This is the buyer education conversation that most Sydney businesses need before they invest in endpoint security – and one that most providers skip because explaining it honestly means admitting that the AV product they may have sold you last year is insufficient.

How Traditional Antivirus Works (and Where It Fails)

Traditional antivirus software identifies threats by comparing files against a database of known malicious signatures. When a file matches a known signature – a pattern of code previously identified as malware – the AV blocks or quarantines it. For known, catalogued threats, this works.

The problem: sophisticated attackers know exactly how signature-based AV works, and they engineer around it deliberately. They use:

• Fileless malware – attacks that execute entirely in memory, never writing a file to disk that AV could scan
• Polymorphic malware – code that changes its own signature with each infection, never matching a known pattern
• Living-off-the-land attacks – using legitimate Windows tools (PowerShell, WMI, certutil) to execute malicious actions, so the "file" running the attack is a legitimate Windows component that AV would never block
• Zero-day exploits – vulnerabilities with no patch and no signature in any AV database because they have never been seen before

Traditional AV catches yesterday's threats. Managed EDR catches how today's attackers actually behave. For the full technical comparison, read our guide: EDR vs Antivirus: What's the Difference?

How EDR Works Differently

Endpoint Detection and Response operates on behavioural analysis rather than signature matching. Instead of asking "does this file match a known threat?", EDR asks "is this process behaving in a way consistent with an attack?"

If a Microsoft Word document spawns a PowerShell process that then makes an outbound connection to an external IP address – that behavioural sequence is a threat indicator whether or not any file involved matches a known malware signature. EDR catches it. Traditional AV does not.

Key EDR capabilities that AV cannot replicate:

• Behavioural detection – continuous monitoring of process activity, network connections, registry changes, and file system behaviour across all endpoints
• Attack chain visibility – seeing the entire sequence of events that make up an attack, not just the individual malicious file
• Automated isolation – when a device shows active compromise indicators, it is automatically isolated from the network within seconds to prevent lateral movement, while the device remains functional for forensic investigation
• Rollback capability – some EDR platforms can roll back ransomware encryption by restoring files to their pre-encryption state using VSS snapshots
• Threat hunting – proactive search through endpoint telemetry for indicators of threats that have not yet triggered an alert

For the distinction between malware-based alerts and behavioural alerts that EDR generates, read our guide: Malware Alerts vs Behavioural Alerts.

Code Hyper One's managed endpoint security services protect Sydney businesses at three distinct, complementary layers of the endpoint. Each layer catches what the others miss – together, they provide comprehensive protection across the full attack chain.

Layer 1 – Endpoint Detection and Response (EDR)

EDR is the intelligence layer – the system that watches everything happening on your endpoints and identifies threats by their behaviour regardless of whether they match a known signature.

What our managed EDR service delivers:

Continuous Endpoint Monitoring Every enrolled device generates a continuous stream of telemetry: every process that starts, every network connection made, every file created or modified, every registry key changed, every login attempt. This telemetry is analysed in real time – both by automated AI systems and reviewed by Code Hyper One's security engineers – for indicators of compromise and indicators of attack.

For the distinction between these two detection categories, read our guide: Indicators of Compromise vs Indicators of Attack.

Automated Threat Response When our EDR platform detects active malicious behaviour – a ransomware encryption process, a credential dumping tool running, a lateral movement attempt – it responds within seconds:

• Suspending or terminating the malicious process
• Quarantining suspicious files
• Isolating the affected device from the network while preserving the ability to manage it remotely for investigation
• Triggering an alert to our security team for human review and escalation

Ransomware Containment and Rollback Our managed EDR includes specific ransomware detection and response capabilities. When file encryption behaviour is detected, the device is isolated from the network automatically – preventing the ransomware from spreading to mapped drives, shared folders, and other devices. Where our EDR platform supports it, VSS-protected file rollback can restore encrypted files to their pre-attack state without requiring a full restore from backup. For a full walkthrough of how to respond to and eradicate a threat identified by EDR, see: Responding to Alerts in EDR and EDR Eradication.

Microsoft Defender for Endpoint – Our Managed Platform Code Hyper One deploys and manages Microsoft Defender for Endpoint (MDE) as the primary EDR platform for our Sydney clients. MDE provides enterprise-grade EDR capability included in Microsoft 365 Business Premium and E5 licences – meaning most of our Microsoft 365 clients already have access to the platform without additional licensing. The gap is not the software; it is the expertise to configure it correctly and the 24/7 operational resource to act on what it detects.

