网络安全

终端防护与 EDR

EDR 监控行为而不只依赖病毒库，可在勒索软件运行中途拦截，并立即将中毒电脑隔离出网络。

现场常见问题

Signature-based antivirus can't stop attacks that use Windows' own tools (PowerShell, WMI) or new ransomware variants. In many companies we visit there's a mix of free antivirus products and nobody knows which machines have expired.

EPP (endpoint protection platform) blocks known threats with signatures, machine learning, web protection and device control. EDR (endpoint detection & response) continuously records processes, connections and file changes. That record lets it catch attacks it has never seen before and lets you trace back where they started.

When something happens

See ransomware-like behaviour, such as mass file encryption in a short window or shadow copies being deleted? EDR kills the process, isolates the machine from the network, and with some vendors rolls files back. The admin sees the whole attack chain on one screen.

EDR, XDR and MDR

EDR: visibility and response on PCs and servers.
XDR: combines EDR data with email, firewall, cloud and identity, so one incident is seen from several angles.
MDR: not software but a service. Analysts watch the alerts and respond for you, 24/7.

Straight advice: EDR that nobody watches is worth less than people think. If your IT team is one or two people who go home at 17:00, look at MDR.

We deploy agents, remove the old antivirus completely (two running side by side cause trouble), set policies and check that no machine has been missed.

功能

Behavioural detection

Catches fileless attacks and abuse of built-in tools.

Anti-ransomware

Stops encryption, with rollback on products that support it.

Network isolation

One click or automatic. The machine still talks to the console for investigation.

Central console

Every device, including field laptops, from the cloud.

USB and application control

USB sticks are still a common way in on project sites.

Vulnerability and patch insight

Reports missing critical patches (vendor-dependent).

Optional 24/7 MDR

Analysts watch and respond on your behalf.

设计与实施

1
Count every endpoint: Windows, macOS, Linux and servers
2
Choose EPP, EDR or MDR by risk and IT headcount
3
Remove old antivirus and roll out agents in batches
4
Set policies, business-app exclusions and alerts
5
Test detection and the isolation playbook with your team

适用场景

Banks and microfinance lenders targeted by ransomware
Hospitals whose patient systems can't stop
Construction and mining firms with field laptops and frequent USB use
Government bodies that need early warning and evidence to investigate

常见系统规模

Protect

适用于: Small businesses wanting centrally managed protection

Cloud-managed EPP
Web protection and device control
Monthly status report

获取报价

Detect & Respond

适用于: Organizations with in-house IT

Full EDR including servers
Isolation and investigation playbooks
IT team training

获取报价

Managed (MDR)

适用于: No in-house 24/7 security team

EDR/XDR with the vendor's MDR service
24/7 incident response
Incident reports and post-incident recommendations

获取报价

我们供货并安装的品牌

CrowdStrike Microsoft Sophos Trend Micro ESET Kaspersky Fortinet Palo Alto Networks Check Point WatchGuard SonicWall

所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。

常见问题

How is EDR different from antivirus?

Antivirus blocks files known to be bad. EDR records and analyses behaviour continuously, so it catches new things and gives you tools to respond. Most current products do both in one agent.

Is the built-in Microsoft Defender enough?

The antivirus built into Windows is reasonable. EDR and central management need a licence such as Defender for Business (included in Microsoft 365 Business Premium) or Defender for Endpoint.

Will it slow PCs down?

Modern agents are mostly light. What really slows machines down is two antivirus products running together. We test against your accounting software and ERP first and add safe exclusions where needed.