Managed Protect
Managed EDR, XDR and MDR
If your endpoint tool raises alerts that nobody has time to read, it isn't protecting you. We run it, act on what it finds, and add 24/7 cover if you need it.
- Cover
- 9×5in house; 24/7 MDR as an option
- Platforms
- Win · Mac · Linuxdesktops, laptops and servers
- Response
- Isolatecontain the device, then call you
- One team
- MSSPalso runs your SOC, firewall and email
01 / The problem
A tool that alerts isn't a tool that responds.
Ransomware starts on a device
A laptop or server is usually where an attack takes hold. Old antivirus looks for known files and misses the rest.
Alerts go unread
EDR raises alerts all day. Without someone to triage them, the real one waits until Monday.
Spotting it is half the job
Someone has to isolate the device and kill the process. Out of hours, that someone is usually nobody.
02 / What’s included
Prevention, detection and people to act.
Next-generation antivirus
Blocks malware, exploits and suspicious behaviour on Windows, macOS and Linux, with device control.
EDR
EDR (endpoint detection and response) records what happens on each device, so we can spot and investigate attacks that get past prevention.
XDR
XDR (extended detection and response) links endpoint data with identity, email and cloud signals, so one attack shows as one incident.
MDR
MDR (managed detection and response) puts analysts behind the tools: triage, investigation and containment. Our team covers UK working hours; for 24/7, the EDR vendor's MDR team covers out of hours, managed by us.
Policy management
We set and maintain endpoint policies, exclusions and device groups so protection is consistent.
Monthly reporting
Detections, actions taken, device health and the changes we recommend, in plain English.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From rollout to response.
- Assess We review your devices, current protection and risk, and agree response playbooks.
- Deploy Agents go out in stages, configured to best-practice policies, with old antivirus removed.
- Tune We cut out noise from your normal software so real alerts stand out.
- Watch and respond We triage, investigate and contain, with partner cover out of hours if you take 24/7, and report monthly.
An alert is only useful if someone acts on it. We make sure someone does.
How ITB runs MDR
04 / Why ITB
EDR, XDR, MDR: what you actually need.
EDR is the tool on each device. XDR joins it up with email, identity and cloud. MDR is the people who act on what they find. Most businesses need all three, and few can staff the third. Our in-house cover is priced for SMEs; 24/7 MDR is there when the risk calls for it.
| What it takes | Do it yourself | With ITB |
|---|---|---|
| Choosing and deploying EDR | Your team, alongside the day job | Done by us, in stages |
| Triage | Your team, when it has time | Our UK team, in working hours |
| Out-of-hours response | A rota of at least [x] people | Optional 24/7 MDR through our partners |
| Containment | Whoever is awake | Agreed playbooks, carried out by us |
| Linking endpoint, email and identity | Several consoles | XDR, run by the same team |
| Reporting | Pulled from the console | Monthly report |
· 05 / Questions
EDR, XDR and MDR, plainly answered.
Q01 What's the difference between antivirus and EDR?
Antivirus blocks known bad files before they run. EDR records what happens on the device, so it can catch and investigate attacks that look normal at first.
Q02 What's the difference between EDR, XDR and MDR?
EDR watches endpoints. XDR adds email, identity and cloud data, so attacks are seen across systems. MDR is a service: people who watch those tools and respond for you.
Q03 What do you do when you find something?
We isolate the device from the network, stop the malicious process and investigate. Then we call you, using playbooks you approve at onboarding.
Q04 Do you offer 24/7 MDR?
Yes, as an option. Our in-house team covers UK working hours (9×5, extended 8×8 where we can). For 24/7, the EDR vendor's own MDR team covers nights and weekends, and we stay your point of contact.
Q05 Can this work alongside our IT support?
Yes. Your IT team or MSP keeps day-to-day device management. We handle the security tooling, monitoring and response.
Q06 Do you handle patching too?
Patching is a separate service, Vulnerability & Critical Patch Management. Most clients take both, because fewer holes means fewer alerts.
Related services
Managed SIEM / SOC
Wider monitoring across logs, network and cloud.
See the serviceVulnerability & Critical Patch Management
Closes the holes attackers use to reach the endpoint.
See the serviceIRaaS
For incidents that need more than isolating a device.
See the serviceEmail & Collaboration
Stops most malicious attachments before they reach a device.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]