We already have antivirus. Is that enough?
No. Signature-based AV catches commodity malware; modern attacks (token theft, living-off-the-land, AI-generated phishing, ransomware) bypass it routinely. EDR + MDR is now table stakes — and increasingly required by cyber-insurance carriers to issue a policy at all.
Do you run your own SOC?
We partner with Huntress for 24/7 SOC coverage. Real human analysts watch your tenant around the clock, triage alerts, and open tickets directly to me. It’s the same model the largest MSPs use — deployed without the overhead of staffing a SOC from scratch.
What about Mac and BYOD?
Fully supported. SentinelOne agents on macOS. Intune (or Jamf where preferred) for device compliance. BYOD handled through Conditional Access and app-protection policies so personal devices can access M365 without giving the device root admin to your data.
How do you handle incident response?
Defined runbook per client. On confirmed P1: SentinelOne auto-isolates the endpoint, Huntress SOC pages me, we kick off containment within minutes. Post-event we deliver a written incident report with timeline, indicators of compromise, root cause, and remediation. We also support your forensics partner and breach counsel if engaged.
Will you help with our cyber-insurance application?
Yes — this is one of the most-requested deliverables. We fill the carrier questionnaire, document the controls we operate, provide evidence (screenshots, policy docs, attestations), and flag any gaps before submission. Several clients have moved insurance brokers based on the package alone.
What if we’ve already had an incident?
Call — we’ll triage with you. We’re not a forensics firm or breach counsel, but we work with both, and we can stand up containment, restore from backup, and harden the environment to keep you operating while the formal IR work runs in parallel.
