Antivirus that watches behaviour, not just files.
Traditional antivirus looks for known bad files. Endpoint detection and response (EDR) also watches what's happening on a device - suspicious scripts, unusual processes, ransomware-like behaviour - and helps stop it. We deploy Microsoft Defender for Business on every managed device and monitor it in support hours.
Uses Microsoft Defender for Business, included in Microsoft 365 Business Premium, which every plan requires.
How it works
Deploy
Defender is switched on through device management, so every enrolled device is covered.
Harden
We apply our standard protection settings, including tamper protection and attack surface reduction rules.
Watch
Alerts come to us. Many are investigated and resolved automatically. The rest we review in support hours.
Contain
If a device is compromised, we isolate it, reset affected passwords and end sign-in sessions. Containment in support hours is included on every plan.
Where it helps
Real situations this covers for businesses like yours.
Someone opens a malicious attachment
Defender blocks it or flags the behaviour, and we check the device and the account it was used with.
Ransomware-like activity starts
Behaviour monitoring is designed to catch it early. We isolate the device and start the clean-up.
The insurance form asks about EDR
More and more cyber insurers ask whether you run EDR. On every plan, the answer is yes.
You pay for Business Premium but never set up Defender
Very common. Business Premium includes Defender for Business. We switch it on and configure it properly.
Which plans include it
Prices exclude VAT. Plans require Microsoft 365 Business Premium (or equivalent), billed separately at Microsoft's list price - we manage and right-size your licences. See full pricing.
Common questions
Is Microsoft Defender good enough for a business?+
Defender for Business adds central management, EDR and automated investigation on top of the antivirus built into Windows. Properly configured and monitored, it's enterprise-grade protection.
Is it monitored 24/7?+
On Essentials and Complete we respond to alerts in support hours (9am-5pm, Monday to Friday). Secure+ adds 24/7 managed detection and response.
Do we still need our old antivirus?+
No. We remove old antivirus products during onboarding so Defender runs as the main protection.
Does it protect Macs and phones too?+
Yes. Defender for Business covers Windows, macOS, iOS and Android devices.
What happens if a device is infected?+
We contain it in support hours at no extra charge: isolating the device, resetting passwords, ending sign-in sessions and blocking senders. Investigation and recovery after that are charged or quoted, except on Secure+, which includes up to 8 hours a year.
Works alongside
Want this looked after for you?
Free Microsoft 365 security audit - Cancel anytime in your first 3 months