Services
Our Services Managed IT Managed Security
About Why Us Contact
Managed Security

Security that's enforced,
not hoped for.

The threats facing small businesses have grown up. Phishing is smarter, ransomware now targets small businesses just as aggressively as large ones, and employees are routinely pasting confidential data into AI tools without realizing the exposure. MindIT Managed Security is a structured program designed for businesses of 5 to 75 people - two levels, two add-ons.

What "enforced" means: Every setting we configure is pushed to your devices by policy and either locked at the OS level or automatically reapplied if something changes. Your team no longer needs to make the right security choice - the policy makes it for them. Disk encryption activates whether the employee does anything or not. Browser restrictions apply even if someone tries to get around them. When a setting drifts, the policy corrects it.
Structure

Two levels. Two add-ons.

Start with the level that fits your environment, then add what makes sense for your business.

Level 1 - Required

Security Essentials

The foundation every client starts with: control over AI tools, hardened devices, and protected identities, with premium managed antivirus on every computer, hardened and monitored beyond the built-in defaults. Works with Microsoft 365 and Google Workspace.

Level 2 - Recommended

Active Computer Defense

24/7 expert monitoring and active threat response with behavioral detection - not just signature-based antivirus. Managed Detection and Response (MDR) by ThreatDown.

+ Phishing Awareness & Training + Password Manager Managed Service
Level 1 - Required

Security Essentials

The foundation every client starts with. Three things every small business needs now, set up once and enforced automatically. The first group below applies to every client on Windows and Mac; the Microsoft 365 and Google Workspace groups add items specific to whichever platform your business runs.

AI Security

Your team is pasting customer records, contracts, and financials into ChatGPT and other AI tools, usually without realizing the data has left your control. We set the rules for AI use, enforce them at the network level on company browsers, and give you a written AI Use Policy for your handbook.

Device Hardening

Every company computer gets premium, centrally managed antivirus, hardened and monitored well beyond the built-in defaults, plus automatic disk encryption, locked-down browsers, and operating-system hardening that closes the doors attackers rely on. Windows and Mac.

Identity Hardening

Most break-ins start with a stolen password, not a virus. We enforce multi-factor authentication, shut off outdated and risky sign-in methods, and watch your accounts for the early signs of takeover, like a mailbox quietly forwarding your email to an outsider.

