Kaseya/Datto Managed EDR is a managed endpoint detection and response service that combines EDR software on your endpoints with 24/7 monitoring and response from a Security Operations Centre (SOC). The EDR agents continuously monitor every endpoint for known and unknown threats — using signature-based detection for known malware and behavioural AI analysis for novel attacks. When it detects a threat, the EDR can automatically isolate the endpoint, kill malicious processes, and roll back changes. Meanwhile, SOC analysts triage alerts, investigate suspicious behaviour, and coordinate the response. The result is endpoint protection that is both automated (fast containment) and human-led (expert investigation and response) — without the cost of building and staffing your own SOC.

Traditional antivirus (AV) is signature-based — it identifies known malware by matching files against a database of known threats. It works well against known malware but can miss novel attacks, fileless attacks, and zero-day exploits without a signature. Managed EDR goes far beyond AV. It uses behavioural analysis and machine learning to detect attacks based on what they do, not what they look like — catching fileless attacks, living-off-the-land techniques, and zero-day exploits that AV misses. It also provides automated response (isolation, process termination, rollback) rather than just blocking. And it includes 24/7 SOC analyst triage — human experts who investigate, confirm, and respond to threats. We recommend Managed EDR as a replacement for or supplement to traditional AV, not as an addition — EDR includes AV capabilities and adds behavioural detection, response, and human expertise.

Zero-day threats exploit vulnerabilities for which no patch or signature exists yet. Traditional AV cannot detect them because it relies on signatures. EDR detects zero-day threats through behavioural analysis — instead of looking at what a file is (its signature), it looks at what the file does (its behaviour). The behavioural AI models are trained on millions of endpoints and learn what normal activity looks like. When an endpoint exhibits anomalous behaviour — unexpected process execution, credential access, lateral movement, unusual network connections — the EDR flags it as suspicious, even if there is no signature match. This catches fileless attacks (which run entirely in memory), living-off-the-land attacks (which use legitimate tools like PowerShell maliciously), and zero-day exploits (which use novel techniques). The SOC analysts then investigate the flagged behaviour to confirm whether it is a real threat.

When the EDR detects a threat, it begins a response sequence. First, automated response: depending on the configuration, the EDR can automatically isolate the affected endpoint from the network (stopping lateral movement), kill the malicious process, quarantine the malicious file, and roll back any changes (including ransomware encryption). This happens in seconds, before a human is even involved. Second, SOC triage: a SOC analyst receives the alert, investigates the telemetry (what happened, how it happened, what was affected), confirms whether it is a real threat, and classifies the severity. Third, escalation and response: if it is a real threat, the analyst escalates to your team with full context and recommended action. On the Enterprise tier, the analyst coordinates the full incident response — isolation, clean-up, persistence removal, backup restoration, and verification that the threat is eradicated. The analyst documents the entire sequence in an incident report.

Ransomware rollback is an EDR capability that, when ransomware is detected, can automatically roll back encrypted files to their pre-encryption state. The EDR continuously monitors file changes and maintains a change journal. When ransomware behaviour is detected (rapid, bulk file encryption), the EDR isolates the endpoint, stops the encryption process, and then uses the change journal to roll back the affected files to their state before the encryption began. This means that even if ransomware starts encrypting files, the EDR can undo the damage—restoring the files without needing to restore from backup. This is a powerful ransomware-protection capability, but it has limitations: it depends on the change journal remaining intact, the EDR being active during encryption, and the ransomware being detected before it completes. We recommend ransomware rollback as one layer of protection, alongside regular backups and employee security awareness training.

It depends on your internal capabilities. EDR software alone provides automated detection and response, but it still generates alerts that need human triage. Without a SOC, those alerts go to your IT team — who may not have the security expertise to investigate, confirm, and respond to threats, and who are unlikely to be monitoring 24/7. As a result, real threats can get lost in the noise of false positives, and response can be delayed. A managed EDR service (like ours) solves this by pairing the EDR software with a 24/7 SOC — human analysts who triage every alert, filter false positives, investigate real threats, and coordinate response. This gives you the speed of automated response (the EDR isolates the endpoint in seconds) with the depth of human expertise (the SOC investigates and responds). For most organisations, a managed EDR service is more effective and more cost-efficient than EDR software alone or building an in-house SOC.

Managed EDR supports Windows, macOS, and Linux endpoints. This includes desktops, laptops, and servers. The lightweight EDR agent runs continuously in the background, monitoring process execution, network connections, file operations, and registry changes. It works regardless of network location — in the office, at home, or on the road — so remote and hybrid workforces are fully covered. The agent reports telemetry back to the SOC over an encrypted connection. For servers, the agent also monitors server-specific activity, including service installation, scheduled task creation, and unusual authentication patterns. We support both physical and virtual endpoints, including cloud-based VMs (AWS, Azure, Google Cloud). Mobile devices (iOS, Android) are not supported by EDR — for mobile, we recommend a separate mobile threat defence solution.

Deployment of Managed EDR typically takes 1 to 2 weeks. The process includes: (1) scoping — identifying the endpoints to protect, the operating systems, and any constraints; (2) agent deployment — installing the EDR agent on all endpoints, which can be done via your existing deployment tooling (e.g., Kaseya VSA, Microsoft Endpoint Manager, or a script); (3) baseline configuration — tuning detection rules, response actions, and alerting thresholds to your environment; (4) SOC onboarding — integrating the endpoints into our SOC monitoring platform and establishing escalation procedures with your team; and (5) go-live — the service is live and the SOC begins 24/7 monitoring. For larger estates (500+ endpoints), deployment may take 2 to 4 weeks. We work with your IT team to schedule deployment around your business needs, and the EDR begins protecting endpoints as soon as the agent is installed.

The three tiers scale the level of human involvement. Essential provides the EDR software with automated detection and response, with alerts going to your IT team — you handle triage and remediation. Professional adds 24/7 SOC analyst triage — our analysts investigate every alert, filter false positives, confirm real threats, and escalate to your team with context and recommended action. Enterprise adds proactive threat hunting (analysts actively search for threats that evade automated detection), incident response coordination (analysts guide the full response when an incident occurs), remediation and recovery guidance, post-incident hardening recommendations, a dedicated security architect, and compliance reporting. Most organisations start with Professional (which balances automation and human expertise) and move to Enterprise as their security maturity or compliance requirements grow.

Yes. Our Managed EDR service supports several compliance frameworks. PCI DSS (Requirement 5 and 10) requires endpoint protection and log monitoring — our service provides this with audit-ready reports. ISO 27001 (A.8.7 and A.8.16) requires malware protection and event logging — our service provides this with control objective mapping. SOC 2 (CC7.1 and CC7.2) requires vulnerability identification and incident response — our service provides this with audit-ready reports. CMMC (SC.3.184 and SI.2.217) requires endpoint protection and incident response — our service provides this with CMMC control mapping. HIPAA Security Rule requires protection against malicious software — our service provides this. The Enterprise tier includes compliance-specific reporting tailored to your framework, with metrics mapped to control objectives and audit-ready evidence. We also provide incident reports that document detection, response, and remediation for audit trails.