Stop Attacks Before They Do Damage With Managed Detection and Response

BCA's MDR covers the places most attacks show up: laptops, desktops and servers (through endpoint detection and response), email and Microsoft 365 accounts. Watching them together matters, because a typical attack moves between them. A phishing email leads to a stolen password, the stolen password leads to a sign-in from somewhere unusual, and that account is then used to send more phishing or reach company files.

No. EDR is software on each device that flags suspicious behavior. MDR is the service around it: people who review what EDR and your other security tools flag, decide whether it's real and respond. EDR tells you something might be wrong; MDR makes sure someone finds out and does something about it. BCA includes both in every plan.

Most alerts are things like a sign-in from a country your team doesn't work in, a password typed into a fake Microsoft page followed by a new sign-in, a new inbox rule that forwards invoices to an outside address, or a program on a laptop trying to switch off security tools. Some turn out to be harmless, such as an employee traveling. The job is telling the difference quickly and acting on the ones that aren't.

For clear threats, yes. Isolating an infected laptop or locking a compromised account happens straight away, because minutes matter. Anything that affects how the business runs, such as taking a server offline or shutting down a shared mailbox, is discussed with you first unless waiting would put the business at greater risk. We agree these rules with you at the start, including who we contact and how.

Yes. Many attacks never touch a laptop: an attacker steals a password, signs in to Microsoft 365 from their own computer and reads email or sets up rules to hide what they're doing. MDR watches for risky sign-ins, sign-ins from two distant places at once, new forwarding rules and mass downloads. When one is confirmed, BCA locks the account and ends every active session.

They're two parts of the same protection. The security operations center is the team of analysts that watches your environment and sorts real threats from noise. MDR is the full service around it: the tools on your devices and accounts, the monitoring and the response that contains and cleans up a confirmed threat. For BCA clients, alerts from the SOC come straight to our technicians, who handle the response.

Very little day to day. We'll agree who to contact and how if something happens. When an alert involves a person, such as a sign-in we can't explain, we may ask them a quick question to confirm it was them. Your team should still report anything that looks wrong, because a call from someone who just clicked a bad link is one of the fastest alerts there is.