Endpoint protection as a service means somebody else runs the security software on your laptops and servers: deployment, policy, alert review and response. You are not buying antivirus licences, you are buying the operating of them. That distinction is the whole value, because the usual failure is not a missing tool, it is a tool nobody watches.

What it actually covers

• Deployment and coverage checking. The agent gets onto every machine, and somebody notices the three laptops that dropped off last month.
• Policy configuration. Default settings are permissive. Hardening the policy is where most of the protection comes from.
• Detection and response. Modern tools do behaviour based detection, not just signature matching, so a file that has never been seen before can still be stopped by what it tries to do.
• Automatic isolation. A compromised machine gets cut off from the network, usually within seconds, before it can spread.
• Alert triage by a human. Someone reads the console, separates noise from a real incident, and escalates.
• Patch and vulnerability reporting. Unpatched software is how most endpoints get hit in the first place.
• Monthly reporting. What was blocked, what is still exposed, what needs a decision from you.

Antivirus, EDR and managed EDR are not the same thing

The middle column is where most small businesses actually sit: a capable tool, bought in good faith, with a console nobody has opened since the week it was installed. The tool is not the problem. The unread console is.

What it costs, and what the cost depends on

Pricing is almost always per endpoint per month, with servers charged higher than workstations. The variables that move the number:

• Who watches, and when. Business hours review costs less than round the clock monitoring, because of staffing.
• Response authority. Alerting you is cheaper than containing the incident on your behalf.
• Log retention. Longer retention costs more and matters if you ever need to reconstruct an incident.
• Server and cloud workload coverage. Servers carry more risk and more cost than laptops.
• Compliance reporting. Evidence packs for an insurer or an auditor take real hours.

Compare quotes on those five lines rather than on headline price. Two quotes with the same per endpoint figure can differ by whether anyone is reading alerts at 9pm.

Questions to ask a provider

1. Who reviews alerts, in which hours, and what are they allowed to do without calling us?
2. How do you detect an endpoint that has stopped reporting?
3. When you isolate a machine, what happens to the person using it?
4. How long are logs kept?
5. What does your monthly report contain, and can I see a sample before signing?
6. What is the process when the detection is wrong and a legitimate application gets blocked?

The last one gets skipped and it matters. False positives on a line of business application cause real disruption, and you want to know the unblocking process before it happens on a Monday morning.

Does your business need it

You probably do if any of these are true: staff work on laptops outside the office, you hold client data that would embarrass you if it leaked, you have no internal security skills, your cyber insurance application asks about endpoint detection, or a larger customer has started sending you security questionnaires.

You can defer it if every machine is on site behind a managed firewall, your data is low sensitivity, and you have someone internally who genuinely checks the console weekly. That is rarer than most owners think.

Details of what we deploy and operate are on the endpoint protection services page, with the wider programme under managed cybersecurity services. If you want to know where your gaps are before buying anything, start with a cybersecurity health check.