For most small businesses, the practical answer is both: centrally managed endpoint protection plus accountable IT operations. Endpoint detection and response (EDR) or managed antimalware can block and investigate activity on devices, but neither one automatically provides multifactor authentication (MFA), patch management, least-privilege administration, protected backups, recovery testing, or incident response. A managed IT provider can operate those controls, yet outsourcing introduces provider-access and supply-chain risk that must be limited and monitored.
The right design is a written division of responsibility. Every device and account should be covered, alerts must reach someone who can act, backups must be isolated and tested, and your provider’s access and response duties must be explicit in the contract.
As an Amazon Associate I earn from qualifying purchases.
Why endpoint protection is necessary but not sufficient
Ransomware usually becomes a business-wide crisis when one compromised device, account, or remote-access path leads to broader privileges and encrypted data. Endpoint protection addresses the device portion of that chain. Centrally managed antimalware can detect known threats, while EDR records suspicious behavior and gives an administrator tools to contain a machine, investigate, and remove malicious activity. CISA’s #StopRansomware Guide recommends centrally managed antivirus together with EDR or application allowlisting where appropriate.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Those controls only help when they are deployed on the relevant laptops, desktops, servers, and virtual machines; configured consistently; kept current; and monitored. An EDR console that nobody reviews is a dashboard, not a response capability. Alerts also need a defined escalation path: who decides whether to isolate a device, who contacts leadership, and who coordinates restoration.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Endpoint software cannot, by itself, guarantee that a stolen password is unusable, that a vulnerable internet-facing service is patched, or that an attacker cannot encrypt every backup. CISA’s guidance places endpoint controls inside a broader set of measures that includes MFA, patching, secure configuration, least privilege, backup protection, and response planning.
What managed IT adds—and what it does not guarantee
Operational capacity
A managed IT service can supply the people and processes a small company may lack. Depending on the agreement, technicians can inventory devices, deploy endpoint agents, apply operating-system and application updates, remove unnecessary services, administer user accounts, and support recovery. A provider may also monitor security alerts or coordinate an incident outside normal office hours.
Those capabilities are contractual, not implied by the words “managed IT.” Some packages cover help-desk support and routine maintenance but exclude EDR, 24/7 alert review, secure backup architecture, restoration testing, or incident response. Ask for a control-by-control scope rather than relying on the service label.
Provider and supply-chain exposure
An MSP often has privileged, remote access to many customer systems. If its credentials, remote-monitoring tools, or administrative workstation are compromised, an attacker may gain a high-value route into multiple businesses. CISA specifically warns that MSPs can be ransomware infection vectors and recommends evaluating their cyber hygiene and limiting their access.
Oversight should include separate administrator accounts, MFA for provider personnel, logging of remote sessions, access limited to systems within the provider’s role, prompt removal of accounts when staff or contracts change, and a clear process for notifying you about a suspected compromise. Require the provider to explain how it protects its own management tools and credentials.
Endpoint security, managed IT, or both?
| Operating model | What it can deliver | Conditions and gaps to address | When it fits |
|---|---|---|---|
| Endpoint security alone | Central antimalware, EDR telemetry, device isolation, and investigation capabilities when configured and monitored. | Does not automatically provide MFA, patching, privilege management, protected backups, recovery testing, or an incident coordinator. | A company with capable internal IT and a documented process for reviewing alerts and acting on them. |
| Managed IT alone | Administration, maintenance, user support, and other services specifically listed in the agreement. | The label does not establish that EDR, after-hours monitoring, backup isolation, restore tests, or incident response are included. Provider access creates additional risk. | A company that needs outside operational capacity and verifies each security control in writing. |
| Endpoint security plus managed IT | Technical detection on devices combined with people who can deploy, maintain, monitor, and respond. | Responsibilities can still be ambiguous unless ownership, escalation, logging, backup protection, and response times are documented. | Most small businesses without dedicated security staff, provided the provider is carefully governed. |
The combined model is a practical synthesis of CISA’s layered recommendations, not a guarantee that every provider or product is adequate. A small business can also operate both layers with internal staff and a specialist security service rather than a single MSP.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build the minimum layered ransomware program
1. Inventory every device and service
Create an authoritative list of laptops, desktops, servers, network appliances, cloud workloads, remote-access gateways, and business-critical applications. Record the owner, operating system, location, administrator, and whether the device stores or can reach sensitive data. Include personally owned devices if they connect to business resources. You cannot verify coverage or close an alerting gap on systems you do not know exist.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Centrally manage antimalware and EDR
Install the chosen endpoint agent on every supported device and prevent local users from disabling it. Set a central policy for malware prevention, suspicious-script detection, tamper protection, and device isolation. Decide who reviews alerts, during which hours, and what severity triggers immediate contact. Test a harmless detection or vendor-provided simulation so you can confirm that the alert reaches the right person and that isolation works.
Application allowlisting can be appropriate where the software set is stable and the business can maintain an accurate list. It is not a substitute for patching and account controls; a trusted application running with excessive privileges can still be abused.
3. Require MFA for important accounts
Enable MFA for email, file storage, VPN and other remote access, administrator accounts, and any service that can reach critical systems. CISA’s small-business advice specifically emphasizes working with the IT provider to enable MFA across email, file storage, and remote access. Prefer phishing-resistant methods where your services support them, and maintain emergency recovery procedures so a lost device does not force MFA to be disabled.
