Security Services

Antivirus, EDR, XDR and MDR: what's the difference in plain terms?

Traditional antivirus asks whether a file matches something known to be bad, and blocks it if so. That works against commodity malware and fails against anything novel or anything that does not involve a file at all, which describes most modern intrusions: attackers increasingly use legitimate administrative tools already present on the machine, so there is no malicious file to match.

EDR, endpoint detection and response, changes the question from what a file is to what a process is doing: it records behaviour on the endpoint, flags sequences that look like an attack even when every individual component is legitimate, and gives a responder the ability to isolate the machine.

XDR extends the same idea beyond the endpoint by correlating signals across identity, email, cloud applications and infrastructure. This matters because a real intrusion is a sequence, not an event: a phishing email, then a sign-in from an unusual location, then a mailbox rule that hides the attacker's replies, then access to a file share.

Reviewed separately, each is a low-priority alert somebody closes. Correlated, they are one obvious incident. MDR is the separate question of who is watching: a managed service where humans triage and respond, rather than a product that generates alerts into a queue. EDR and XDR are capabilities; MDR is staffing.

What do the five Cyber Essentials controls actually require?

Cyber Essentials covers five control themes, each with specific technical requirements rather than general aspirations. Firewalls: every device protected by a correctly configured boundary or software firewall, with default administrative passwords changed and no unnecessary services exposed. Secure configuration: remove or disable unused accounts and software, change default passwords, disable auto-run.

The requirement that catches most applicants out is the last one, because it applies to all software, not just operating systems, and because unsupported software is an automatic fail whether or not it is patched. Scope is the other stumbling block: home workers' devices, mobile phones used for work email and cloud services all fall in scope in ways organisations do not expect.

Certification is a self-assessment verified annually, and the question set is revised periodically, so answers that passed two years ago may not pass now. Cyber Essentials Plus adds independent technical verification: an assessor testing your actual devices rather than reading your description of them.

Why isn't MFA on its own enough any more?

Because attackers adapted. Multi-factor authentication remains the single highest-value control you can deploy and stops the overwhelming majority of password-based attacks, but three techniques now routinely defeat basic implementations. Adversary-in-the-middle phishing proxies the real login page, captures the session token after you have completed MFA, and replays it: the attacker never needs your password or your code.

MFA fatigue pushes repeated approval prompts until a tired user taps accept. And SIM swapping undermines SMS as a factor, which is why SMS is the weakest option still in common use.

Conditional Access is what turns authentication from a single gate into a policy decision. Rather than asking only whether the credentials are correct, it evaluates the whole context of the sign-in and applies the appropriate requirement or blocks it.

The highest-value policies are requiring a compliant or managed device for access to company data, blocking legacy authentication protocols that cannot enforce MFA at all, and requiring phishing-resistant methods such as passkeys or FIDO2 security keys for administrators. Every organisation should also keep excluded break-glass accounts with long unique credentials stored offline, because a policy that locks out every administrator is a self-inflicted outage that happens more often than anyone admits.

Why is email still the main way attackers get in?

Because it is the one system that must accept unsolicited content from strangers by design. Every other route can be closed; email cannot be. The attacks that succeed are rarely the crude ones. Business email compromise involves no malware at all: the attacker gains access to a mailbox, watches genuine conversations for weeks, then intervenes in a real invoice thread with amended bank details.

Because the message comes from a legitimate account, in an existing thread, with correct context, no technical control reliably distinguishes it from the real thing. Supplier compromise works the same way from the other end, which is why 'the email came from our supplier's real address' describes the attack rather than a defence.

On the process side, and this is the one that stops the loss: a bank detail change must be verified by telephone on a number already held on file, never a number from the email. Most successful invoice frauds would have been prevented by a single phone call.

Why is backup a security control rather than just an IT one?

Backups that are online, reachable from the same network and accessible with the same domain credentials as everything else are not a recovery position; they are simply more data waiting to be encrypted. The controls that matter are immutability, separated credentials that are not domain accounts, and at least one copy that is offline or logically isolated.

The second half is testing. A backup job reporting success proves that data was written, not that a business can be restored from it. Restore testing is the only evidence that matters, and it should answer specific questions: how long a full restore actually takes against the recovery time the business assumed, whether application-consistent restores of databases work, and whether the documentation needed to run the restore is itself stored somewhere that will survive the incident. Extortion has also shifted toward data theft as well as encryption, so backup solves availability but not confidentiality.

What does 24/7 threat management involve in practice?

It means three distinct things, worth separating when comparing providers. Monitoring is collecting and watching telemetry from endpoints, identity, email, cloud and network continuously. Detection is the analytics that turn that telemetry into a prioritised signal, which is where most of the engineering value sits, because raw alert volume from a modern estate is far beyond what any team can read.

Response is what happens next: triage to establish whether an alert is real, then containment actions such as isolating a device, disabling an account or revoking active sessions. A service that monitors and detects but escalates every decision back to a customer who is asleep has not solved the out-of-hours problem it was bought for.

The questions worth asking are therefore about authority and escalation rather than about tooling. Which containment actions can be taken without waiting for your approval, and which always require it? Who gets contacted at three in the morning, and what happens when they do not answer?

Is the underlying tooling yours or the provider's, and what happens to your historical telemetry if you change supplier? How long is data retained, and is that long enough for investigation given that attackers commonly dwell for weeks before acting?

Managed security services, MSSP, SOC-as-a-service: what do the labels mean?

They overlap enough to be genuinely confusing, so here is the plain version. A managed security service provider, or MSSP, is a company that runs some or all of your security controls for you rather than selling you the tools to run yourself.

SOC-as-a-service is narrower: the monitoring, detection and response function of a security operations centre, bought as a service instead of staffed in-house. Managed detection and response, or MDR, is SOC-as-a-service with the response part explicitly included rather than stopping at the alert.

The distinction that actually matters when you are buying is where the work stops. Some managed security services end at a dashboard and a monthly report, which leaves the hardest part, deciding what to do about an alert at two in the morning, exactly where it was. Ask what happens between detection and resolution, who is authorised to act, and what the response commitment is outside business hours. That answer separates providers far more reliably than any list of tooling.

What we do sits in that space and we would rather describe it than badge it: Microsoft 365 and Entra ID hardening, Defender deployed and tuned rather than left at defaults, 24/7 threat monitoring with response, email security, backup treated as a security control, and Cyber Essentials or Cyber Essentials Plus certification where you need to evidence it to a client or an insurer. If you are comparing us against an MSSP or a SOC-as-a-service provider, those are the same questions to put to us.

Where do most Microsoft 365 tenants have gaps?

The recurring findings are remarkably consistent. Legacy authentication protocols still enabled somewhere, which lets an attacker bypass MFA entirely. Global Administrator assigned permanently to more people than need it, often including a departed supplier. Guest accounts accumulated over years, with nobody able to say who invited them.

Third-party application consents granted by users, giving applications standing access to mail and files that survives a password reset. Mailbox auditing not fully enabled, so there is no record when an investigation is needed. Anonymous sharing links with no expiry, created years ago and still live.

None of these are exotic and all are visible to anyone who looks systematically. The reason they persist is not incompetence but drift: a tenant is configured correctly at a point in time, then absorbs three years of pragmatic exceptions and defaults that changed on Microsoft's side without anyone reviewing the impact.

Microsoft's Secure Score is a reasonable starting map but not a target to be maximised, because some recommendations do not fit every organisation and chasing the number rather than the risk produces controls that get switched off the first time they inconvenience someone senior.