Managed EDR/XDR with automation
Detection & response on your endpoints and servers (EDR/XDR), with automation. Managed, sovereign, per seat.
│ IN SERVICE
We manage · Kovant
- Deployment & tuning of the EDR agent (Windows, macOS, Linux)P01
- XDR correlation (endpoints, M365/Entra identity, network, SaaS)P02
- Automation playbooks (auto-isolate, block, notify)P03
- Threat-intelligence feedsP04
- Monthly detection reportP05
You manage · You
- P06Risk acceptance
- P07Allow-list sign-off
Shared
- Detection-threshold tuningP08
We manage · Kovant
- Deployment & tuning of the EDR agent (Windows, macOS, Linux)P01
- XDR correlation (endpoints, M365/Entra identity, network, SaaS)P02
- Automation playbooks (auto-isolate, block, notify)P03
- Threat-intelligence feedsP04
- Monthly detection reportP05
You manage · You
- Risk acceptanceP06
- Allow-list sign-offP07
Shared
Detection that acts, not just alerts
Beyond a simple antivirus, we correlate several sources — endpoints, identity, network, SaaS — to see the whole attack, then let automation contain the threat: isolating a machine, blocking an indicator, killing a process. Managed, sovereign, billed per seat.
We’re clear on scope: automation acts; 24/7 human watch is our SOC/MDR service.
- Behavioural detection
- XDR correlation
- Confirmed indicator
- Automation playbook
- Containment (isolate / block / kill)
Who it’s for
- SMBs that have outgrown basic antivirus — you want behavioural detection and automatic response, not just signatures.
- Teams with a mixed estate — endpoints, servers and SaaS to correlate in one view rather than in silos.
- IT-support clients moving up — you add an advanced security layer on the same contract and the same invoice.
Features included
- Multi-OS EDR agent (Windows, macOS, Linux), lightweight rollout via RMM
- Behavioural detection, not just signatures
- Multi-source XDR correlation (endpoints, identity, network, SaaS by tier)
- Automated response: auto-isolate, block indicator, kill process
- Guided remediation, then auto-remediationsignature
- Custom playbooks (n8n)signature
- Log retention from 30 days to 1 year by tier
- Monthly detection report, up to proactive threat huntingsignature
Security included
Frequently asked questions
How is EDR different from antivirus?
Antivirus recognises known threats by signature. EDR watches process behaviour and catches the unknown too, then lets you investigate and respond.
And EDR versus XDR?
EDR covers endpoints. XDR correlates several sources — endpoints, identity, network, SaaS — to reconstruct an attack that crosses multiple surfaces.
Doesn't auto-isolate cause false positives?
We start in dry-run mode, tune thresholds and maintain allow-lists before enabling automated response. False positives are managed, not endured.
Where is my data?
On our self-hosted infrastructure in the European Union. No data leaves the EU.
Do I also need a SOC?
Automation acts on its own for known cases. For 24/7 human monitoring and analyst-led incident response, see our SOC/MDR service.
Go further
One contract, one invoice, one SLA
Pricing
Essential
€6/endpoint/mo
- Hosted in Europe
- Daily backups
- Email support
Pro
€12/endpoint/mo
- Everything in Essentiel, plus:
- Priority support
- Proactive monitoring
Signature
€22/endpoint/mo
- Everything in Pro, plus:
- Fully managed
- SLA & on-call