Endpoint security & MDR | Detection and response | Newblend
Newblend Book an introduction
Technology

Endpoint security & MDR

Prevention does not always work. The difference is how fast you notice something is happening and how fast it is stopped. So we monitor every device, day and night.

In short
  • Endpoint Detection and Response on workstations, laptops and servers.
  • Managed Detection and Response: monitoring 24 hours a day, including Identity Threat Detection on Microsoft 365.
  • Patch management and performance monitoring, with automatic ticket creation on critical faults.
  • On a confirmed threat we isolate the device, so it does not spread further.
  • Included in the Prevent blend, extended in Protect.
Last updated: 5 August 2026
Layers

What happens on a device

Endpoint Detection and Response

Continuous detection of unusual behaviour instead of only known viruses. Critical alerts arrive automatically as a ticket.

Managed Detection and Response

Monitoring by specialists 24 hours a day, including Identity Threat Detection on your Microsoft 365 environment.

Isolation on threat

On a confirmed threat we take the device off the network. That limits the damage to one workstation instead of your whole environment.

Patch management

Automatic security updates for the operating system and common software, with reporting on what was updated.

Device management

Central management through Intune: settings, encryption and the option to wipe a lost device remotely.

Reporting

A periodic overview of alerts, resolved incidents and the status of your endpoints. Usable in your ISO and NIS2 file.

Why not just a virus scanner

What changed since ransomware

  • Attackers often use valid credentials instead of malware. A scanner does not see that; behavioural detection does.
  • First access and actual damage are sometimes weeks apart. Monitoring in between makes the difference.
  • Identity is the new point of attack: phishing a Microsoft 365 account gives immediate access to mail and files.
  • An isolated device is quickly redeployed; an encrypted environment is not.
  • Without logging you do not know afterwards what happened, and you need that for the reporting duty.
Technology is half of it

Most incidents start with an employee clicking something. Awareness training and phishing simulations are therefore part of the same measure. Read more about awareness.

Frequently asked questions

How will we notice this in daily work?

As little as possible. Monitoring and patches run in the background. What you notice is that faults are often picked up before you report them.

Does this work on Mac and mobile too?

Yes, with differences per platform. During the inventory we set out which measures are possible on which device.

Who is watching outside office hours?

MDR monitoring runs 24 hours a day. A confirmed threat is acted on immediately; other alerts are handled during office hours under the SLA.

Is this part of the blends?

Yes. Endpoint Security and Endpoint Management are in the Prevent blend, Microsoft 365 Security and backup in Protect.

Read on

Want to talk it over?

Book a half-hour introduction. We are happy to think along, even if you are not sure yet what you are looking for.