Code Hyper One provides both – deploying MDE with a security-hardened configuration, onboarding all enrolled endpoints, and monitoring alert queues continuously so that a threat detected at 3am on a Saturday is actioned within minutes, not discovered on Monday morning. For the full breakdown of Microsoft Defender for Endpoint capabilities, see our Microsoft Defender services.

NGAV is the preventive layer – blocking known malicious files and code before they execute. While EDR addresses what antivirus cannot, NGAV still plays a critical role in catching the high-volume commodity malware that continues to target Australian businesses at scale.

What our NGAV service delivers:

Signature and AI-Based Detection Our NGAV combines traditional signature-based scanning with machine learning models trained on global malware samples to identify malicious code based on structural characteristics, not just exact signature matches. This catches polymorphic malware variants that evade pure signature detection while remaining significantly lighter on system resources than legacy AV products.

Real-Time Protection with Cloud Intelligence Threat intelligence is continuously updated via the cloud – when a new malware sample is identified anywhere in our vendor's global install base, all enrolled endpoints have protection against it within minutes without requiring a local update cycle.

Lightweight Agent – No Performance Impact Our NGAV agent is optimised for minimal system resource usage. Your staff will not notice it running. The days of AV products that consume 30% of CPU during scans and slow down laptops are over – our NGAV runs silently in the background without impacting the performance of the devices it protects.

Scheduled and On-Demand Scanning In addition to real-time file scanning, scheduled deep scans run during off-hours – scanning every file on every enrolled device against the full threat database without impacting business hours performance.

DNS protection is the network layer – stopping malicious internet connections before they are established. When a device on your network attempts to connect to a malicious domain (a phishing site, a command-and-control server, a malware distribution host, or a site on a security blocklist), DNS filtering intercepts the DNS lookup request and blocks the connection before a single byte of malicious content reaches the device.

Why DNS protection is the most underappreciated endpoint security control:

Every internet connection your devices make begins with a DNS lookup – translating a domain name into an IP address. By filtering at the DNS layer, malicious connections are blocked at the earliest possible point in the attack chain – before a malicious file is downloaded, before a phishing page is rendered, before a command-and-control beacon reaches its server. This is why DNS protection is sometimes called the "first firewall" – it acts before anything else has a chance to be compromised.

What our managed DNS protection service delivers:

Malicious Domain Blocking Our DNS protection platform maintains continuously updated blocklists of known malicious domains – including phishing sites, malware distribution hosts, botnets, command-and-control servers, and cryptocurrency mining domains. Attempts by your endpoints to resolve these domains are blocked silently, with no action required by the user.

Protective DNS (PDNS) Compliance The Australian Cyber Security Centre (ACSC) actively promotes Protective DNS as a baseline security control for Australian businesses and government agencies. Our DNS protection service aligns with ACSC's PDNS guidance, using the same category of threat intelligence feeds used by government agencies. For broader DNS and SSL infrastructure context, see our DNS and SSL services.

Category-Based Web Filtering Beyond malicious domain blocking, our DNS protection enables category-based web filtering – blocking access to specific categories of websites (gambling, explicit content, peer-to-peer file sharing, anonymisation proxies) that represent either productivity risks or security risks for your business. Policies are configurable per user group, per device, and per business hours schedule.

DNS-Layer Visibility and Reporting Every DNS query from every enrolled device is logged – giving Code Hyper One and your designated IT contact complete visibility into every website your fleet is attempting to reach. This is invaluable for incident response (identifying devices that contacted a malicious domain before it was added to the blocklist), compliance reporting (demonstrating policy adherence), and security audits.

Remote Worker Coverage DNS protection via an agent-based deployment covers every enrolled device regardless of network location – staff working from home, from a café, or from a client site are protected by the same DNS filtering policies as in-office devices, without requiring them to connect through a VPN.

The distinction between "having endpoint security software" and "having managed endpoint security services" is not a minor one. It is the difference that determines whether your security tools produce outcomes or just produce logs.

Alert monitoring and triage EDR platforms generate alerts – hundreds or thousands per week in an active business environment. Not all alerts are equal. Some are genuine critical threats requiring immediate response. Some are high-severity findings requiring investigation within hours. Some are low-severity informational events. Most are false positives – legitimate activity that superficially resembles malicious behaviour.

