Part of Managed Security Services
Managed EDR powered by SentinelOne and Halcyon ransomware protection, watched and acted on 24/7 by Core-Infosec’s own analysts. One service to prevent, detect, respond and recover.
Endpoint detection and response and dedicated anti-ransomware protection solve different parts of the problem. We deploy both, tune them to your environment and put an analyst team behind them, so alerts become decisions and actions.
Singularity Endpoint uses behavioral AI to detect suspicious activity on devices and servers, with automated response options and a rollback capability that SentinelOne documents for undoing unauthorized changes on endpoints. Core-Infosec runs it for you: policies, triage, response and tuning.
Halcyon is a dedicated ransomware defense layer. It is documented to act from before execution through data exfiltration to encryption, using behavioral AI/ML, and to guard your endpoint tooling from tampering. We deploy and manage it alongside your EDR.
Halcyon states that it supplements existing EDR with dedicated anti-ransomware protection, and that is how we use it. Two independent layers mean one does not have to be perfect: ransomware that slips past one meets the other, and tampering with the endpoint agent is itself something to detect.
CMDR can also include the layers around the endpoint: email threat protection, SIEM and log management, security awareness and phishing training, vulnerability management and patching, and a password manager. Start with the endpoint and add layers when you are ready. See also managed email security and vulnerability management.
Core-Infosec investigates Microsoft 365 and business email compromise, ransomware and data theft. That experience shapes what CMDR watches for and how we respond. See Incident Response Services. Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.
A current list of devices and servers, an administrator contact who can approve the rollout, and a named person we can reach when a decision is needed, such as taking a server offline.
Small and mid-size organizations that want one accountable security partner instead of several separate vendors, and IT firms and MSPs that need a security bench.
Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day. Ask us about incident response retainers as well.
Coverage depends on the services selected and your environment. Vendor capabilities are as described publicly by SentinelOne and Halcyon, and results depend on the threat and the deployment.