Detection, response and hardening for New York firms
Insurance renewal forms now ask which tools watch your endpoints, what share of your assets they cover and who acts when an alert fires. This service is built to answer those questions in writing. It is for firms of 20 to 250 people in New York and the Tri-State area that answer to an insurer or a regulator. If you do not have those insurance or regulatory requirements, you may not need this level of coverage.
Four parts of the service
Detection and response
EDR on laptops and servers, with Entra ID sign-in logs, email events and firewall logs collected in one place and kept for as long as your obligations require. You authorize in writing, up front, which containment steps we may take on our own, such as isolating a machine or disabling an account, so nothing waits for a meeting when a rule fires.
Vulnerability management
Authenticated scans on a regular schedule. Findings are ranked by whether they can be reached from the internet and passed to patching, and each one is closed as fixed or recorded as an accepted risk.
Email and identity
Microsoft 365 mail hardening, with DMARC moved to enforcement once your mail flow is mapped. Conditional access, separate admin accounts and legacy authentication turned off, so a stolen password alone is not enough to sign in to Microsoft 365.
Awareness and phishing simulation
Short recurring training and simulated phishing emails, with completion records you can hand to an insurer or an examiner.
What monitored means here
Monitoring is continuous; staffing is not, and we say so. The tooling runs around the clock. The containment steps you authorized in advance run the moment a rule fires, and the engineer is paged when a detection crosses the threshold we agreed with you. A page is not the same as an engineer already working the problem, and only staffed coverage around the clock removes that delay. So the agreement automates what cannot wait and puts both the automated steps and the escalation path in writing. If a detection turns into an incident, the same engineer runs containment, keeps the written timeline and works with your attorney and your insurance carrier. How we work covers the full process. Managed IT and Cloud & network are scoped in the same agreement.
Walk through your coverage with the engineer
On a call, the engineer goes through your environment source by source, from endpoints to identity to email to the firewall, and tells you what is not being watched. The assessment writes those gaps into a register you can hand to your insurer.