ThreatDown EDR and MDR in Dubai

EDR is a product: it records what happens on each endpoint, detects suspicious behaviour rather than only known-bad files, and gives someone the tools to investigate and contain an incident. MDR is that same technology plus the people who operate it — a security operations centre monitoring the alerts around the clock, triaging them and taking containment action. The practical test is simple: if nobody in your business will open a security console at 2am on a Friday, EDR alone gives you a recording of the incident rather than a response to it. Businesses with an IT team that has genuine capacity to investigate alerts are correctly served by EDR; most UAE SMEs under a hundred users are not.

ThreatDown is Malwarebytes' business brand — the same company, with the corporate endpoint products grouped under the ThreatDown name and the consumer antivirus product continuing as Malwarebytes. If you already know Malwarebytes as the tool that cleans up an infected home laptop, the business platform is a different proposition: centrally managed agents, an EDR detection engine, vulnerability and patch management, a cloud console called Nebula, and optional 24/7 managed detection and response. Nifty IT is a partner in the ThreatDown Partner Program and deploys and supports the business platform.

It depends on whether anyone would act on a detection outside working hours. Buy the managed tier when your IT cover is one person during business hours, when a client questionnaire, insurer or regulator requires it, when you have been hit before, or when downtime has a real number attached. Stay on EDR when you have a team that will genuinely use the console. And if your fundamentals are not in place — MFA missing, backups never restored, firewall unpatched — fix those first, because 24/7 monitoring of a weak environment is spending at the wrong end of the list. We will tell you which of those three situations you are in before quoting.

No. ThreatDown EDR and MDR are endpoint-focused: they cover workstations, laptops and servers running the agent. Mailbox compromise in Microsoft 365, suspicious sign-ins, cloud and SaaS activity, and network-level intrusion are outside that scope and are covered by different controls — tenant-level alerting and conditional access on the Microsoft 365 side, and the firewall at the network layer. This is normal for endpoint MDR across the industry, but it is worth stating clearly, because assuming your whole business is being watched when only the endpoints are is an expensive misunderstanding.

It is priced per endpoint per month, and the drivers are which bundle you take, how many endpoints are in scope and the term length. The jump that matters is Advanced to Elite, because that is where you stop buying software and start buying analyst time — expect a meaningful step, and expect it to still be far cheaper than staffing 24/7 cover yourself. Multi-year terms normally reduce the annual figure. We quote in AED per endpoint with the bundle contents itemised, so you can see what the managed tier adds rather than comparing two totals with different things inside them.

The platform starts from around five endpoints, which puts it within reach of genuinely small UAE businesses — a five to ten person office is a normal customer rather than too small to be served. That matters, because a lot of enterprise EDR and MDR products carry minimums that price small businesses out entirely and leave them on consumer antivirus. That said, small does not mean you should skip the fundamentals: at that size, MFA, a tested backup and patching still come before managed detection.

No, and this is the most important misunderstanding to clear up. Ransomware Rollback keeps a rolling record of file changes so that encrypted files on a protected endpoint can be reverted — it is genuinely useful and it has saved real incidents. But it works on endpoints running the agent, within a limited time window, and it does nothing for a file server nobody enrolled, a NAS, a cloud service or an incident discovered weeks later. It is a fast recovery option layered on top of backup, never a replacement for a restore-tested backup. Any provider who tells you otherwise is selling, not advising.

Two active endpoint protection agents scanning the same files cause performance problems and false positives, and the blame invariably lands on whichever was installed most recently. So migration is part of the deployment: the incumbent product is cleanly removed as the new agent goes on, staged department by department rather than in one pass, with a pilot group first to prove exclusions and performance on your heaviest line-of-business applications. Defender is handled the same way — it steps back automatically when another registered protection product takes over, but we verify that rather than assume it.

On Elite and Ultimate, ThreatDown's 24/7 security operations centre does the immediate work — triage, threat hunting and containment such as isolating the endpoint from the network, killing a process or quarantining a file, either automatically under agreed playbooks or after escalating for approval. Nifty is the local side: we agree the escalation path with you in advance, and we handle the morning after — the rebuild, the restore, the user who cannot work, the follow-up on how it got in. Both halves matter. A SOC that isolates a laptop at 3am has done the right thing, and somebody still has to get that person working again.

Not a formal committed detection or response SLA, and the SOC is pooled rather than assigning named analysts to your account. We would rather state that plainly than let you infer a guarantee that does not exist — it is a fair question to ask of every MDR provider you consider, and the answers vary more than the marketing suggests. What you can pin down is the escalation path: who gets contacted, what the analysts are authorised to do without waiting for approval, and what our own response commitment to you is under a support or managed contract. That last part is contractual and we will put it in writing.

Yes, and it is how most of these deployments start — usually from expired endpoint licences, consumer-grade antivirus installed one machine at a time, or an unmanaged Defender deployment nobody is monitoring. The work is discovery first, so we know what devices actually exist including the ones not in anyone's inventory, then a pilot group, then staged removal and replacement by department, then verification device by device against that inventory. You get a coverage report at the end showing exactly what is protected and what is not — the gaps are the point of the exercise.

Vulnerability and patch management is included in every ThreatDown bundle, including the entry tier, and for most UAE SMEs it is the most valuable thing in the box — unpatched third-party software is how endpoints actually get compromised, and it is the control most often missing altogether. It is also frequently bought and never configured. We set the patch policy up as part of deployment, with operating system and third-party applications on a tested schedule and critical patches expedited, and we can run it on an ongoing basis either standalone or inside a managed IT contract.