Endpoint Security · Managed Service
Service group: CybersecurityEndpoint protection that someone actually maintains
We deploy, configure and look after the security software on your laptops, desktops and servers, keep its policies consistent, confirm every device is reporting, and act on the alerts it raises during agreed hours.
At a glance
- Service
- Recurring managed endpoint protection for covered Windows and macOS devices and Windows servers
- Best suited to
- Canadian organizations of roughly 5 to 200 employees that need consistent device protection without an internal security administrator
- Core inclusions
- Agent deployment, policy configuration, protection health checks, alert review in agreed hours, device isolation when warranted and monthly coverage reporting
- Not included by default
- Endpoint licences, after-hours alert handling, forensic investigation and support for unmanaged personal devices
- Pricing basis
- Per covered device per month; proposed figures are confirmed in a written quotation
- Regions
- Delivered remotely across Canada; on-site help in Metro Vancouver, the Fraser Valley and Calgary confirmed per address
- How to start
- Order an Endpoint Security Assessment or estimate costs with the endpoint security calculator, then confirm scope
What managed endpoint security is
Endpoint security is the protection that runs on each computer and server: antivirus and anti-malware scanning, behaviour monitoring, exploit and ransomware protection, host firewall and device control. Managed endpoint security means a provider owns the outcome of that software being present, configured and working on every device in scope.
The software itself is only part of the job. Agents stop reporting, exclusions get added during troubleshooting and never removed, tamper protection gets turned off, and new laptops arrive without protection. Our service is the routine work that catches those problems: deployment, policy management, health monitoring, alert triage and reporting.
This page describes the managed service. If you want to understand what endpoint detection and response can and cannot see, see our Endpoint Detection and Response page; if your organization runs Microsoft Defender, our Defender management service covers that platform specifically.
Common endpoint protection failures
Devices with no protection at all
New hires, replacement laptops and rarely used machines are set up quickly and never receive the agent, so the console shows fewer devices than the business owns.
Protection that stopped reporting
An agent was installed years ago, its definitions are stale and nobody noticed because nobody was watching the management console.
Overly broad exclusions
Whole folders or drives were excluded from scanning to fix a slow application, creating a blind spot an attacker can use.
Alerts no one reads
Detection emails go to a shared mailbox or a former employee, so a quarantined threat or a blocked ransomware behaviour is never followed up.
What we manage on each device
Deployment and coverage
Agents deployed through Intune, group policy or our management tools, with coverage reconciled against your device inventory every month.
Policy configuration
Real-time protection, cloud-delivered protection, tamper protection, potentially unwanted application blocking and attack surface reduction rules set to a documented baseline.
Exclusion governance
Exclusions are kept narrow, justified in writing and reviewed periodically instead of accumulating silently.
Health monitoring
Devices with outdated definitions, disabled protection or missed check-ins are flagged and fixed as routine maintenance.
Alert triage and containment
Detections are reviewed during agreed hours; where the platform supports it we isolate a device from the network, run scans and coordinate cleanup or reimaging.
Coverage reporting
A monthly summary of protected devices, gaps, notable detections and recommended actions written for a non-technical reader.
What the service covers
Covered devices and alert review hours are listed in your proposal.
Typically included
- Endpoint agent deployment on covered Windows and macOS computers and Windows servers
- Baseline protection policy configuration and change management
- Monthly reconciliation of protected devices against your inventory
- Health remediation for agents that stop reporting or fall out of date
- Alert review and initial containment during agreed business hours
- Coordination of malware cleanup or device reimaging
- Monthly coverage and detection report
Requires separate scope or quotation
- Endpoint protection licences, unless supplied through a quoted bundle
- After-hours or weekend alert response, unless written into your plan
- Forensic analysis, threat hunting or breach investigation
- Personal devices that are not enrolled in management
- Mobile threat defence for phones and tablets unless specifically scoped
Platforms we work with
We prefer to manage what you already license where it meets your needs.
- Microsoft Defender Antivirus and Microsoft Defender for Business
- Microsoft Defender for Endpoint Plan 1 and Plan 2
- Established third-party endpoint protection platforms already in place
- Microsoft Intune for policy deployment and device compliance
- Windows 10 and 11, macOS and Windows Server
- Remote monitoring and management tooling for health checks
Who this is for
Teams with mixed or unknown coverage
Organizations that are not sure every device is protected, or that run several antivirus products bought at different times.
Businesses with remote and hybrid staff
Teams whose laptops rarely visit the office and need protection managed over the internet rather than the office network.
Organizations with insurer requirements
Businesses asked by insurers or clients to show that endpoint protection is deployed and monitored on all company devices.
Benefits for your business
- Confidence that the number of protected devices matches the number you own
- Consistent settings across every laptop rather than whatever was set at purchase
- Detections followed up by a person instead of an unread email
- Faster containment of an infected device during agreed hours
- Clear monthly evidence for insurers, clients and leadership
- Predictable per-device cost that scales as you hire
How we onboard your devices
Inventory and assessment
We compare your device list with what each security console reports and note unprotected or misconfigured machines.
Platform decision
We recommend keeping, upgrading or replacing your current protection based on licensing, features and manageability.
Staged deployment
Agents and policies roll out to a pilot group first, then to everyone, with conflicting legacy products removed cleanly.
Tune and document
We adjust policies to reduce false positives, record approved exclusions and document the baseline.
Ongoing management
Health checks, alert triage and monthly reporting continue under your agreed scope.
Ways to buy
All recurring services are confirmed by written quotation before billing starts.
Managed Endpoint Security subscription
Per-device monthly management for organizations that already know which devices need coverage.
Endpoint Security Assessment
A one-time review of coverage and device security settings, useful before choosing a platform.
Part of a managed IT package
Endpoint security can be bundled with help desk, patching and Microsoft 365 administration.
Frequently asked questions
Is Microsoft Defender good enough, or do we need another product?
For many organizations already licensed for Microsoft 365 Business Premium, Defender for Business is a capable platform when it is configured and monitored properly. We recommend a third-party product only when a specific requirement justifies the extra cost and complexity.
Will endpoint security stop ransomware?
It significantly improves your chances of blocking or containing common ransomware behaviour, but it is one layer. Patching, MFA, email filtering and tested backups are equally important, which is why we treat endpoint protection as part of a wider programme.
Do you respond to alerts overnight?
Alert review takes place during the hours in your scope. Automatic protections such as blocking and quarantine keep working at all times, but human review outside those hours is only available if written into your plan.
Can you protect servers as well as laptops?
Yes. Windows servers in scope receive server-appropriate policies, with exclusions for databases or line-of-business software agreed with the vendor where needed.
How is it priced?
Per covered device per month. The endpoint security calculator shows proposed figures, and your written quotation confirms the final price, including any licences we supply.
Related services
Products and packages
Industries we support
Service areas
Check whether every device you own is protected
Start with an endpoint review or estimate per-device costs. You will receive a written scope before any recurring commitment.