Attacks that matter rarely arrive as a file your antivirus recognizes. They arrive as ordinary Windows tools, used the wrong way, at 2 a.m. AllTech runs endpoint detection and response on every machine you own, watches the behavior instead of just the file, and has a 24/7 security operations center that actually reads what comes back.
Ransomware operators stopped bringing their own software years ago. There's no reason to. Every Windows machine ships with everything they need: a utility to delete backup snapshots, a utility to download files from the internet, a scripting engine that can run anything. Signature-based antivirus has no opinion about a legitimate Microsoft tool doing exactly what it was designed to do.
These tools run constantly, for entirely normal reasons, and nothing about the file tells you which time was normal. Only the behavior does: what launched it, what it did next, whether it happened on one machine or forty at once.
Endpoint detection and response records the behavior on every endpoint, flags the patterns that look like an attack in progress, and puts the result in front of someone who can tell the difference between a backup script and the first ten minutes of a ransomware deployment.
Datto EDR runs on every workstation, laptop, and server. It records process behavior continuously and maps what it sees to MITRE ATT&CK, the same framework incident responders use, so a detection arrives with context instead of a bare filename.
Datto AV and SentinelOne handle the known-bad: commodity malware, malicious documents, exploit attempts. Real-time and scheduled scanning, centrally managed, with detections reported up rather than dismissed by whoever happens to be sitting at the machine.
Datto DNS Secure blocks connections to malicious and unwanted destinations before they’re made. It also tells us when a machine is trying to reach somewhere it shouldn’t, which is often the first sign of an unwanted browser extension or bundled adware.
Detections go to RocketCyber’s security operations center, which is staffed around the clock, so they don’t sit on a dashboard nobody opens. Endpoints can be isolated from the network remotely while an incident is being worked, so a compromised laptop stops being everyone’s problem within minutes.
You get a plain-language report every month: what was seen, what was escalated, what turned out to be nothing, and what’s still open. No portal login required.
Between June 1 and July 1, 2026, across nearly 1,300 endpoints, 44 firewalls, and more than 800 Microsoft 365 accounts, here's what the layers actually did.
events recorded
Roughly 9,800 per machine per day: every process start, network connection, and file written. Nobody looks at this layer. It’s there so that when something does happen, the history is already recorded.
pulled for behavioral analysis
That’s three-thousandths of one percent. These matched known attack patterns, meaning the tools and sequences that show up in real intrusions.
flagged possibly malicious / rated critical
Still not incidents. Candidates.
logs and events triaged by the SOC
Endpoint, cloud, and network telemetry, correlated across sources rather than judged one machine at a time.
security incidents opened
About one every twelve hours. Each one meant an analyst decided the activity warranted a real investigation.
resolved / closed as normal / left open
Every incident opened during the month was worked to a conclusion.
Two numbers in that list matter most: zero ransomware detections across the fleet, and zero incidents still sitting open at the end of the month. The second one is the harder of the two, and it's the one that tells you whether anybody is actually reading the alerts.
Figures from AllTech's Datto EDR and RocketCyber SOC reporting, June 1 – July 1, 2026. The two event totals measure different pipelines and are not additive.
None of them were malware. Here's what the platform flagged most often, and why:
Windows includes a tool for managing shadow copies, the snapshots that let you restore a file you overwrote. It has real administrative uses. It is also, almost universally, the first thing ransomware runs, because encrypted files aren’t leverage if you can just roll them back. It fired on hundreds of machines last month, and all of them were benign. The next one is the reason we watch it.
`curl` ships with Windows and macOS and is used constantly by legitimate software. It’s also how an attacker who already has a foothold pulls down the rest of their toolkit. Most of last month’s command-and-control detections traced back to it. They were concentrated on a handful of machines, which is the pattern that says “a script doing its job” rather than “an intrusion spreading.”
`svchost.exe` runs half of Windows. It’s also the most commonly impersonated process name in malware, because a fake one hides in a list of forty real ones.
Either housekeeping or cleanup after something you’d rather not know about. The difference is entirely in what preceded it.
A platform that only alerted on definite malware would have been silent all month. A platform that alerts on all of this and hands you the list is just a different kind of useless. The work is in between: knowing that a shadow-copy command on the backup server at 1 a.m. is the job, and the same command on a front-desk laptop at 1 a.m. is a phone call.
