Full response authority, plus quarterly phishing simulation
Everything in Endpoint MDR Essentials, plus the SOC acting on your behalf: isolating endpoints, disabling accounts, purging malicious mail and blocking indicators directly, within the authority you grant in writing.
What you get
- Everything in Essentials — 24/7 monitoring, analyst triage, mailbox threat handling, weekly reporting, monthly tuning.
- Full response authority — we act rather than advise, within your documented scope.
- Quarterly phishing simulation — a simulated campaign each quarter with per-department results and a short remedial module for anyone who clicks.
- Incident timeline — confirmed incidents get a written timeline and remediation plan with owners and dates.
- Monthly executive summary — a leadership-readable page alongside the technical detail.
Response authority — the default matrix
- Act immediately, notify after — isolate a workstation; disable a standard user account and revoke sessions; purge a malicious message from all mailboxes; block sender, domain, IP or hash.
- Call first — disable a privileged or service account.
- Explicit approval required — anything affecting production availability.
Agreed and signed at kickoff, reviewed quarterly.
What is not included
- Any guarantee of prevention or financial warranty against breach outcomes.
- Remediation labour, rebuilds and restores.
- Server, network, cloud workload and OT coverage.
- The full managed awareness program — quarterly simulation is included here; continuous training and risk scoring is a separate program.
- Forensics intended for litigation or insurance claims.
Your first 30 days
- Day 0–2 — kickoff; scope, contacts and response authority matrix agreed and signed.
- Day 3–7 — endpoint agent and mailbox connector deployment; coverage verified.
- Day 8–14 — baseline period in notify-only mode.
- Day 15–18 — authority walkthrough plus a two-scenario tabletop.
- Day 19–30 — active response switched on; baseline phishing simulation scheduled.
Billed monthly. No minimum term. Cancel any time before your next renewal date.