Detect suspicious activity
Monitor managed computers for signs that something may need attention.
Endpoint detection and response
Watch for threats on your computers.
Watch for threats on your computers.
Have someone ready to respond.
Endpoint Detection and Response (EDR) helps identify suspicious activity on managed computers and supports investigation and response. Included in Protect, Maintain and Manage, alongside security monitoring that runs around the clock.
What is EDR?
Device protection with detection and response.
An endpoint is a device such as a laptop or desktop computer. EDR looks for activity that may indicate a threat and gives security teams information to investigate and respond. It works alongside email security, software updates and account protection.
An example you can recognise
The attachment that did more than open a document.
A staff member opens an attachment they believed was an invoice. Behind the document, a program starts behaving unexpectedly. The computer may still appear to work normally.
Illustrative scenario, not a customer incident or a guarantee that every threat will be detected.
How it helps
From a device alert to a response.
Investigate the alert
Use the available device information to understand what happened and what needs a response.
Act on threats
Stack2 security monitoring runs 24/7 and acts on threats around the clock. Response arrangements are confirmed during onboarding.
How the protection fits together
Devices, accounts and access each need attention.
| Protection | The question it helps answer | Included in |
|---|---|---|
| Endpoint Detection and Response (EDR) | Is there a threat on a managed computer? | Protect, Maintain and Manage |
| Identity Security Posture Management (ISPM) | Are account settings or permissions creating weaknesses? | Protect, Maintain and Manage |
| Identity Threat Detection and Response (ITDR) | Is a business account showing signs of misuse? | Maintain and Manage |
| Backup monitoring | Did the backup run, and does a failure need attention? | Every plan; backup storage and software are separate |
Working with Stack2
Make device security part of everyday IT.
Confirm the devices in scope
Every plan covers one computer per person. We confirm your devices and appropriate security configuration during onboarding. Tell us about additional computers or servers so their coverage can be agreed.
Keep protection and maintenance together
EDR, device monitoring, patching and updates are included in the managed security foundation across all three plans.
Understand the support arrangements
Security monitoring runs 24/7. General helpdesk support is Monday–Friday, 9am–5pm. Maintain and Manage include unlimited remote support during business hours; Protect support is billed at $198/hr.
Your managed IT plan
Included in Protect, Maintain and Manage.
EDR is included in Protect ($69), Maintain ($149) and Manage ($199) per user per month, including GST. Every plan also includes ISPM. Maintain adds ITDR and unlimited remote support during business hours. Manage adds security planning, governance and project ownership.
One computer per person. Month to month, no fixed term and no minimum team size — we ask for 90 days' notice to cancel.
See plan inclusions and pricingBuild a broader security plan.
Understand ISPM
Review the identity settings and permissions that affect who can access your systems.
Explore ISPMUnderstand ITDR
Learn about detection and response for threats targeting business accounts.
Explore ITDRPlan for recovery
Understand backup monitoring and the separately arranged backup services your business needs.
Explore backup and recoveryYour EDR questions, answered.
Which plans include EDR?
EDR is included in Protect, Maintain and Manage as part of the managed security foundation. Each plan covers one computer per person; additional devices are agreed separately.
Does EDR guarantee that we cannot be hacked?
No. EDR helps detect and respond to device threats. It works alongside other controls and cannot guarantee that every attack will be prevented or detected.
Does 24/7 security monitoring mean the helpdesk is always open?
No. Security monitoring runs and acts on threats around the clock. General helpdesk support is Monday–Friday, 9am–5pm.
Does EDR replace backups?
No. Backup monitoring is included in every plan, while backup storage and software are separate. Discuss recovery requirements alongside device protection.
How is EDR different from ITDR and ISPM?
EDR focuses on threats on managed devices. ITDR focuses on threats targeting business accounts. ISPM focuses on weaknesses in identity settings and permissions.
Will you automatically isolate a computer?
Available response actions depend on the security tools, device and agreed configuration. We confirm the response arrangements appropriate to your environment during onboarding.
Further reading: Microsoft's explanation of endpoint detection and response.