Six things accounted for most of what an analyst investigated last month:
A remote-desktop service appeared on a managed workstation. Sometimes that’s a technician. Sometimes it’s how an attacker keeps a way back in after the original hole is closed. Either way it gets a call, because the two look identical in a log.
A dozen machines had new local user accounts created. Most were routine setup. Creating a local account is also one of the oldest persistence techniques there is, which is why nobody gets to assume.
Someone gained rights they didn’t have that morning. The SOC called the client the same day rather than emailing a ticket.
Two files disguised as PDF setup programs were caught and mitigated on a workstation before they ran. This is what a real attack usually looks like: nothing sophisticated, just convincing enough at 4:30 on a Friday.
One machine ran PowerShell in a pattern that matched a known defense-evasion technique. Investigated, resolved, no compromise.
Sign-ins from anonymized IP addresses, from unfamiliar locations, and one session token that behaved anomalously (the technique that lets an attacker skip multi-factor authentication entirely).
Twenty-four of the 63 turned out to be normal activity once someone looked. That's the job working correctly. The alternative is a system tuned quiet enough to never bother you, which is also quiet enough to miss the one that mattered.
Just over half of the incidents opened last month (50.8%) originated in the cloud: Microsoft 365 sign-ins, risk detections, and account activity that no agent on a laptop would ever see. The rest came from endpoint and network detections.
That's worth saying on a page selling endpoint security. Protecting the devices is necessary and it is not sufficient. An attacker with a stolen session token never touches a managed machine. The laptop is clean, the antivirus is green, and the account is being used by someone else entirely.
Endpoint security is one layer. We'd argue it's non-negotiable, but it doesn't work alone.
Email Security & Phishing ProtectionandMicrosoft 365 & Entra IDcover the other half.
Figures from AllTech's Datto EDR and RocketCyber SOC reporting, June 1 – July 1, 2026.
We find out what you actually have. In most environments that includes at least a few machines nobody remembered: an old server, a laptop that left with someone, a workstation on a bench.
Agents deploy remotely and quietly. No reboots for most machines, no downtime, no change to how anyone works.
The first two weeks are noisy on purpose. Your line-of-business software does things that look strange out of context, and we’d rather learn what normal is than suppress detections blind.
The SOC triages detections as they arrive, 24/7. You hear from us when something needs you, and once a month either way.
Yes, and you want both. Antivirus identifies files it recognizes as malicious. EDR watches what programs do, which is the only way to catch an attacker using software that’s already installed and signed by Microsoft. We run both because they fail in different places.
The agent is lightweight and most people never notice it’s there. If a specific application does conflict, we tune around it rather than turning protection off.
The SOC triages it first — most detections are explainable within minutes. If it isn’t, the machine can be isolated from the network remotely while we investigate, and you get a call, not a ticket.
Yes. Windows, macOS, and Linux are all covered, which matters more than it used to now that a meaningful share of most fleets isn’t Windows.
It can detect and interrupt the behavior that precedes encryption, which is the realistic version of that promise. Anyone selling a product that makes ransomware impossible is selling you something. Endpoint security is one layer; tested backups are the other, and we’d rather you have both.
Plenty of businesses own one and nobody reads the alerts. If that’s the situation, say so — the conversation is about who’s watching it, not about replacing what you bought.
Most endpoint compromises start with a message. Filtering catches it before the click.
Detections are only useful if someone reads them at 3 a.m. Last month that was 63 investigations.
Endpoint security reduces the odds. Tested backups are what make the bad day survivable.
Device compliance, conditional access, and Intune policy are where endpoint security either holds or gets bypassed.
What we deliver remotely vs. what needs someone on-site, in one place.
Attackers chained three Ivanti Connect Secure flaws to get root on VPN appliances. CISA lists all three as exploited. Fixed versions and checks.
CISA lists Cisco ASA and FTD flaw CVE-2026-76418 as exploited. A crafted VPN request can reload the firewall. Affected setups, fixed versions, steps.
CISA lists FortiOS flaw CVE-2025-61624 as exploited. It needs admin access, but attackers used it to reach root. Affected versions and what to do.
We'll inventory your endpoints, check what protection is installed and whether it's reporting to anyone, and show you what a month of behavior data on your network actually contains, explained in plain language and with no pressure.
Trusted by dozens of businesses
AllTech