Ransomware, credential theft, and data breaches aren’t a matter of if — they’re a matter of when. That’s why every Managed and Co-Managed IT client at Portolan Networks gets our minimum security baseline, not cybersecurity as an afterthought or an upsell.
Ransomware, credential theft, and data breaches aren’t a matter of if — they’re a matter of when. That’s why every Managed and Co-Managed IT client at Portolan Networks gets our minimum security baseline, not cybersecurity as an afterthought or an upsell.
Cybersecurity Services for Sarasota Businesses
Every Portolan Networks Managed IT plan includes a cybersecurity baseline: endpoint detection and response backed by a 24/7 human-staffed security operations center (EDR/MDR), DNS filtering and privileged access management (PAM). It’s built into the price, not sold as an upgrade. On top of that, we offer email, identity and training protections matched to your risk and your insurance requirements.
Included as Your Baseline
Every Managed IT plan includes three core protections, built into your per-user price. We review the baseline every year to keep pace with new threats.
- EDR/MDR. EDR watches each computer for suspicious behavior. MDR puts people behind it: alerts go to a 24/7, human-staffed security operations center that investigates and acts. We use Huntress Labs.
- DNS Filtering. Stops connections to known malicious and phishing sites before a page loads. We use DNSFilter.
- Privileged Access Management (PAM). Removes everyday admin rights and controls when elevated access is granted. We use CyberFox AutoElevate.
For Co-Managed clients, we’ll work with tools you already have where they’re solid. If your existing setup is outdated or ineffective, we may recommend a change that fits our shared security standards.
Additional Protection, Tailored to You
Beyond the baseline, we offer additional layers of protection based on your business’s specific risk and needs:
Identity Threat Detection and Response (Microsoft 365)
Continuous monitoring of your Microsoft 365 tenant for signs of compromise, including credential theft, session hijacking, rogue OAuth applications, impossible travel, and token theft. Included with every Microsoft 365 plan we manage.
Security Posture Management
Ongoing monitoring to catch misconfigurations before they become vulnerabilities, available for your Microsoft 365 identity environment, your endpoints, or both.
Vulnerability Management
Regular scanning of PCs and network devices to detect outdated software and insecure configurations before an attacker finds them first.
Security Awareness Training
Because human error remains the leading cause of data loss, we help train your team to recognize and avoid the threats that target them directly. We use Huntress Managed Security Awareness Training. Included with every Microsoft 365 plan we manage.
Email Threat Protection
Blocks spam and fraud, scans attachments for viruses and malicious code, and verifies links before your team ever clicks them. We use Proofpoint. Included with every Microsoft 365 plan we manage.
Managed Firewalls
We sell, install, and actively manage and monitor your firewall, so it stays configured correctly, not just installed and forgotten.
Business Password Managers
We roll out and support password manager software for your team, with policy guidance and training available as needed. We use Keeper Security.
Secure Remote Access (Zero Trust Network Access)
Lets employees reach the specific company apps and files they’re allowed to use from home or on the road, after verifying the person and the device. Unlike a traditional VPN, a compromised laptop doesn’t get a path into your whole network. We use Timus Networks.
What cyber insurers usually ask about
If you’ve filled out a cyber insurance application or renewal recently, these questions probably look familiar. They’re the ones we see most often. The exact list varies by carrier and changes from year to year, so check your own application.
| Insurer question | How we cover it |
|---|---|
| Is MFA enforced on email and remote access? | Microsoft 365 configuration, plus Security Posture Management to keep it enforced |
| Do you have EDR on every endpoint? | Included in the baseline (EDR/MDR) |
| Is EDR monitored 24/7? | Yes, by a human-staffed security operations center |
| Do you run security awareness training? | Included with our Microsoft 365 service; available as an add-on otherwise |
| Is email filtered for phishing and malware? | Included with our Microsoft 365 service; available as an add-on otherwise |
| Are admin rights restricted? | Included in the baseline (PAM) |
| Do you have offsite, tested backups? | Backup and disaster recovery |
We can’t tell you how any of this affects your premium; that’s a conversation for your broker. But we can make sure your answers are accurate.
Learn More
We’ve written plain-language guides on the threats these tools are built to stop:
Common Questions
No — it’s part of our minimum included baseline, not an optional add-on. EDR/MDR, DNS filtering, and PAM come built into our core Managed IT offering itself, and we review this baseline annually to make sure it keeps pace with evolving threats. We hold to this because a client without adequate security protections poses a real risk both to their own business and to the relationship as a whole.
It depends on the scope of our engagement — if we’re not managing your workstations directly, there’s more room for flexibility. That said, we still strongly recommend implementing these protections at a minimum, regardless of whether we’re the ones managing them. Your cyber insurance provider will very likely require the same baseline anyway, so it’s worth having this conversation sooner rather than later.
EDR (Endpoint Detection & Response) is the technology that detects suspicious activity on your devices. MDR (Managed Detection & Response) is that same technology backed by actual humans watching it. A lot of businesses have EDR running with no one monitoring the alerts it generates — which means threats can sit unnoticed until real damage is done. What we provide is true MDR: EDR backed by a 24/7, human-staffed security operations center, so detected threats are actually seen and acted on, not just logged.
It depends on your environment. We strongly recommend Email Threat Protection and Security Awareness Training for every client — both are typically required by cyber insurance providers anyway — but these do require a compatible business email platform. If you’re using a free email service like a personal Gmail account, we’re unable to offer them. The same compatibility requirement applies to Identity Threat Detection and Response and Security Posture Management. Endpoint Security Posture Management and Vulnerability Management aren’t currently required, though we reevaluate our baseline annually and expect that to change in the future. Many businesses start out on a free email account due to budget or unfamiliarity with the alternatives — if that’s you, we’re happy to help you move to a business-class email platform with your own domain, every step of the way.
These work together, but catch different things. Identity Threat Detection and Response (ITDR) watches for signs that an attack is actively happening — things like credential theft, session hijacking, rogue applications, impossible travel, and stolen login tokens. Security Posture Management (SPM) works earlier in the process: it continuously checks your Microsoft 365 and endpoint configurations for misconfigurations or unauthorized changes that could create an opening for an attacker in the first place. Think of it this way: SPM makes sure the doors and windows are properly locked. ITDR is the alarm system that goes off if someone gets in anyway. You genuinely need both — one without the other leaves a real gap.
Browser-based password managers aren’t built for business use, and they’re generally less secure than a dedicated business password manager. A real password manager helps your team create and rotate strong, unique passwords, and lets you securely share credentials when needed — like sharing a banking login with your accountant — without anyone actually seeing the password itself. The bigger issue is offboarding: when an employee leaves, a business password manager lets you instantly revoke or reassign their access to company passwords. Chrome’s built-in password manager syncs to that employee’s personal Google account — meaning if they leave the company, they could still have access to every password they ever saved, with no way for you to revoke it.
Not sure where you stand?
If you’re unsure what protections you have today, or what your insurer will ask for at renewal, book a time on my calendar and I’ll walk through it with you. Or call (941) 200-4360.
Pat Midzio
Founder & Chief Technologist