Antivirus looks for known bad files. Endpoint detection and response watches what each device does, and our team acts when that behaviour looks like an attack.
Suspicious processDevice isolated and cleaned upContained
Legacy antivirusRemoved after rolloutManaged
Device hardeningMacro restriction to approveDecision needed
Coverage reportUnprotected device flaggedManaged
Illustration · not live data
01Who it's for
Is this service right for you?
The software records and blocks; our team reviews what it finds and acts on it. That pairing is what turns an alert into a contained threat rather than an unread notification.
Built for
Any business with laptops, desktops or servers, from a single office to many sites
IT teams and providers who want a security team behind their endpoint alerts
Government, health and education teams that handle sensitive information
You probably need it if…
Your staff laptops still rely on basic antivirus
Your cyber insurer now asks for EDR on your devices
You have an EDR tool installed but no time to review its alerts
You're working towards an ASD maturity target or preparing for ASD Essentials
02What's included
What you get
Detect & respond
EDR deployment
We roll out endpoint detection and response to your Windows and macOS laptops and desktops and your Windows and Linux servers, remove overlapping legacy antivirus and confirm each device is reporting. You get a list of protected devices.
Alert monitoring and triage
Our team reviews alerts, investigates suspicious behaviour and separates real threats from noise. You hear from us when something needs your attention, with a plain-English explanation of what happened.
Threat containment
When we confirm a threat, we stop the malicious process, quarantine files and isolate the device from the network where needed. We then help you clean up and get the user working again.
Prevent
Policy tuning
We set protection policies, exclusions and device groups to suit how your business works. That reduces false alarms while keeping protection in place, so real threats stand out and staff aren't interrupted.
Device hardening
We help you apply hardening settings aligned with ASD Essentials and the controls ASD prioritises, such as application control, Microsoft Office macro restrictions and browser hardening, so fewer attacks get a foothold in the first place.
Report & review
Coverage and health reporting
Regular reports show protected and unprotected devices, threats stopped, outdated agents and open issues. You can show an insurer or auditor exactly where endpoint protection stands.
03In detail
Endpoint security, in depth
How does EDR actually work?
EDR records what happens on each device: which processes start, what they change and which network connections they make. When that behaviour matches an attack pattern, EDR can stop the process and cut the device off from the network. That is how it catches attacks that use legitimate admin tools or stolen passwords, where nothing on disk looks like a known bad file.
EDR is only as good as the people watching it. An alert that nobody reads protects no-one. Because penetration testing is also part of our work, the team reviewing your alerts knows how attackers behave once they reach a device.
A common example of what this looks like in practice: if a credential-theft tool is launched from a downloaded file on a laptop, the tool is blocked and the device isolated automatically. Our team then confirms nothing else is affected before releasing the device.
Which level of service suits you?
The FAQ below defines EDR, MDR and XDR. The practical difference is who acts on an alert and how widely you look:
Option
Who acts on an alert
Suits
EDR
Your own IT staff
Organisations with IT staff who can review alerts
MDR
A security team, on your behalf
Most organisations without their own security team
XDR
A security team, correlating several sources at once
Organisations with several security tools and more complex environments
We recommend one based on how sensitive your data is, who would act on an alert, and how much risk you’re prepared to carry.
How does endpoint security fit with ASD Essentials?
In ASD Essentials, EDR feeds the visibility and response domain. It is not one of the strategies in ASD’s current Essential Eight maturity model, which ASD Essentials will replace, but it supports several of them and helps you see when other controls fail. During rollout, we also help you apply hardening that maps directly to ASD’s strategies: application control, restricting Microsoft Office macros and user application hardening.
We inventory your devices and current protection, and agree which platform and coverage suit your risk and budget.
2Step 02
Trial or pilot
We deploy to a pilot group, or, where it fits, run the 14-day endpoint security trial, so you can see the alerts and reporting before committing.
14 days
3Step 03
Roll out
We deploy to all devices, remove legacy antivirus and tune policies until alerts are meaningful.
4Step 04
Monitor and report
Our team watches alerts, responds to threats and reports on coverage and incidents regularly.
05Frameworks
How this maps to the frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
Endpoint Security: framework mapping
Control
ASD Essentials
ASD maturity model (current)
ISO/IEC 27001
NIST CSF
EDR deployment and monitoring
Visibility and response
–Not applicable
A.8.1, A.8.7, A.8.16
Detect (DE.CM-09)
Application control
–Not applicable
Application control
A.8.19
Protect (PR.PS-05)
Device hardening
–Not applicable
User application hardeningRestrict Microsoft Office macros
A.8.9
Protect (PR.PS-01)
Threat containment and investigation
Visibility and response
–Not applicable
A.5.25, A.5.26
Respond
06Pricing
Pricing and how to start
Pricing
Quoted for your environment
What changes the price
Final price depends on the number of devices, whether servers are included, the platform tier you need and extra features such as device control or vulnerability insight.
EDR licence and agent deployment for each covered device
Endpoint detection and response (EDR) is software that records activity on each device, detects suspicious behaviour and lets you respond. Managed detection and response (MDR) adds a team of people who watch those alerts and act on them for you. Extended detection and response (XDR) combines signals from endpoints, email, cloud and network to spot attacks that cross several systems.
Is antivirus enough for a small business?
No. Traditional antivirus looks for known malicious files, but many attacks now use stolen passwords, legitimate admin tools or new malware that no signature recognises yet. EDR watches behaviour instead, so it can spot and stop an attack in progress. Antivirus is one part of endpoint security, not the whole of it, and many insurers now ask specifically for EDR.
Will endpoint security slow down our computers?
Modern EDR agents are lightweight, and most users don't notice them day to day. We tune scanning and exclusions during rollout, for example for accounting or design software that writes many files, and test with a pilot group before deploying to everyone. If a device does slow down, we adjust the policy rather than leaving your staff to put up with it.
What does the 14-day endpoint security trial include?
The trial lets you run endpoint protection on a group of your devices and see the alerts and reporting for yourself before you commit. It is a proof-of-value engagement for organisations evaluating a purchase. Limits and the end-of-trial steps are confirmed in writing before the trial starts. At the end, we go through what was detected and recommend next steps.
Which devices can you protect?
We protect Windows and macOS laptops and desktops, and Windows and Linux servers, whether they sit in your office, in staff homes or in the cloud. Mobile phones and tablets need a different approach, usually device management through Microsoft Intune combined with mobile threat protection. We cover each device type you have during the initial review.
How much does endpoint security cost?
Endpoint security is priced per device each month, so you pay for what you protect. The main choice is between EDR alone and EDR with a managed response service, and we explain that trade-off for your risk. We quote once we have reviewed your devices and servers.
