In short: Todyl Endpoint Security combines endpoint detection and response (EDR) with next-generation antivirus (NGAV) in the single Todyl agent. It monitors file and process activity in real time, uses managed detection rules and behavioural analytics, maps threats to MITRE ATT&CK, and can isolate hosts, quarantine files and stop processes. It is licensed per device, monthly.
What Todyl Endpoint Security is
Todyl Endpoint Security, billed as Todyl EDR & NGAV, is the device protection module of the Todyl platform. It replaces traditional antivirus with two layers in one agent:
- Next-generation antivirus (NGAV) to stop known and unknown malware before it runs
- Endpoint detection and response (EDR) to record what happens on the device, spot suspicious behaviour and act on it
Todyl positions it against malware, ransomware, in-memory and file-less attacks and "living off the land" techniques, where attackers misuse built-in tools such as PowerShell. Because it is the same agent used by Todyl SASE, protecting a device's network traffic and protecting the device itself come from one install, one console and one policy model.
What is included
| Capability | What it does |
|---|---|
| Continuous file monitoring | Watches file changes, additions and deletions in real time |
| Managed detection rules | A prebuilt rule library that Todyl maintains, so you do not have to tune it yourself |
| Behavioural analytics | Machine-learning driven detection of suspicious activity, not just known signatures |
| MITRE ATT&CK mapping | Each detection is mapped to attacker tactics and techniques |
| Host isolation | Cuts a compromised device off the network while you investigate |
| File quarantine | Removes infected files from use |
| Process control | Terminates or suspends an individual malicious process rather than a whole application |
| SOAR playbooks | Automated responses to triggers such as a malware infection, with Security Automation |
| Audit logs and reporting | Evidence for audits and requirements such as GDPR and PCI DSS |
Response modes can be set per tenant, so you decide how much the platform does automatically and what waits for a person.
How Todyl Endpoint Security is licensed
Endpoint Security is licensed per device: each laptop, desktop or server running the agent counts. Billing is monthly in arrears on the devices protected, and Todyl's service is offered without annual contracts, so the count follows your estate as people join and leave.
It can be bought on its own or as part of a Todyl package (Essentials, Advanced or Complete) alongside SASE, SIEM, MXDR and GRC. On its own it gives you protection and response; paired with Todyl SIEM and Todyl MXDR, its detections are correlated with network and identity data and watched around the clock. Ask us for a quote for your device numbers.
Requirements and deployment
There is no hardware or on-premises server. We deploy the agent silently through your RMM or device management tool, check for conflicting antivirus products, and remove them in a controlled order so no device is left unprotected. Windows workstations and servers are the common case; we confirm support for any other operating systems in your estate during scoping.
We then set response modes, exclusions for business-critical systems and alert routing, and run in a monitoring-first mode before enabling automatic containment.
Who it suits and how we help
Todyl Endpoint Security suits organisations that want EDR-grade protection without running a separate antivirus, VPN and log platform, and those already using or planning Todyl SASE who want one agent for everything. It supports the malware protection control in Cyber Essentials.
We scope your devices, deploy and tune the agent, handle incidents with you, and manage licence changes on one invoice. Compare other products in endpoint protection. See all vendors on our vendors A to Z, or go back to the Todyl overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Todyl Endpoint Security an antivirus?
Yes, and more. It includes next-generation antivirus to block malware and EDR to detect and respond to suspicious behaviour, such as file-less and living-off-the-land attacks, in one agent.
Do I need to remove my existing antivirus?
Usually yes, to avoid two products conflicting. We plan the switch so the Todyl agent is protecting each device before the old product is removed.
Is Todyl EDR licensed per device?
Yes. Each protected laptop, desktop or server counts as a device, billed monthly in arrears on what was protected.
Is Todyl Endpoint Security monitored 24/7?
Not on its own. Add Todyl MXDR for a 24/7 team that monitors and responds to detections, or we can monitor the console as part of our managed service.