{"id":345,"date":"2026-06-30T20:37:52","date_gmt":"2026-07-01T04:37:52","guid":{"rendered":"https:\/\/rainier-it.com\/blog\/?p=345"},"modified":"2026-06-30T20:37:56","modified_gmt":"2026-07-01T04:37:56","slug":"security-a-la-carte-enterprise-grade-protection-for-small-business-one-line-item-at-a-time","status":"publish","type":"post","link":"https:\/\/rainier-it.com\/blog\/security-a-la-carte-enterprise-grade-protection-for-small-business-one-line-item-at-a-time\/","title":{"rendered":"Security, \u00e0 la carte: enterprise-grade protection for small business \u2014 one line item at a time"},"content":{"rendered":"\n<p>Most IT providers sell security the way cable companies sell TV: one big bundle, take it or leave it, signed for a year. If you only wanted three channels, tough \u2014 you\u2019re paying for two hundred. We think that\u2019s backwards. So we broke our managed-security stack into four products you can buy individually, priced per device, per month, with no contract and no minimum bundle.<\/p>\n\n\n\n<p>It\u2019s called <a href=\"https:\/\/rainier-it.com\/security\/\"><strong>\u00c0 La Carte Security<\/strong><\/a> \u2014 the exact same EDR, identity protection, automated patching, and remote monitoring we run for our flat-rate managed clients, sold one line item at a time. Pick what you need, skip what you don\u2019t, and cancel anytime. This post walks through what each product actually does, what it costs, and how to put a stack together.<\/p>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p>Enterprise-grade security, one line item at a time. No bundles. No contracts. Cancel anytime.<\/p><\/blockquote><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">How it works<\/h2>\n\n\n\n<p>Four steps, and only the last one is ongoing. There\u2019s no on-site visit, no reimaging, and nothing to rip out if you change your mind.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Configure.<\/strong> Pick your products and how many of each. Every product is priced on its own quantity \u2014 one product\u2019s volume never changes another\u2019s rate.<\/li>\n\n\n\n<li><strong>Pay.<\/strong> Card on file, billed monthly. Your invoice tracks what\u2019s actually installed \u2014 add a laptop mid-month and it shows up on the next cycle.<\/li>\n\n\n\n<li><strong>Install.<\/strong> One installer with your products baked in. Run it on each machine \u2014 a few minutes each, no on-site visit, no reimaging.<\/li>\n\n\n\n<li><strong>We watch.<\/strong> From there it\u2019s a 24\/7 SOC on your endpoints, patching on your schedule, and monitoring that flags problems before they become outages.<\/li>\n<\/ul>\n\n\n\n<p>The installer is a single signed script that carries whichever products you bought. Run it as an administrator and it silently enrolls the machine \u2014 here\u2019s what that looks like on a workstation:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># One installer, your products baked in \u2014 run as admin on each machine.\n# EDR + patching + monitoring enroll silently. No reboot. No reimage.\nPS C:\\> .\\Install-RainierAgents.ps1\n\n&#91;1\/3&#93; Huntress Managed EDR ......... installed  (agent checking in)\n&#91;2\/3&#93; Action1 Patch Management ..... installed  (enrolled: HQ-Workstations)\n&#91;3\/3&#93; Remote Monitoring &amp; Support .. installed  (core services: OK)\n\nDone. 3 products live in ~4 minutes. Nothing to configure on-site.<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># One installer, your products baked in \u2014 run as admin on each machine.<\/span><\/span>\n<span class=\"line\"><span style=\"color: #616E88\"># EDR + patching + monitoring enroll silently. No reboot. No reimage.<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">PS C:\\<\/span><span style=\"color: #81A1C1\">&gt;<\/span><span style=\"color: #D8DEE9FF\"> .<\/span><span style=\"color: #88C0D0\">\\Install-RainierAgents.ps1<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">&#91;<\/span><span style=\"color: #B48EAD\">1<\/span><span style=\"color: #81A1C1\">\/<\/span><span style=\"color: #B48EAD\">3<\/span><span style=\"color: #ECEFF4\">&#93;<\/span><span style=\"color: #D8DEE9FF\"> Huntress Managed EDR ........<\/span><span style=\"color: #81A1C1\">.<\/span><span style=\"color: #D8DEE9FF\"> installed  <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #D8DEE9FF\">agent checking <\/span><span style=\"color: #81A1C1\">in<\/span><span style=\"color: #ECEFF4\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">&#91;<\/span><span style=\"color: #B48EAD\">2<\/span><span style=\"color: #81A1C1\">\/<\/span><span style=\"color: #B48EAD\">3<\/span><span style=\"color: #ECEFF4\">&#93;<\/span><span style=\"color: #D8DEE9FF\"> Action1 Patch Management ....