Anti-Virus

Antivirus asks one question: does this file match something already known to be malicious? That works against commodity malware but misses attacks that use legitimate system tools, stolen credentials, or malicious activity that never touches disk as a file at all.

Endpoint detection and response (EDR) asks a different, harder question: is this behaviour normal for this device and this user? It watches process activity, network connections and file changes continuously, flags anomalies, and lets a security team investigate and contain a threat on one device before it spreads to others.

Microsoft Defender for Endpoint is the standard platform Fresh Mango deploys for Microsoft 365 business clients. It provides antivirus, EDR, attack surface reduction rules, and a central dashboard that shows the health and threat status of every managed device in one place, rather than each machine reporting in isolation.

Because it is built into Microsoft 365, it also correlates signals across email, identity and endpoint — for example, linking a suspicious sign-in with unusual activity on the same user's laptop — which a standalone antivirus product cannot do.

Software alone does not respond to an alert at three in the morning; a person or process has to. Managed detection and response (MDR) pairs the EDR platform with a team that triages alerts around the clock, investigates genuine incidents and takes containment action — isolating a device from the network, for example — before damage spreads.

For most Fresh Mango clients this sits with our specialist practice at Complete Cyber Security, which handles alert triage and incident response so a genuine threat is acted on immediately rather than waiting for the next business day.

The majority of successful attacks exploit a vulnerability for which a patch already existed. Endpoint protection and patch management have to run together: Microsoft Defender for Endpoint reduces what gets through, while disciplined operating system and application patching closes the doors attackers most often use.

• It cannot see attacks that use legitimate tools already on the system (so-called living-off-the-land techniques).
• It has no central visibility, so a compromised device is only found when it causes a visible problem.
• It reacts after the fact rather than flagging suspicious behaviour as it happens.
• It does nothing to correlate an endpoint alert with a suspicious email or sign-in elsewhere in the business.
• Vendors increasingly build EDR into the same licence, so paying for signature-only antivirus is often paying for less at the same price.

• Deploy Microsoft Defender for Endpoint (or an equivalent EDR platform) on every managed device, not just servers.
• Pair endpoint protection with disciplined, monitored patch management.
• Arrange managed detection and response so alerts are triaged around the clock, not only during office hours.
• Enable attack surface reduction rules to restrict what legitimate applications are allowed to do.
• Review endpoint alerts and trends monthly, not only when something visibly breaks.
• Isolate and investigate compromised devices immediately rather than simply re-imaging and moving on.

• Anti-Spam & Email Securitythe email-side security layer alongside endpoint protectionRead more
• Cyber Security Servicethe wider security service endpoint protection sits withinRead more
• Ransomware and What to Do About Ithow EDR helps detect and contain ransomwareRead more
• Managed IT Serviceshow endpoint protection is deployed and monitored as part of managed supportRead more
• Complete Cyber Securitymanaged detection and response and incident escalationRead more