Managed Endpoint Security & CVE Remediation
Vulnerabilities Found, Then Fixed
Our fully managed endpoint security tier. We detect known vulnerabilities on every workstation and laptop, prioritise them by risk and fix them, while our SIEM platform monitors endpoint security events and our team reviews the alerts.
What is Managed Endpoint Security & CVE Remediation?
Every laptop and desktop runs an operating system and applications that regularly turn out to contain security flaws. Managed Endpoint Security is our fully managed tier for those devices: we find the flaws, fix them in order of risk and keep watch for signs of attack.
An agent on each device detects missing updates and known vulnerabilities, known as CVEs (Common Vulnerabilities and Exposures). Our team then prioritises what is found and remediates it, by applying patches, updating or removing vulnerable software, or changing settings where that is the fix.
Endpoint security events are also sent to our SIEM (security information and event management) platform for automated analysis. Alerts are reviewed by our team in line with your agreed service level, and actions such as isolating a device run automatically only where your endpoint tools support them and you have authorised the policy. On Advanced IT & Security, 24/7 investigation and containment of endpoint threats on onboarded devices are already provided by the included Pulsar IT Managed SOC, so this tier adds vulnerability remediation and SIEM telemetry rather than charging for that coverage again.
Key benefits
- Known vulnerabilities fixed by our team, highest risk first
- Replaces basic scanning, so you are never charged for both on the same device
- Endpoint security events analysed automatically by our SIEM platform
- Alerts reviewed by our team, with approved actions such as isolating a device
- Reporting on what was found, what was fixed and what remains open
How does it work?
This tier builds on Endpoint Protection, which must be in place on each device. On top of it we add vulnerability detection, remediation by our team and monitoring of the security events your devices produce.
Baseline
We enrol each workstation and laptop, run an initial vulnerability assessment and agree with you how fixes will be scheduled, tested and communicated to staff.
Prioritise and remediate
Findings are ranked by severity, whether they are known to be exploited and how exposed the device is. Our team then fixes them: patches, software updates, removal of unsupported applications or configuration changes.
Monitor and respond
Endpoint security events flow into our SIEM platform for automated analysis. Our team reviews alerts in line with your agreed service level, and approved automated actions run only where supported and authorised.
Verify and report
Devices are rescanned to confirm fixes worked, and regular reports show open vulnerabilities, remediation progress and notable security events.
- DiscoverAgent finds missing updates and CVEs on each device
- PrioritiseRanked by severity, exploitation and exposure
- RemediateFixed by our team: patch, update, remove or reconfigure
- ReassessRescan confirms the fix and finds anything new
Technical scope
- Agent-based vulnerability detection on each enrolled workstation and laptop
- Identification of missing operating system and application updates and known CVEs
- Risk-based prioritisation using severity ratings and evidence of active exploitation
- Remediation by our team: patching, software updates, removal of unsupported software and configuration changes
- Rescanning to verify that remediation has worked
- Collection of endpoint security events into our SIEM platform
- Automated analysis and alerting using detection rules
- Alert review by our team in line with your agreed service level (on Advanced IT & Security, endpoint threats on onboarded devices are investigated 24/7 by the included Pulsar IT Managed SOC instead)
- Approved automated response, such as isolating a device from the network, where supported and authorised
- Escalation of confirmed incidents to your nominated contacts
- Regular vulnerability and security event reporting
Examples of what we handle
A flaw in everyday software
A new CVE is published for a widely used browser or document reader. Affected devices are identified, updated by our team and rescanned to confirm.
Software past its end of support
An old application no longer receives security fixes. We flag it, explain the risk and agree a replacement or removal with you.
Suspicious behaviour on a laptop
Endpoint protection reports unusual activity. The SIEM raises an alert, our team reviews it and, where you have authorised it, the device can be isolated while it is investigated.
A fix that is a setting, not a patch
Some vulnerabilities are closed by changing a configuration rather than installing an update. We make the change through our normal change process.
Problems solved
Vulnerability reports nobody acts on
Scanning without remediation leaves the risk in place. In this tier our team fixes what is found.
Patching that misses third-party apps
Operating system updates are often handled while browsers, readers and other applications fall behind. CVE remediation covers the applications too.
Too many findings to know where to start
Hundreds of findings can be overwhelming. Risk-based prioritisation puts the dangerous ones first.
Device alerts nobody sees
Security software raises warnings that can go unread. Our SIEM platform analyses them and our team reviews the alerts.
