Skip to content
Book a risk assessment

Device Shield.

Attacks stopped on the device, and every alert explained.

Protection for your laptops and servers, rolled out in rings with no unprotected gap and tuned from evidence. Every device alert goes through Verdict, and a compromised device can be cut off mid-attack.

Price
$4 per device, monthly
Included
Incident analysis and isolation
Runs on
Your Microsoft licence, or a partner tool
Northbank Advisory · 45 devices in three ringsExample
Day 5
Device Shield
5
Both running
15
Old antivirus
25
Unprotected
0

Early ring: 15 more devices. Both tools run side by side.
No unprotected gap

Your old antivirus stays on until the new one has proved itself.

Switching protection is when a business is most exposed. We run both side by side, then remove the old one ring by ring.

One pilot laptop, days 1 to 4Example
Old antivirus
Device Shield
Your laptop
Blocking
Removed
Watching, not blocking
Blocking
Protected the whole time

Day 3: two healthy days on the new tool, so the old one comes off.

  • Pilot first

    IT and one volunteer per team go first, so problems show up on five devices, not forty-five.

  • Side by side

    The new tool installs in watch mode while the old one keeps blocking.

  • One-step rollback

    If anything breaks, that ring rolls back in one step. The old antivirus is still there until it's safe to remove.

Attack blocking

Blocking rules go on when the evidence says they're safe.

Each rule starts in audit. It logs what it would have stopped, without stopping it. After 14 days we read the evidence and decide, rule by rule.

  • Office apps can't launch other programs
    0would-have-blocked events in 14 days
    Block
    Switched on after 14 quiet days
  • Nothing can read saved sign-ins from memory
    0would-have-blocked events in 14 days
    Block
    Switched on after 14 quiet days
  • No programs straight from email or webmail
    0would-have-blocked events in 14 days
    Block
    Switched on after 14 quiet days
  • No unsigned programs from USB drives
    3would-have-blocked events in 14 days
    Block, one exception
    The reception scanner's helper app is allowed by name
  • No remote commands through PsExec or WMI
    41would-have-blocked events in 14 days
    Stays in audit
    Your IT provider's tool relies on this. We're agreeing a safer method with them.
  • Office macros can't call Windows directly
    1would-have-blocked events in 14 days
    Block
    After one old spreadsheet macro is replaced
Incident analysis included

When a laptop is attacked at 2am.

Every device alert goes through Verdict with your Known Normal. Above your escalation line, the device is isolated straight away, if your containment settings allow it.

How Verdict decides
Laptop NB-LT-031 · Advisory teamExample
  1. 02:14:07
    Alert
    A Word document from email started PowerShell, which tried to download a file.
  2. 02:14:19
    Verdict: attack likely, 91%
    The sender's domain is a week old, this laptop has never run PowerShell, and the file has been seen nowhere else.
  3. 02:14:26
    Laptop isolated
    It can still reach us, and nothing else.
  4. 02:17
    Analyst confirms
    The download was blocked before it ran. No other device received the email.
  5. 02:21
    Sam gets a call
    The plain-English summary and next steps are already in the portal.
  6. 08:40
    Back to work
    Your IT provider reimages the laptop. The lookalike domain is blocked for every customer we protect.

One device, contained. If it had spread, Rapid Response takes over.

Coverage

Proof that every device is covered, every month.

Enrolled devices are checked against your device list. Anything missing or gone quiet shows up as a gap you can see, not a footnote.

Device coverage · Northbank AdvisoryPortal · Example
45 of 45devices on your list are enrolled
  • Protection on45/45
  • Tamper protection on45/45
  • Up-to-date protection updates44/45
  • Reported in the last 7 days44/45
Needs a look · 2
  • NB-LT-018 · Not seen for 9 daysOwner on leave
  • NB-LT-044 · Updates 3 days oldFixes itself at next sign-in
What it runs on

Runs on what you already pay for.

If your licence already includes endpoint protection, we use it. If not, we bring a partner tool. The service is the same either way.

Microsoft 365 Business Premium

Defender for Business is already in your licence. We switch it on and run it.

Nothing extra to buy

Microsoft 365 E3

E3 includes Defender for Endpoint Plan 1, which lacks the detection and response we rely on. Add Plan 2 or E5 Security.

Licence add-on needed

Some plans need a server add-on licence for servers. The platform check in the calculator shows what you'd need.

Price

$4 per device a month, counted from what's enrolled.

In this example, Northbank's 45 devices come to $180 a month. Incident analysis and isolation are included. Hands-on recovery is Rapid Response, sold separately.

Works well with Fix First Always On Rapid Response

Groundwork asks what you have. Device Shield proves it's protected.

Book Groundwork first, and we'll size the rollout from your answers.

Book Groundwork