Endpoint and network security

Microsoft's own endpoint and email protection, included with Microsoft 365 Business Premium rather than bought separately. Because it ships with a licence many businesses already hold, the common situation is not choosing it but discovering it was never switched on properly. Capable enough that adding a second product on top is often paying twice for overlapping coverage.

Watches how software behaves rather than matching it against a list of known threats, which is what catches attacks written specifically to avoid such lists. Well regarded and widely deployed in larger organisations. The capability is real; the question for a smaller business is usually whether anyone is positioned to act on what it reports.

Behavioural endpoint protection with the ability to undo changes an attack made to a machine, rather than only stopping it. That rollback is the distinguishing feature and is aimed squarely at ransomware. As with any detection product, the value depends on somebody responding to the alert.

Endpoint protection that consistently scores well in independent testing while staying undemanding on the machine it runs on. That matters more than it sounds on older hardware, where a heavy security agent is the difference between a usable laptop and a complaint. A sensible middle option between the built-in tools and the heavier detection platforms.

Endpoint protection and firewalls administered together, so the boundary device and the machines behind it share information about what they are seeing. The integration is the argument for buying both from one vendor. Popular with smaller businesses that want one console rather than two.

Covers endpoints, email, and server or cloud workloads from one vendor, with a long history in the market. Most relevant where a business has servers to protect as well as laptops. Broad coverage rather than a single standout capability.

The business line from Malwarebytes, whose reputation was built on cleaning up machines that were already infected. That remediation heritage still shows, and it is sometimes deployed alongside another product specifically for cleanup. Straightforward to run, which suits businesses without a security specialist.

Very light endpoint protection paired with DNS filtering that blocks known-bad sites before a browser reaches them. The small footprint suits older machines and slower connections. The DNS filtering is frequently the more valuable half, since it stops a whole class of problem before anything has to be detected.

A long-standing enterprise security name, now part of Broadcom, with particular strength in data loss prevention — controlling what information can leave the organisation and by which route. Most relevant where a regulator or a contract imposes that requirement. Enterprise in both capability and administrative weight.

Maintains a connection to a device that survives a wipe or an operating system reinstall, because the agent is embedded in the firmware of many business laptops. That makes it useful for locating or erasing hardware that has genuinely gone. Only applies to supported models, so it is a purchasing decision as much as a software one.

Security for phones and tablets, which are frequently the only devices some staff use and are routinely left out of the security conversation entirely. Covers malicious apps, phishing over text, and unsafe networks. Relevant to any business where real work happens on a phone.

Combines detection tooling with a team that monitors it, so alerts reach someone rather than accumulating in a console nobody opens. That combination is the entire proposition — detection without response is an expensive way to find out afterwards. Aimed at organisations with no security staff of their own.

A monitored detection and response service where an operations team watches alerts continuously and can isolate a compromised machine directly. Built specifically around acting quickly at times when nobody at the business is awake. The response capability, not the detection, is what is being bought.

Delivers networking and several security functions through a single agent on the device, replacing a collection of separate tools and appliances. Suits distributed businesses where there is no office boundary left to defend. Consolidation is the argument; the trade-off is depending on one vendor for a broad set of functions.

Security monitoring and response scaled for smaller environments, collecting activity from across the estate and having analysts review what matters. Fills the gap between no monitoring at all and a full security operations programme. Sized for businesses that would never staff the latter.

Built around ransomware specifically rather than threats generally, including capturing the keys needed to recover files if encryption does begin. Deliberately narrow, and intended to sit alongside ordinary endpoint protection rather than replace it. Relevant where ransomware is the risk that genuinely keeps someone awake.

Watches email, devices, cloud accounts, and external exposure together, and reports in language a business owner can act on rather than a security analyst. Aimed at small businesses that have no security function and no plans to build one. Breadth and legibility over depth.

Gives staff access to specific internal resources rather than dropping them onto the whole network the way a traditional VPN does. That limits how far a compromised laptop can reach. Suits businesses with remote staff and something internal still worth protecting.

Segments an internal network automatically, so machines can only reach what they demonstrably need. Segmentation is well understood as a defence and almost never implemented, because doing it by hand is laborious and easy to get wrong. Automating it is the entire proposition.

A browser with organisational controls built in, so policy about copying, downloading, and screenshotting applies inside the place most work now happens. Useful where staff use personal or unmanaged machines and the browser is the only thing that can be controlled. A genuinely different approach to a problem usually attacked at the device level.

Adds protection to browsers people already use, isolating risky sites and blocking credentials from being typed into pages impersonating a login screen. Sits closer to the actual point of failure than a network filter does. Lighter to deploy than replacing the browser outright.