What Your Security Tools Actually Do (and Which Ones You Actually Need)
Every managed IT provider will hand you a list of acronyms, EDR, MDR, XDR, SOC, MFA, as proof they're doing something. Most of them are real and useful. Here's what they actually do, in plain language, including which ones we think are genuinely optional.
Endpoint protection & EDR
This is your antivirus's more capable descendant, it doesn't just block known bad files, it watches for suspicious behaviour on the device itself and can respond automatically. Every plan includes this; it's not really optional in a modern environment.
24/7 SOC monitoring, what a human actually adds
Automated tools flag things. A Security Operations Centre means an actual person looks at what got flagged and decides what to do about it. Most of the time that's mundane, clearing a false positive when someone logs in from an unexpected location. Occasionally it's the difference between an intrusion getting caught and getting missed: it's not unheard of, in real incident-response situations, for an attacker already inside a system to try talking IT staff into switching this kind of monitoring off. Having someone watching who can't be talked out of it is the actual point.
Password managers, the one everyone needs and nobody adopts
Honestly, every business needs one, and almost nobody pushes their staff to actually use it without help. Done properly, the organisation, not individual employees, owns the passwords under one managed identity, so when someone leaves, they don't take company passwords with them.
Dark web monitoring, an honest take
This one gets sold harder than it delivers. Checking whether your credentials have shown up in a breach dump is worth doing occasionally, but on its own it has fairly limited value, especially once you've moved to passwordless sign-in, where there's no password to leak in the first place. We include it at our highest tier; we won't pretend it's essential at every level.
Cyber awareness training, why it works (hint: it's cultural)
The value here isn't really the content of the training videos, it's that getting caught by a simulated phishing email, and knowing it, keeps people alert in a way a policy document never does. It builds a culture of noticing, more than it teaches specific facts. That's a genuine, if unglamorous, reason it's worth including.
External vulnerability monitoring, who this actually matters for
If you're not hosting anything yourself, no self-managed server or custom infrastructure exposed to the internet, this one matters a lot less. It earns its keep for businesses that are self-hosting something, catching new vulnerabilities in what's exposed and flagging ports opened by misconfiguration (or by an attacker trying to make it easier to get back in).
So which of these do you actually need?
Depends on your risk profile and what you're required to prove, not just budget. See how these map to our three plan tiers →