And it stays enforced. Every protection is monitored continuously. When a setting is switched off, drifts, or gets changed, our platform flags it and reapplies it, so your security holds instead of quietly eroding over time. We also tune these protections as threats evolve, so your defenses keep pace instead of going stale.
Every Client Windows, Mac, and all environments
  • Premium managed antivirus on every computer, hardened and monitored beyond what the built-in antivirus does on its own
  • macOS security hardening and fleet management via Mosyle MDM - firewall, Gatekeeper, FileVault enforcement, screen lock, update enforcement, sharing and app-permission controls
  • Drive encryption with recovery key escrow - BitLocker on Windows, FileVault on Mac
  • Managed browser security across Chrome, Edge, Firefox, and Brave; on Mac, Safari is disabled so staff stay on a protected browser
  • AI tool governance and DNS-layer threat protection on managed browsers
  • Office macro restrictions - blocks macros in files downloaded from the internet
  • Removable storage control - malicious USB execution blocked on every computer, with optional write-blocking available to stop data being copied off to USB drives, discs, or phones
  • Continuous monitoring with automatic drift correction - protections are checked across your fleet and reapplied when they change
  • Policy tuning as threats evolve - we update and tighten your protections in response to new attack techniques
  • Account-takeover monitoring - including detection of suspicious mailbox auto-forwarding rules
  • Personnel policy templates - Acceptable Use Policy and AI Use Policy, written and provided as part of onboarding
  • Quarterly executive security report showing exactly what was blocked (malicious sites, phishing and malware email, threats stopped); annual 1-hour security review
Windows device hardening the security baseline behind every Windows endpoint
Antivirus catches known-bad files. Hardening removes the openings attackers rely on before any file runs, and it is re-checked and reapplied on a schedule rather than set once and forgotten. Delivered automatically to every Windows endpoint and re-verified weekly, on whatever licenses you already have. More than 250 individual device settings are enforced across the categories below.
  • Credential protection - stops attackers from stealing passwords and tokens out of memory: LSASS protection, Credential Guard and virtualization-based security, no stored LM hashes, and plaintext-credential blocking
  • Attack surface reduction - Microsoft Defender ASR rules block the techniques ransomware and malware rely on (credential theft from LSASS, malicious USB content, Office and script-spawned processes, abuse of vulnerable signed drivers), with Controlled Folder Access guarding your files
  • Network and protocol hardening - NTLMv2-only authentication, required SMB signing, SMBv1 disabled, and LLMNR, NetBIOS, and WPAD shut down to close the quiet name-resolution paths used to capture credentials
  • Exploit and escalation defense - Data Execution Prevention and SEHOP system-wide, Microsoft's vulnerable-driver blocklist, AutoRun and AutoPlay disabled, and privilege-escalation paths such as AlwaysInstallElevated and anonymous enumeration closed
  • Service and access lockdown - unnecessary remote services disabled (Remote Registry, Telnet), the print spooler's remote attack surface mitigated against PrintNightmare, and null-session and anonymous share access denied
  • Host firewall and privacy - Windows Firewall enforced on all profiles with inbound blocked by default, advertising ID and consumer and telemetry features disabled, and UAC tuned to prompt on the secure desktop
  • Security audit logging - the events needed to investigate an incident are turned on and captured: PowerShell activity, full command-line detail on every process that runs, and failed sign-in and account-lockout tracking
Added for Microsoft 365 requires M365 Business Premium
Everything above is already in place on your existing licenses. Business Premium builds on that hardened foundation with the identity, cloud, and device-management controls only the Microsoft 365 platform can enforce.
  • Multi-factor authentication enforced for all users, with legacy authentication and device-code sign-in flows blocked outright
  • Stronger protection for administrators - phishing-resistant MFA required for admin accounts, plus separate MFA enforcement for Azure management and guest access
  • Defender for Office 365 - Safe Links, Safe Attachments, anti-phishing, anti-impersonation, ZAP
  • Intune device compliance standard - devices are held to a baseline that requires disk encryption and Secure Boot, with Windows Hello PIN sign-in
  • OneDrive policy management for known-folder backup and controlled file sync
  • Mobile app protection (MAM/BYOD) - corporate data isolated from personal apps on iOS and Android, with selective remote wipe on departure or loss
  • Available to enable per your needs - tighter sign-in session lifetimes, mandatory app protection for mobile email, and blocking of unmanaged or personal devices
  • Ongoing review and tuning as Microsoft's platform and the threat landscape change
Added for Google Workspace if your business runs on Google Workspace
  • Identity hardening - 2-Step Verification enforcement, Advanced Protection Program enrollment for high-risk users
  • Gmail security hardening - anti-phishing, attachment scanning, link warnings, external sender markers, SPF/DKIM/DMARC configuration
  • Google Drive sharing policy audit and remediation - external sharing, anonymous links, and shared drive permissions
  • Chrome browser policy enforcement via the Google Workspace Admin console
Level 2 - Recommended

Active Computer Defense

Security Essentials already puts premium, managed antivirus on every computer. Active Computer Defense adds the part antivirus alone cannot do: a 24/7 team watching for behavioral attacks and ransomware, ready to step in and shut them down the moment they start.

ThreatDown Elite Managed All environments
  • ThreatDown Elite premium endpoint protection on all in-scope computers
  • 24/7/365 monitoring, investigation, and threat response by Malwarebytes MDR analysts
  • Endpoint detection and response (EDR) with managed threat hunting
  • Automated ransomware rollback, up to 7 days post-incident
  • Advanced host-based firewall policy, device control, and application blocking
  • Dedicated incident-response engagement available on demand for serious incidents
  • MindIT manages customer-side incident response during business hours; ThreatDown SOC handles after-hours containment
Optional Add-Ons

Add what makes sense for your business

Each add-on is independent. Mix and match based on your risk profile, compliance requirements, and budget.

Phishing Awareness & Training

The people layer. Most breaches start with a click. Train the click out of your team with ongoing simulated campaigns and microlearning.

  • KnowBe4 - monthly simulated phishing campaigns and microlearning modules
  • Phish-prone percentage tracking per user
  • Compliance-ready training records (HIPAA, PCI, cyber insurance)
  • Quarterly results integrated into the executive security report

Password Manager Managed Service

Bitwarden Teams deployed across your business - and browser password saving disabled centrally so the manager is the easy path, not just an option people ignore.

  • Bitwarden Teams license with default vault structure (HR, Finance, IT, Shared)
  • Browser password saving disabled centrally across managed devices
  • Provisioning tied to employee onboarding and offboarding
  • 30-minute group training session at launch
Mind IT Services
← Back to minditservices.com

(651) 317-9646  ·  Twin Cities, MN  ·  minditservices.com