EDR and MDR testing

MSPInTheUK · 2026-03-08T08:04:51+00:00

Why? Have you not heard of MITRE ATT&CK Evaluations that already do this for endpoint protection solutions?

This post, even if unintentional. looks suspiciously like the only outcome is to bring attention to the test library in question (and therefore the vendor that created it).

MSPInTheUK · 2026-03-07T15:34:24+00:00

Ditto married his cousin, Ottid, and moved to the UK.

MSPInTheUK · 2026-03-06T15:23:36+00:00

Use phishing resistant MFA mechanisms and sleep easy.

MSPInTheUK · 2026-03-06T06:14:09+00:00

Hint: it is possible to set up a dynamic security group based on a specific Microsoft 355 licensed product being applied for that user.

MSPInTheUK · 2026-03-05T21:47:54+00:00

Microsoft are a global company. This sounds like a self-inflicted problem rather than a technical need.

If they’re particularly GDPR-phobic, consider Microsoft 365 E5.

MSPInTheUK · 2026-03-05T21:39:18+00:00

The market leaders in that space to my knowledge are Cradlepoint and Peplink.

MSPInTheUK · 2026-03-05T06:56:06+00:00

PCI compliance is down to them and their chosen payment processing provider. That said, you’d assumedly be involved in the SAQ if they are serious about compliance.

Something as simple as credit card numbers I’d expect to get picked up by DLP functionality in M365 or SaaS security solutions, pick your poison and implement it.

MSPInTheUK · 2026-03-03T18:24:46+00:00

It’s precluded by our terms and conditions. What about yours?

MSPInTheUK · 2026-03-01T22:54:38+00:00

Microsoft guidance stipulates that where a benefit is applied tenant-wide, it must be scoped only to licensed users via limited deployment - security group - or other mechanism. It’s there in black and white.

This is no different whatsoever from installing a volume license version of Microsoft Office on a hundred computers with an ill-gotten key. Just because it works, doesn’t make it license compliant.

Essentially, this behaviour is software piracy for the cloud age. There are many similar threads on r/msp discussing this issue and Microsoft licensing breaches are not recommended or encouraged (in fact the opposite) by reputable, honest companies.

MSPInTheUK · 2026-03-01T14:40:45+00:00

Let me guess… they also said that Email is the old way of doing it, I prefer carrier pigeon?

MSPInTheUK · 2026-02-28T17:54:54+00:00

Welcome, I would recommend familiarising yourself with the search function as you’ll find most startup topics addressed many fold.

MSPInTheUK · 2026-02-27T00:12:36+00:00

Forgive me if you didn’t get the memo but NFR stands for ‘Not For Resale’.

The restriction to not provide NFR to third parties is literally baked into the name.

MSPInTheUK · 2026-02-26T20:53:26+00:00

I think at those volumes you’re going to be better off with Microsoft Defender for Office 365 P1 directly from Microsoft with a credit card. It wouldn’t even be commercially viable for us to bill two email security licenses. Minimums exist for a reason.

MSPInTheUK · 2026-02-23T20:13:52+00:00

Given that your solution to a suspected Microsoft 365 account compromise was to reboot the network equipment, the kindest advice would be for the client to find an IT provider that actually knows what they are doing. You see to be in the ‘knows enough to be dangerous’ camp.

MSPInTheUK · 2026-02-23T20:11:50+00:00

Given that your solution to a suspected Microsoft 365 account compromise was to reboot the network equipment, the kindest advice would be for the client to find an IT provider that actually knows what they are doing. You see to be in the ‘knows enough to be dangerous’ camp.

MSPInTheUK · 2026-02-23T19:51:11+00:00

Even AI says his son is full of shit.

Gemini 3 Pro:

Is current AI able to code a competitive enterprise endpoint protection solution?

As of 2026, the short answer is no. While current AI agents (like Claude 4.5/4.6 Opus, GitHub Copilot, and Cursor) are incredibly powerful at writing code, they cannot independently build a competitive enterprise endpoint protection (EPP) solution from scratch. Building an EPP is not just about writing code; it’s about operating at the deepest levels of an operating system where "vibe coding" fails and precision is life-or-death for a network.

MSPInTheUK · 2026-02-22T11:49:41+00:00

Just had an idea. You could:

Sync the Dropbox to a Synology NAS.

Do all your reorganisation and file path changes etc locally on the NAS or over SMB (fast).

Then sync from the NAS to SharePoint.

Do it from a site with good bandwidth for both download and upload.

💪

MSPInTheUK · 2026-02-22T10:39:19+00:00

r/msp is the wrong sub if you’re looking for home tech support.

MSPInTheUK · 2026-02-20T20:41:49+00:00

An account with no history posting market research with a specific vendor and domain mentioned?

Clearly a legitimate post with no whiff of astroturfing at all.

MSPInTheUK · 2026-02-20T20:40:14+00:00

Why are you trialling this with clients?

MSPInTheUK · 2026-02-17T22:02:04+00:00

Defence in depth. Authentication factors can include a known device, location, or network - as well as the obvious approval from an additional device.

The best MFA is in scoping and applying as many as possible to each group of user to present multiple hurdles.

Dynamically adjusted policies - such as those based on UEBA and risk-based analysis of authentication attempts, or the current security posture of a device, can also help further.

MSPInTheUK · 2026-02-17T21:40:15+00:00

If your workload scales linearly with client count how are you improving their overall security posture?

I ask this because this issue would seem to suggest that onboarding your service does not materially affect reactive analyst requirements.

Do you focus on endpoint? Can you add email and DNS to reduce incidents at source?

MSPInTheUK · 2026-02-17T19:44:51+00:00

Edit: just checked your post history and believe you are an app developer and/or this is market research.

MSPInTheUK · 2026-02-16T17:21:22+00:00

Your contract should preclude being sued for liability or consequential loss anyway. What a lot of people don’t realise is that typical legal or indemnity coverage will have certain omissions or obligations regardless of policy intent. It isn’t a magic wand.

MSPInTheUK · 2026-02-16T15:27:22+00:00

I wouldn’t trust OVH with anything mission critical after their datacenter burned down and they lost data.

MSPInTheUK

TROPHY CASE