Protecting the machine itself, and reading the alerts it raises

Classic antivirus recognises known files by signature. EDR watches behaviour on the endpoint — which processes ran, what they tried to change, where they connected — so it catches attacks nobody has seen before and lets you investigate what happened after the fact. For most organizations the right answer is not to choose, but to deploy a platform that does both.

ILS Networks is an official partner of Sophos, ESET and SentinelOne. The choice between platforms comes from the environment: workstation and server counts, the operating systems actually in use, regulatory requirements, and who operates the system day to day.

Servers too. A policy that covers only workstations leaves the layer that actually holds the data exposed. Deployment is planned so workstations, servers and virtual environments run under the same policy and the same management.

The endpoint layer and the network layer should tell the same story. We design them together — segmentation in the network, firewalls at the edge and endpoint protection inside the machine — so an incident looks the same from both angles instead of falling between them.

EDR is the platform — what runs on the machine, spots unusual behaviour and lets you investigate it. MDR is somebody running that platform for you. In our MDR service we deploy the platform (Sophos or ESET), set and tune the policy, and wire its alerts through to us — so when something fires we know immediately and act on it: isolate the machine, work out what happened, clean up and close the hole. Without that, EDR is a licence nobody reads.

No, and we would rather say so up front. We do not staff a manned security operations centre with analysts on shifts. What we do have: detection running continuously on the platform, alerts wired to reach us the moment they fire, and support that acts on an incident. In practice we know about a real incident immediately. If your organization is required to have a manned SOC — by regulation or by a customer — we will tell you that in the first conversation rather than sell you something else.

That is agreed up front. At some clients the internal team operates it and we advise; at others operation is part of our managed IT service or of our MDR service. What matters is that someone is defined as watching the alerts — an EDR nobody reads is a licence, not a defence.

Yes. ILS Networks is an Israeli IT infrastructure company, and an official partner of Sophos, ESET and SentinelOne.

Antivirus recognizes a malicious file it already knows; EDR watches behaviour on the endpoint and catches attacks never seen before — a process encrypting files, a legitimate tool used for intrusion, an unusual outbound connection. EDR also keeps the telemetry needed to reconstruct what happened afterwards. We deploy ESET and SentinelOne at this layer.

Not on its own. Endpoint protection detects and stops a great deal, but a full ransomware scenario is contained by several layers together: segmentation that stops lateral spread, access control that limits privilege, backup with a copy that cannot be deleted from the compromised machine, and a restore test proving the backup works. We build those layers together rather than separately.