
- You have had a malware scare and still aren't sure how it got in
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkEndpoint protection & EDR questions
What is the difference between antivirus and EDR?
Antivirus mostly blocks known malicious files. EDR also records behaviour on the device, spots suspicious activity that involves no malware file and gives responders the tools to isolate and investigate a machine remotely.
Is Microsoft Defender good enough?
Microsoft Defender for Business, included in Microsoft 365 Business Premium, is a capable EDR product when it is properly configured and its alerts are watched. Other products suit some businesses better, and we recommend based on your licences and setup.
Does EDR slow computers down?
On current business hardware the impact is normally hard to notice. Older or under-powered machines can feel it more, and we tell you if that is the case before rollout.
Are alerts watched outside business hours?
Our team reviews alerts during business hours, and high-risk detections can isolate a device automatically at any time. If you need people watching overnight, we can add a specialist monitoring service and set out exactly what it covers.
Do Macs and servers need EDR too?
Yes. Macs are targeted less often than Windows but are not immune, and servers are a favourite target because they hold shared data. We cover every device that touches company information.
Is it included in a plan?
Antivirus and threat detection on every computer is included from the Essentials plan at $69 per user per month plus GST. Specialist after-hours monitoring is optional and quoted in writing first.
What should staff do if they see a security warning?
Stop, leave the computer on and tell us straight away. Turning it off can destroy useful evidence, and quick reporting lets us check whether the threat was blocked or needs more work.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security