Aug 2026teamlogicit.live
Announcement 01 · Device & accountManaged endpoint & identity detection and response
Two ways in, one team watching both: your computer and your login.
Attackers arrive one of two ways — they run something on your machine, or they simply sign in as you. This single platform covers both, and the same analysts review what it finds around the clock. It is one rollout, not two: the same install window, the same escalation path, the same phone call if something is wrong.
Half one · On the device
Behavior, not filenames
Traditional antivirus works from a list of known-bad names. Attackers now use tools already installed on your machine, so there is no file to recognize. A small background agent watches what programs do — a document that launches a script, a tool that copies itself into startup, a foothold left behind for later.
Half two · On the account
The sign-in that shouldn't be
Your email and files live in the cloud, so an attacker doesn't need your laptop — they need your account. A read-only connection to your organisation's identity system learns your usual locations, devices and hours, then watches for sign-ins that don't fit and the quiet changes that follow one.
Step one
It goes in quietly
A light agent is pushed to every managed computer — no restart, no icon in your way — while the cloud side connects with read-only access. Nothing is installed on your device for the account half.
Step two
It learns what normal is
Which process chains your work actually produces, and which locations, devices and hours your account actually uses. Then it flags only what breaks the pattern.
Step three
A human decides, then acts
Findings reach an analyst before they reach you. A confirmed threat means an isolated machine or a revoked session and password reset — plus a phone call. Noise gets closed silently.
What this catches — on the device
The invoice that runs code. You open an attachment that looks like a PDF. Instead of a document, it silently starts a built-in Windows scripting tool, which reaches out to an unfamiliar server. Nothing on disk is "a virus" — but a document starting a script and phoning out is a chain no normal workflow produces. The machine is isolated within minutes.
The remote-access tool you didn't ask for. A support scam or a rogue installer leaves behind a legitimate, commercially sold remote-control program. Antivirus won't touch it — it's real software. But an unmanaged remote tool appearing on a workstation gets flagged, because the question is not "is this software bad" but "does this belong here."
The foothold that waits. Attackers often break in weeks before they act, leaving a small entry to come back to — a scheduled task, a new service, a registry entry that runs at login. These persistence tricks are exactly what the agent inventories, so the quiet phase gets caught instead of the ransom phase.
What this catches — on the account
The hidden inbox rule. The classic sign of a taken-over mailbox. The attacker creates a rule that files anything mentioning "invoice," "wire," or "payment" straight into a folder you never open — so you don't see the replies while they redirect a payment. A brand-new rule that hides finance keywords is an immediate alert.
Two places at once. You sign in from the office at 9:02 a.m. Eleven minutes later the same account signs in from another country. No one travels that fast — so either a password is being shared, or it has been stolen. The pattern gets flagged even when both sign-ins "succeeded."
The extra authenticator. After a successful phishing attempt, attackers register their own second factor so they can return whenever they like — long after you change your password. A new authentication method nobody requested is treated as a compromise, not a convenience.
What you'll notice
Almost nothing
No new login, no daily prompts, no scan window interrupting your afternoon. The two times you will hear from us are the times it matters: your machine being isolated, or being signed out of everything at once and asked to set a new password. Both are deliberate, and someone will already be calling you.
What we need from you
Stay on and stay alert
Leave computers powered on and connected during the rollout window. And approve multi-factor prompts only when you personally triggered the sign-in — if one arrives out of nowhere, deny it and report it. An unexpected approval request means someone already has your password.
Is anyone reading my files, my email, or watching my screen?
No. On the device it records how programs behave — what started what, what connected where. On the account it reads sign-in records and settings — who logged in, from where, what changed. Not screen recording, not keystrokes, not document or message contents.
Does this replace antivirus, or multi-factor?
Neither. Antivirus still handles the known, named threats efficiently; multi-factor is still essential. Both are now insufficient alone — modern phishing pages capture the code as you type it or steal the session afterward. This layer covers what happens past that point.
Will it slow my computer down?
It is designed to be light — no full-disk scans, minimal memory. If a machine feels slower after install, tell us; that's a fault to fix, not something to live with.
What if I'm travelling?
Travel alone doesn't trigger anything. It's the impossible combinations and the follow-on changes that do. Telling us about long trips in advance still helps us close alerts faster.
Questions about any of this
Ask before you work around something. If a block, a prompt, or a new step is getting in the way of your job, that's worth a two-minute conversation — the fix is usually immediate, and the workaround usually isn't safe.
teamlogicit.live