Defend
Device protection
Every laptop, workstation and server your firm runs is enrolled, kept to a documented baseline and watched for threats, so a device is as protected on the road as at the desk.
A device is where a client file is actually open.
Sign-in rules decide who gets in. The device is where the file is then open, downloaded, printed and carried out of the office. So every laptop, workstation and server your firm runs is managed from one place: enrolled, so we know it exists; encrypted, so a lost one is a lost box and not a lost file; patched and configured to a written baseline, the same on every machine; and watched for the signs of an attack. Protection and threat detection run on every device, and because the team that runs the device also protects it, nothing falls through a handover. What that looks like differs by platform: a laptop, a CAD workstation that must not slow down, a server.
What we set up
Enrolled, encrypted, to one baseline, watched.
The same four things on every device, so there is no machine nobody knows about and no setting that depends on who set the device up.
-
Enrolled, every one
A device that isn’t on the list is the one nobody patches. Every device is enrolled in management, and the list is compared against the directory and the protection console, so a machine that slipped through turns up.
-
Encrypted from the first day
Every laptop and workstation is encrypted before it holds a client file, with the recovery key stored centrally, never on a sticker. A lost device is a lost box, not a lost file.
-
One documented baseline
What a device must look like is written down once: the protection, the settings, the software, what the user may change. Every device is held to it, and a change to the baseline is a decision on record, not a setting someone adjusts.
-
Protection and threat detection
Managed protection runs on every device and reports to one place. What it finds is reviewed by our engineers, and what we change because of it goes into your evidence file.
-
Patched from one place
Operating systems and applications are kept current from one place, in waves that start with a pilot group, so a bad update reaches a few devices and not the whole firm.
-
Wiped when it leaves
A lost device, a leaver’s laptop, a machine going back to the leasing company: company data is wiped remotely, and the wipe is on record with its date.
By platform
Where it runs.
The baseline is one. How it is applied differs: a laptop managed through Intune, a CAD workstation that must stay fast, a server on the premises or in Azure.
On record
In your evidence file.
- Every device with its protection, encryption and patch level
- The baseline as it is written, and when it was last reviewed
- The exceptions, each with its reason, its owner and its date
- The wipes: which device, when, why
- What the detection found, and what we changed because of it
The insurer’s questions about endpoint protection and encryption get answers with a date, not a guess.
What usually goes wrong without it.
-
The device nobody enrolled
The conference-room PC, the old laptop in a drawer, the machine set up in a hurry: not on the list, so not patched, not encrypted, not watched. After a provider change, three lists have to be compared: management, protection, directory. The device missing from one is the one nobody patches.
-
Protection that depends on the user
A setting the user can change is a setting someone changes before a deadline. Protection that can be switched off from the keyboard isn’t protection.
-
Encryption without the key
The laptop is encrypted, the recovery key was on the laptop. After a failed update, the files are as gone as if the device had been stolen.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Will the protection slow our machines down?
On an ordinary laptop, no. On a CAD workstation it can, if it scans the wrong folders at the wrong moment, which is why workstations get their own page and their own exceptions: decided deliberately, written down, reviewed.
What happens when a laptop is lost or stolen?
Tell us. The device is encrypted, so the files on it can’t be read. We wipe the company data remotely as soon as it comes online, revoke its sign-ins, and the whole thing goes into your evidence file with its date.
Can our people use their own laptops or phones?
A private device gets as far as the sign-in page, and no further: conditional access only lets managed devices open client files. Where a phone is needed, it is enrolled, so the company data on it can be wiped without touching private photos.
Which protection products do you use?
We name them in your contract, not on our website: a published list would tell attackers what to look for. In your evidence file you see what protects each device.
Start
Which devices in your firm are on no list?
In a first call we go through every kind of device your firm runs, what protects them today, which ones are encrypted, and what a documented baseline would change.
- No first level
- No surprises
- Pilot before you buy