In short
Managed antivirus means someone else deploys, configures and looks after your business antivirus. We can deploy agents, set policies, handle exclusions, licence changes and renewals. For round-the-clock threat response, vendors such as CrowdStrike, Sophos, ThreatDown, WatchGuard, Check Point, Acronis, Trend Micro and Halcyon run their own services. Scope is agreed at quote.
Get a quote for managed antivirus
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a managed antivirus service is
Managed antivirus (sometimes known as a managed endpoint protection service) is business antivirus that a provider looks after for you, rather than your own team running it day to day. It usually covers three layers of work:
- Getting it in place: removing the old product, deploying the agent to every device, checking each one reports in.
- Keeping it right: policies, exclusions for business applications, new starters and leavers, licence counts and renewals.
- Dealing with what it finds: reviewing detections, investigating suspicious activity and responding to incidents.
The first two are about administration and can be handled by a reseller or IT provider. The third, done properly at any hour, needs a security operations team, which is why most vendors now offer their own managed detection and response (MDR) service. A sensible managed antivirus arrangement makes clear who does which layer.
What Forever Systems can do
We supply the products on this site and can take on much of the administration around them. Depending on what we agree with you at quote, we can:
- plan the switch from your current product and deploy agents through your device management, group policy or installer
- set up groups and policies for workstations, servers and Macs, including web protection and device control where the product has it
- build exclusions for your business applications and server roles from the vendors' guidance
- add and remove licences as people join and leave, and handle renewals and edition changes
- add modules such as patching, encryption or EDR as your needs change
- help you read the console and reports, and point you to the vendor's service where round-the-clock response is needed
What we include, how changes are requested and how alerts are routed are set out in your quote, so both sides know what is covered. We do not offer response times or round-the-clock monitoring of our own; for that, the vendor services below are designed for the job.
Vendor-run MDR services
Several of the vendors we supply run their own managed detection and response services, staffed by the vendor's analysts and working on the same agent as the antivirus. These are the vendor's services, sold through us:
| Vendor | Service | In one line |
|---|---|---|
| CrowdStrike | Falcon Complete Next-Gen MDR (in the Complete Defend bundle) | CrowdStrike's team monitors, investigates and remediates threats around the clock |
| ThreatDown | ThreatDown MDR | Malwarebytes' managed detection and response, added per endpoint through OneView |
| Sophos | Sophos MDR and MDR Plus | Run by Sophos analysts; MDR Plus adds full-scale incident response |
| WatchGuard | Core MDR | Added as an endpoint module to Prime, 360 or Elite |
| Check Point | Check Point MDR | Added per endpoint or on top of Endpoint Security licences |
| Acronis | Acronis MDR | Managed detection and response on the Acronis Cyber Platform agent; requires Acronis EDR or XDR |
| Trend Micro | Worry-Free with Co-Managed XDR | Trend Micro's experts monitor, investigate and recommend or take action |
| Halcyon | Ransomware Operations Center | Included with Halcyon's anti-ransomware platform |
Each service has its own scope: what the vendor's team may do without asking (for example isolating a device), who they contact, and what counts as incident response rather than monitoring. We can help you agree those settings at the start. MDR is covered in more depth by endpointsecurity.uk's EDR, XDR and MDR guidance, and cloud-security.cloud explains EDR vs XDR vs MDR.
Not sure which bundle fits? Ask us
Tell us what you need and we will recommend the right bundle for your organisation, with a quote.
Managed antivirus or MDR: which do you need?
The two are often confused. A practical way to decide:
| Situation | Usually enough | Consider adding |
|---|---|---|
| Small office, Windows and Macs, no internal IT | Business antivirus with administration handled for you | Vendor MDR if an insurer or customer asks who responds to threats |
| Internal IT team, office hours only | Business antivirus or EDR, run by your team with our help on setup and changes | Vendor MDR for evenings, weekends and holidays |
| Servers with critical data, or a history of incidents | EDR on servers and key devices | Vendor MDR across the estate |
| Regulated, or customers ask for round-the-clock monitoring | - | Vendor MDR with an agreed response scope |
If you are not sure which side of the line you are on, our EPP vs EDR page explains what each layer catches, and we can talk it through with you.