Without a managed service, these alerts land in a queue that someone in your business needs to review, triage, and act on – every day, including weekends and holidays, including 3am. For most Sydney businesses without a dedicated security operations team, this simply does not happen. Alerts accumulate. Real threats sit undetected.

Code Hyper One's managed endpoint security service provides:

• Continuous alert monitoring across all enrolled endpoints
• Triage of every alert – distinguishing genuine threats from false positives
• Immediate automated response to critical threats (isolation, quarantine, process termination)
• Human escalation for complex or novel threats requiring engineering judgement
• Incident notification to your designated contact with a summary of what happened, what was done, and what action (if any) is required from your team

Policy management and tuning Endpoint security tools require ongoing configuration management. Detection policies need tuning to reduce false positives without reducing detection accuracy. Exclusion lists need management as new legitimate software is deployed. Rollback policies need updating as business processes change. Threat intelligence feeds need reviewing as the local threat landscape evolves.

Code Hyper One manages all of this as part of the managed service – your endpoint security posture improves continuously rather than degrading from the configuration it had on day one.

Patch management integration Many EDR alerts point to vulnerabilities in software that needs patching. Our managed endpoint security integrates with Datto RMM – so an EDR finding that a critical vulnerability is being exploited triggers an accelerated patch deployment to the affected device, closing the vulnerability that the attack exploited rather than simply containing the individual incident.

For a deeper look at how security monitoring and response works in practice, read our guide: How Security Monitoring Works.

Endpoint Detection and Response (EDR) has evolved into Extended Detection and Response (XDR) – and understanding the distinction helps buyers make informed decisions about the right level of protection for their environment.

EDR focuses on endpoint telemetry – data from workstations, laptops, servers, and mobile devices. It provides deep visibility into endpoint activity but has limited visibility into network traffic, cloud environments, and SaaS applications.

XDR extends detection and response across multiple security domains simultaneously – endpoints, email, network, identity, and cloud – correlating telemetry from all sources to identify attacks that span multiple vectors. An XDR alert might connect a suspicious email to a suspicious login to a suspicious process on an endpoint, giving a complete attack picture that EDR alone would miss.

For Sydney businesses running Microsoft 365, Microsoft's XDR capability (Microsoft Defender XDR, formerly Microsoft 365 Defender) correlates signals from Microsoft Defender for Endpoint (EDR), Microsoft Defender for Office 365 (email), Microsoft Defender for Identity (Active Directory), and Microsoft Defender for Cloud Apps (SaaS) – delivering XDR capability through the Microsoft security stack that Code Hyper One manages. For the full comparison, read our guide: XDR vs EDR: What's the Difference?

ASD Essential Eight

The Essential Eight directly requires endpoint security controls at every maturity level:

• Application Control (ML1+) – preventing unauthorised executables from running on workstations. Our EDR and NGAV enforcement implements application control
• Patch Operating Systems (ML1+) – keeping operating systems patched. Our managed service integrates endpoint patching via Datto RMM
• Configure Microsoft Office Macro Settings (ML1+) – our Microsoft 365 management enforces macro policy via Group Policy and Intune
• User Application Hardening (ML1+) – disabling unnecessary features commonly exploited in endpoint attacks

At ML2 and ML3, the Essential Eight requires multi-factor authentication, privileged access controls, and formal security monitoring – all delivered through our managed endpoint security and Microsoft Entra ID management services. For the full Essential Eight requirements, see our Essential Eight Checklist 2026.

Privacy Act 1988

The Privacy Act 1988 (Cth) and the Australian Privacy Principles require organisations to take "reasonable steps" to protect personal information from misuse, interference, loss, and unauthorised access or disclosure. Managed endpoint security – specifically EDR monitoring, NGAV protection, and DNS filtering – represents documented, active reasonable steps for endpoint security, directly relevant to Privacy Act compliance particularly for businesses handling significant volumes of personal data.

APRA CPS 234

For financial services entities regulated by APRA, CPS 234 requires information security controls commensurate with the threats to information assets. Endpoints – as the primary entry point for most attacks – require documented, actively managed security controls. Our managed endpoint security service produces the monitoring logs, incident records, and configuration documentation required for APRA supervisory review.

Cyber Insurance

Australian cyber insurers now commonly require: EDR deployed on all endpoints, active 24/7 monitoring, MFA on all accounts, and evidence of patch management – as conditions of policy issuance. Our managed endpoint security service satisfies EDR, monitoring, and patching requirements. For the full picture of what cyber insurers require in 2026, see our cyber insurance requirements guide.