Endpoint Security
Protect laptops, desktops and servers with properly deployed detection, hardening and response, monitored and kept current.
Overview
We protect laptops, desktops, servers and mobile devices with prevention, detection and response, managed from one console.
- AgentLightweight agent on laptops, desktops, servers and mobile devices.
- PolicyPrevention, device control, disk encryption and hardening baselines.
- EDRProcess, network and file activity recorded for investigation.
- ResponseRemote isolation of compromised hosts from one console.
Technical scope
- Next-generation antivirus and EDR deployment
- Device hardening to security baselines
- Application control and USB or device control
- Disk encryption with BitLocker or FileVault
- Patch and configuration compliance
- Mobile device management policies
- Remote isolation and remediation of compromised hosts
Architecture and how it works
A lightweight agent on each device sends telemetry to a cloud console. Policies set prevention, device control and hardening, while EDR records process, network and file activity so analysts can investigate and isolate hosts remotely.
Delivery process
- 01
Discover
Discover endpoints and baseline risk
- 02
Pilot
Pilot agents on a representative group
- 03
Roll out
Roll out in waves and tune policies
- 04
Integrate
Integrate alerts with the SIEM or SOC
- 05
Review
Review exclusions and coverage monthly
Tools and deliverables
Deliverables include the agent deployment plan, prevention and device-control policies, hardening baselines and encryption settings. Detection coverage and exclusions are documented, and response runbooks describe how hosts are investigated and isolated.
Deliverables
- Endpoint inventory and coverage report
- Policy and baseline documents
- Deployment and rollback plan
- Alert-handling runbook
- Monthly health report
Common questions
How do the agent and the cloud console work together?
A lightweight agent on each device sends telemetry to the cloud console, which pushes prevention, device-control and hardening policies back to it. Analysts use the same console to investigate and respond, so policy, detection and response are managed from one place across laptops, desktops, servers and mobile devices.
What does EDR record that antivirus does not?
EDR records process, network and file activity over time, so analysts can trace how a threat started, what it touched and how it spread, not just whether a file matched a known signature. This history is what makes investigation, scoping and root-cause analysis possible after something has got past prevention.
How are devices hardened?
Devices are configured to security baselines, with application control, USB and device control, and disk encryption through BitLocker or FileVault. Patch and configuration compliance is tracked per device, so drift from the baseline is visible and can be corrected before it becomes an entry point for an attacker.
How are compromised hosts contained?
Analysts can isolate a host from the network remotely while keeping it reachable by the console, then remediate it. This stops lateral movement and data exfiltration while the investigation continues, and the device can be returned to service once it is clean, without anyone having to collect it physically.