Slow containment of an infected device
An infected laptop left on the network can affect others. Approved automated isolation can contain it quickly where supported.
What's included
Included as standard
- Vulnerability detection on each enrolled device (replaces Basic Endpoint Vulnerability Scanning)
- Vulnerability remediation: identified CVEs prioritised and fixed by our team
- Automated monitoring of endpoint security events through our SIEM platform
- Alert review by our team in line with your agreed service level
- Approved automated response, such as isolating a device, where supported by your endpoint tools and authorised by you
- Regular vulnerability and security reporting
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- SIEM monitoring of your firewall logs, through Managed Firewalls
- Scans of servers, switches and internet-facing systems, through Network Vulnerability Assessments
- Incident response planning, through Security Monitoring & Incident Response Readiness
What's not included
- Endpoint Protection, which is required on each device and priced separately unless included in your plan
- Software licences, upgrades or hardware needed to fix a vulnerability, such as replacing unsupported software
- Devices that are not enrolled, and personal devices unless specifically agreed
- 24/7 SOC analyst investigation and containment, which come from Pulsar IT Managed SOC (included in Advanced IT & Security), not from this service
- Full incident investigation and recovery beyond initial response, which is scoped separately
Some vulnerabilities have no fix available yet, or can only be resolved by replacing software or hardware. We explain the options and any interim measures, such as restricting the affected software.
Monitoring is automated and alerts are reviewed by our team in line with your agreed service level. Automated responses run only where your endpoint tools support them and you have authorised the policy.
This tier replaces Basic Endpoint Vulnerability Scanning on the same device. Where your plan already includes basic scanning, the managed tier is charged at its full price; any adjustment for the overlap is subject to Pulsar IT approval and confirmed at scoping.
Who it's suitable for
- Businesses that receive vulnerability reports but lack the time to act on them
- Organisations without in-house security staff
- Businesses handling sensitive client, financial or personal data
- Teams with many laptops working away from the office
- Companies working towards Cyber Essentials, where timely patching is required
Pricing
Priced per workstation or laptop per month. This tier replaces Basic Endpoint Vulnerability Scanning on the same device, so the two are never charged together, and it requires Endpoint Protection on each device.
Use the quote builder to add Managed Endpoint Security & CVE Remediation to an indicative quote, or book a free security review and we'll recommend what fits.
Price
£10 per device / month
Replaces Basic Endpoint Vulnerability Scanning on the same device. Where your plan already includes basic scanning, this tier is charged at its full price; any adjustment for the overlap is subject to Pulsar IT approval and will be confirmed at scoping.
What affects the price
- Number of workstations and laptops
- Endpoint Protection on each device (required)
- Operating systems and applications in use
- Size of the initial remediation backlog
- Automated response policies you choose to authorise
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Do I pay for basic scanning and this service on the same device?
No. Managed Endpoint Security replaces Basic Endpoint Vulnerability Scanning, so the two are never charged together for one device. If your Advanced plan already includes basic scanning, the managed tier is charged at its full price of £10 per device per month; any adjustment for the overlap is subject to Pulsar IT approval and confirmed at scoping.
How do you decide which vulnerabilities to fix first?
We look at the severity rating, whether the flaw is known to be exploited by attackers, and how exposed the device and software are. Actively exploited flaws on widely used software usually come first; low-risk findings are scheduled in.
Will fixing vulnerabilities disrupt my staff?
Most fixes are routine updates applied in the background. Where a fix needs a restart or could affect a business application, we agree timing with you and test where practical before rolling it out.
Which automated actions can run without asking me?
Only those you approve during onboarding. Isolating a laptop that shows clear signs of compromise is a typical example. It stops the device talking to the rest of the network, which also stops that person working, so we agree carefully when it should happen.
Is this the same as the Advanced plan?
No. The Advanced IT & Security plan includes Endpoint Protection, Basic Endpoint Vulnerability Scanning, which finds and reports vulnerabilities, and 24/7 SOC-backed endpoint monitoring through Pulsar IT Managed SOC once your devices are onboarded. This managed tier is an optional addition that fixes the vulnerabilities and adds SIEM telemetry for correlation with your other monitored systems. It does not charge again for the threat investigation and containment that Managed SOC already provides on Advanced.
Does it cover servers?
The service is priced per workstation and laptop. Servers are managed through Managed Servers, and any server vulnerability work beyond that is agreed during scoping.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.