The tools we deploy. How they map to HIPAA. What happens when something goes wrong.

Defender for Business provides next-generation antivirus, behavioral detection, and automated investigation and remediation across all enrolled Windows endpoints. Attack Surface Reduction (ASR) rules block common malware delivery techniques — macro execution from email, Office child process spawning, credential theft from LSASS.

Defender is our first line of detection. It covers the majority of commodity malware and is deeply integrated into the Intune compliance and conditional access stack — a non-compliant device can be automatically blocked from accessing Microsoft 365 resources.

Huntress provides what Defender alone can't: human analysts in a 24/7 SOC who investigate suspicious activity and escalate with context, not raw alerts. When Defender detects a behavioral anomaly, Huntress analysts determine whether it's a real attack, a false positive, or something in between — and respond accordingly.

Huntress also monitors for persistent footholds (scheduled tasks, registry run keys, services) that attackers leave behind. This persistence hunting is the layer most practices are missing — ransomware operators often establish persistence weeks before detonating.

DNSFilter intercepts DNS queries before a connection is established — blocking access to malware distribution sites, phishing domains, command-and-control infrastructure, and inappropriate content before any data is sent or received. It applies to all devices on the network and can be extended to roaming users via a lightweight agent.

For healthcare practices, DNSFilter also enforces acceptable use policies — preventing staff from accessing content that isn't appropriate on a clinical network. Reporting shows which devices queried which domains, providing part of the audit trail HIPAA's technical safeguards require.

Acronis provides immutable cloud backups — once written, the backup data cannot be modified or deleted, even by ransomware running on the source machine. Backups run on a defined schedule with defined retention, and recovery point objectives (RPO) and recovery time objectives (RTO) are documented for each practice's critical systems.

Acronis also includes active protection that detects and stops ransomware behavior on the endpoint — separate from Defender, providing a second layer of detection specifically tuned for backup-aware ransomware that attempts to delete shadow copies before encrypting files.