4. Patch and harden systems
Apply operating-system, browser, application, firmware, and security-tool updates. Prioritize internet-facing systems and vulnerabilities that are being actively exploited. Remove unsupported software, disable unnecessary services, close unused ports, and separate administrative work from everyday browsing. Use standard user accounts for routine work and grant elevated privileges only when required. Keep a record of exceptions, their business justification, and their review date.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Protect backups from the attacker
Maintain backups of critical data that attackers cannot readily reach or encrypt. CISA recommends offline, encrypted backups and regular tests of availability and integrity. Keep at least one copy disconnected from ordinary network credentials, rotate media or storage destinations, and restrict who can delete or alter backup sets. Define which systems and files must be restored first, how long the business can operate without them, and where clean replacement systems will run.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
6. Prepare an incident process
Write down contacts for the business owner, IT administrator or MSP, endpoint provider, insurer or legal counsel if applicable, and law enforcement. Specify who can authorize device isolation, account disablement, network shutdown, and restoration. Preserve logs and affected devices for investigation instead of wiping them immediately. CISA’s response material includes a checklist; use it to turn a general plan into named tasks and decision points.
Questions to put to a managed provider
Request written answers and attach the agreed scope to the contract or statement of work:
- Which laptops, desktops, servers, cloud services, applications, and user accounts are covered?
- Is endpoint protection included? Which technology is deployed, and who reviews alerts?
- What happens outside business hours? Define monitoring hours, escalation contacts, and the expected response to a high-severity alert.
- Who patches operating systems and applications, how are failed updates identified, and how are exceptions approved?
- Who configures MFA and least-privilege roles, and how are administrator accounts reviewed?
- Who owns the backups? Identify protected copies, encryption, retention, storage locations, and deletion rights.
- How often is a restoration performed, what is restored, and who receives the test results?
- What provider accounts, remote-monitoring tools, VPNs, and API keys can reach your environment? How are they protected, logged, and removed?
- What are the notification, containment, evidence-preservation, and recovery duties when ransomware is suspected?
- How long are security and remote-access logs retained, and who can supply them during an incident?
Have the provider identify exclusions in plain language. For example, “backup monitoring” may mean checking whether a job completed, not proving that a usable restore is possible. “Security monitoring” may mean forwarding alerts without investigating them. Your contract should distinguish those activities.
Using an external drive for offline backups
An external hard drive can be a defensible storage medium for an offline backup because it can be disconnected after a backup job. The drive itself is not ransomware protection. Encrypt it before storing business data, keep it in a physically secure location, use a rotation schedule so one copy is not always connected, and limit who can access it. If the drive remains attached to a workstation or server with ordinary user credentials, ransomware may encrypt it along with the primary files.
Test restoration from the drive on a separate system. Confirm that files open, permissions are usable, and the result meets the business’s recovery priorities. Record the test date, data set, time required, and any failures. If an MSP manages the drive or another backup destination, verify its isolation and testing practices and place those requirements in writing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to test whether the plan works
Alert test
Use a safe test file or an approved simulation supplied by your security provider. Confirm that the endpoint agent detects it, the alert appears centrally, the assigned person receives it, and the response procedure identifies the affected device.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Access test
Review all administrator and provider accounts. Confirm MFA is active, privileges match current duties, former staff no longer have access, and remote sessions are logged. Check that a provider cannot reach systems outside its agreed role.
Recovery test
Restore representative files and, where possible, a complete system to an isolated environment. Measure whether the result meets the business’s stated recovery order. A successful backup job is not proof that the data can be recovered.
Tabletop exercise
Walk through a scenario in which an employee reports encrypted files while the MSP is unavailable. Decide who disconnects devices, who communicates with customers and staff, who preserves evidence, and who approves restoration. Update contact details and responsibilities after the exercise.
Common failure modes and fixes
- Agents installed but not monitored: assign an alert owner, define severity thresholds, and test escalation.
- “Managed” means only help desk: obtain a written list of included security controls and exclusions before signing.
- One administrator account controls everything: use named accounts, MFA, least privilege, and separate emergency credentials.
- Backups are online and writable: create disconnected, encrypted copies and restrict deletion rights.
- Backup jobs succeed but restores fail: schedule integrity and restoration tests and retain their results.
- Provider access is permanent: limit privileges, log sessions, review accounts, and remove access when no longer needed.
- Patching is informal: maintain an asset list, prioritize internet-facing systems, track failed updates, and document exceptions.
- No one knows who makes the first call: publish an incident contact sheet and rehearse the escalation path.
Choosing the operating model for your business
Choose endpoint security alone only when internal staff can maintain coverage, review alerts, administer accounts, patch systems, protect backups, and lead an incident. Choose managed IT when you need operating capacity, but select the provider by its documented controls rather than its marketing category. For most small businesses without security specialists, combine centrally managed endpoint protection with a provider or internal team that is contractually responsible for monitoring, maintenance, MFA, privilege control, backup isolation, restore tests, and response coordination.
Review the arrangement whenever you add cloud services, remote workers, new locations, or a provider with broader access. Ransomware resilience is an operating discipline: technology detects threats, people make decisions, and tested recovery limits the damage when prevention fails.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
