Endpoint and network security, managed monthly

What this actually solves

You do not have an IT person, or you have one and they were already at capacity long before this. Then two things arrive in the same month. Your insurer's renewal form asks what endpoint protection is deployed and how patching is managed. Your largest customer sends a vendor security questionnaire with a section on device controls. Neither question can be answered from memory, and neither will accept a shrug. What is being bought here is not really software. It is somebody accountable for the answer, in writing, on a predictable date.

The gap in a small company is almost never that the tools were never purchased. It is that nothing checks whether the tools are still doing their job. An endpoint agent stops checking in after an operating system upgrade and nobody notices, because a silent agent and a quiet month look identical from the outside. A patch cycle fails on the one laptop that is always shut at six. A backup runs nightly for years and has never once been restored, so nobody has discovered that it captures files but not the database. Managed security is mostly the discipline of finding those three things before an incident finds them for you.

What we do, and in what order

The first month is a different piece of work from every month after it, and the pricing reflects that. Onboarding builds the picture; the monthly cycle keeps it true.

1. Count the estate before touching anything. Every laptop, desktop, phone and server that touches company data — who holds it, what it runs, whether disk encryption is on, whether it locks itself. Devices nobody remembered are normal at this stage, and they are usually the interesting ones. Two to four days.
2. Onboard the controls. Endpoint detection deployed and confirmed reporting — Microsoft Defender for Business where the company already pays for Microsoft 365 Business Premium, Huntress on smaller mixed fleets, CrowdStrike or SentinelOne where your own customers demand a named vendor. Patching moved onto one system rather than four — NinjaOne, Action1 or Microsoft Intune. Disk encryption on, screen lock policy applied, backup job configured, and the existing firewall reviewed and documented instead of replaced. One to two weeks.
3. Prove the backup by restoring it, with a stopwatch running. Rebuild onto a clean, empty target from the backup alone, without touching the live system, and time it. Write down every point where it stalled — the database password nobody had, the config file that needed editing, the step where the domain had to be repointed. Those stalls are the actual content of your recovery runbook, and the elapsed time is a number you can give your insurer. Half a day to a day per system, in the first month and then repeated on a schedule.
4. Run the monthly cycle. Patch report reviewed device by device, alerts triaged, one restore test, joiners provisioned and leavers removed in the same week they leave, and a short written report that a non-technical owner can finish in one sitting. One to two days a month, depending on the size of the fleet.
5. Respond between cycles. Alerts get a written containment sequence agreed before anything happens, not invented at eleven at night. The first instruction in every one of them is to preserve evidence before wiping, reinstalling or cleaning, because a tidy machine is an unreadable one. Within the response window written into the contract.
6. Review every quarter. Licence drift, devices that left the company without anyone telling us, accounts that outlived their owner, and one page on what is getting worse and what decision it needs from you. Half a day.

There is one test worth knowing about, because it is the fastest way to settle the "we already have antivirus" argument in front of a room. The EICAR test file is a harmless, inert line of text that antivirus products are built to flag on sight — it exists for exactly this purpose and does nothing at all. Download it onto a machine that is supposedly protected. If it is caught instantly, good. If it lands quietly in the Downloads folder, nothing on that device is actually running.

What moves the price

The range is $500–$5,000/mo and the engagement is ongoing rather than a fixed term, so the monthly number has to be right on month twelve as well as month one. Three things set it.

How many devices, and whether the network is in scope. The bottom of the range is a single small office where the estate is entirely company laptops and the work is endpoints only. The top is a fleet across several sites with servers, firewalls and network configuration managed as well, where onboarding alone takes weeks and the monthly cycle is a real recurring workload rather than an afternoon.

The response window you actually need. A defined business-hours window and a tighter, out-of-hours commitment are two different services and cost accordingly. We would rather sell you the honest smaller one than write a promise that fails on its first bad night, so this is a conversation we have at proposal stage and not after.

Whether identity and offboarding sit inside the retainer. Joiners and leavers, shared vaults, MFA enrolment and the account clean-up that follows a departure are ongoing work with a real time cost. Some clients keep that with HR and only want the device side; others hand over the whole thing. It is a genuine fork in the price.

What usually goes wrong

An SLA is written that cannot actually be met. "One hour response, 24/7" is easy to type into a proposal and is the single most common way this arrangement ends. It does not fail gradually; it fails on one specific night when nobody answers, and every good month before that stops counting. The fix is unglamorous — write the window you can genuinely honour, state plainly what falls outside it, and price the tighter one properly if it is really needed.

Tool licences get buried inside the monthly fee. It looks cleaner on the invoice and it is a slow trap. Vendors raise per-seat pricing, the fleet grows by devices nobody mentioned, and some months later the account is quietly losing money — at which point you either eat it or reopen a price conversation from a weak position. Licences billed at cost, in your own tenant where possible, keeps that visible for everyone.

Offboarding is treated as an HR task. Someone leaves on a Friday, their manager tells payroll, and nobody tells the person who administers the accounts. Weeks later their mailbox still receives, their device still syncs company files, and their credentials are still valid in a system that was never on anybody's list. This is the most common real exposure in a small company and it is created by a process gap, not a technical one — which is why leaver removal belongs in the monthly cycle with a date against it, not in an inbox.