Recommended Technology Platform

Consumer-grade antivirus is not approved on managed devices. Business antivirus must include centralised management, policy enforcement, real-time threat reporting, and integration with the remote monitoring platform. All managed endpoints are covered under our standard deployment.

Antivirus alone does not detect fileless attacks, lateral movement, or living-off-the-land techniques. EDR provides behavioural analysis, threat hunting, and automated containment. All managed devices require an active EDR agent integrated with our security operations centre for human-reviewed incident response.

All managed devices must have full-disk encryption enabled. Windows devices use BitLocker (requires Windows 11 Pro and TPM 2.0). Mac devices use FileVault 2. Encryption keys are escrowed centrally so lost or stolen devices can be remotely wiped and key recovery is available to authorised staff.

Operating system and third-party application patches are deployed automatically via the remote monitoring platform. Security patches are applied within 14 days of release in line with the ASD Essential Eight Maturity Level 1 baseline. Devices outside the patch window are flagged and reported monthly.

All managed Windows and Mac devices must be enrolled in the MDM platform. Enrolment allows security baselines to be enforced, software to be deployed remotely, certificates to be managed, and remote wipe to be performed if a device is lost or stolen. Unenrolled devices cannot be supported under a managed services agreement.

All managed devices run a lightweight RMM agent that monitors system health, disk usage, backup status, antivirus state, and patch compliance. This is how issues are detected and resolved proactively — often before staff notice anything is wrong.