What to ask any managed antivirus provider
Whoever you choose, ask the same questions so you can compare like with like:
- Which tasks are included: deployment, policies, exclusions, licence changes, renewals, reporting?
- Who receives alerts, and who acts on them, at what times? Is any response the provider's or the vendor's?
- What may the provider or vendor do without asking, such as isolating a device or a server?
- How do you request changes, and what is outside scope?
- Who owns the console and the data, and what happens if you move provider?
- How are devices counted and billed as numbers change?
Clear answers here matter more than a long feature list. Our business antivirus cost guide covers how management and MDR show up in a quote.
Is managed antivirus the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How a move to managed antivirus works
Moving to a managed arrangement usually follows the same pattern, whether or not you change product:
- We review your devices, servers, current product and renewal date, and what you want handed over.
- We recommend a product, edition and any vendor service, and set out the scope in a quote.
- Once agreed, we plan the cutover, including removal of the old product and the order devices move in.
- Agents are deployed in stages, starting with a pilot group, with policies and exclusions in place from day one.
- We check devices report in and hand over console access and reports to your nominated contacts.
- Licences, policies and modules are then adjusted as your organisation changes, within the agreed scope.
If you add a vendor MDR service, there is an extra onboarding step: agreeing with the vendor's team what they may do without asking, who they contact and how incidents are handed back to you. We can help you set that up.
Where patching, encryption and backup fit
A managed antivirus arrangement is a natural place to tidy up related tools that often sit on separate agents and invoices:
- Patching: several products add patch management on the same agent, which helps with the Cyber Essentials security update control.
- Disk encryption: Sophos Device Encryption and Bitdefender Full Disk Encryption manage BitLocker and FileVault from the antivirus console.
- Backup: Acronis puts anti-malware and backup on one agent, which can replace two products with one.
- Anti-ransomware: a dedicated layer such as Halcyon (Halcyon Pro Platform, or Pro Platform Plus DXP with data theft blocking) can run beside your antivirus where ransomware is the main concern. See ransomware protection for the layers.
Consolidating is not necessarily cheaper on the licence line, but fewer agents and consoles usually means less to manage. We can show both options in a quote.
How we help
Forever Systems supplies business antivirus and the vendor-run services above, and can take on the administration around them. We can:
- recommend a product and, where it fits, a vendor MDR service for your size and risk
- deploy it, set policies and exclusions, and keep licences in step with your organisation
- set out exactly what we and the vendor each do, in writing, at quote
- review the arrangement with you as your estate changes
Contact us to talk through what you need managed, and ask us for a quote.
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro, Sophos, Check Point, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
What is managed antivirus?
Managed antivirus is business antivirus that a provider looks after for you: deploying agents, setting policies and exclusions, handling licence changes and renewals, and, through a vendor's MDR service if added, responding to threats.
Is managed antivirus the same as MDR?
No. Managed antivirus usually means administration of the product. Managed detection and response (MDR) adds a security team that investigates and responds to threats. Many vendors we supply run their own MDR services on the same agent.
Do you monitor alerts around the clock?
We do not offer round-the-clock monitoring of our own. Vendor MDR services, such as CrowdStrike's Falcon Complete, Sophos MDR, ThreatDown MDR and WatchGuard Core MDR, are run by the vendors' analysts and can be supplied through us.
What does a managed antivirus service include?
It varies by provider. With us, the scope is agreed at quote and can include deployment, policies, exclusions, licence changes, renewals and adding modules. Ask any provider to set out in writing who does what, including who acts on alerts.
Can I switch to managed antivirus without changing product?
Often, yes, if your current product is one we supply. We can take over licensing and administration and add a vendor MDR service where available. If not, we plan a switch to a product that fits.
Still have a question about managed antivirus?
Ask us and a member of our team will reply by email.
More endpoint protection guides
CrowdStrikeIs CrowdStrike an antivirus? Falcon Prevent next-gen antivirus, the bundles we supply and how it is licensed.