<\/span><span style=\"color: #81A1C1\">.<\/span><span style=\"color: #D8DEE9FF\"> installed  <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #D8DEE9FF\">enrolled: HQ<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Workstations<\/span><span style=\"color: #ECEFF4\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">&#91;<\/span><span style=\"color: #B48EAD\">3<\/span><span style=\"color: #81A1C1\">\/<\/span><span style=\"color: #B48EAD\">3<\/span><span style=\"color: #ECEFF4\">&#93;<\/span><span style=\"color: #D8DEE9FF\"> Remote Monitoring <\/span><span style=\"color: #81A1C1\">&amp;<\/span><span style=\"color: #D8DEE9FF\"> Support .<\/span><span style=\"color: #81A1C1\">.<\/span><span style=\"color: #D8DEE9FF\"> installed  <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #D8DEE9FF\">core services: OK<\/span><span style=\"color: #ECEFF4\">)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">Done. <\/span><span style=\"color: #B48EAD\">3<\/span><span style=\"color: #D8DEE9FF\"> products live <\/span><span style=\"color: #81A1C1\">in<\/span><span style=\"color: #D8DEE9FF\"> ~<\/span><span style=\"color: #B48EAD\">4<\/span><span style=\"color: #D8DEE9FF\"> minutes. Nothing to configure on<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">site.<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1. Managed EDR \u2014 a 24\/7 human SOC on every endpoint<\/h2>\n\n\n\n<p>Huntress Managed EDR isn\u2019t just software. Behind the lightweight agent (Windows, macOS, and Linux) sits a <strong>24\/7\/365 human Security Operations Center<\/strong> with an average response time of <strong>about 8 minutes<\/strong> \u2014 from the moment an alert is received to a verified incident report in your inbox or the alert closed as noise. The agent continuously hunts for the persistence footholds attackers use to survive reboots and stay hidden, and plants ransomware canary files on every protected endpoint, so the instant anything starts encrypting, a SOC investigation opens.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/rainier-it.com\/blog\/wp-content\/uploads\/2026\/06\/huntress-authorized-partner-white.png\" alt=\"Rainier IT is an Authorized Huntress Partner\" style=\"width:360px\"\/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">What you get<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Analysts review alerts before you ever see them.<\/strong> Huntress reports carry a false-positive rate under 1% \u2014 you act on signal, not noise.<\/li>\n\n\n\n<li><strong>Human-validated isolation.<\/strong> On a confirmed threat, analysts can isolate a host \u2014 or the whole org \u2014 so it can only talk to Huntress. A human validates first, so a false positive never locks up your server.<\/li>\n\n\n\n<li><strong>Remediation, not raw alerts.<\/strong> Every incident report arrives with step-by-step remediation, and we work it with you. You\u2019re never handed an alert stream to triage alone.<\/li>\n\n\n\n<li><strong>Microsoft Defender, managed.<\/strong> Huntress manages and monitors Defender \u2014 AV health, scan status, signature updates \u2014 across every protected endpoint at no extra charge.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Metric<\/th><th>What it means<\/th><\/tr><\/thead><tbody><tr><td>~8&nbsp;min<\/td><td>Average SOC response \u2014 alert received to report sent or alert closed<\/td><\/tr><tr><td>&lt;1%<\/td><td>False-positive rate on incident reports \u2014 human-verified before you see them<\/td><\/tr><tr><td>~4.5&nbsp;million<\/td><td>Endpoints protected by the Huntress platform worldwide<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Huntress-published platform metrics.<\/figcaption><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. Managed ITDR \u2014 because attackers don\u2019t break in, they log in<\/h2>\n\n\n\n<p>Modern business compromise increasingly starts with a Microsoft 365 account, not a machine \u2014 <strong>67% of organizations report a rise in identity-related incidents over the past three years.<\/strong> Huntress Managed ITDR connects directly to your Microsoft 365 tenant \u2014 set up in minutes, no endpoint agent required \u2014 and puts the same 24\/7 SOC behind every licensed identity, with a <strong>3-minute average response time for identity threats.<\/strong> It works without expensive premium Microsoft licensing tiers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the SOC catches<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Session hijacking.<\/strong> Detects attackers who steal session tokens \u2014 the digital keys that keep users logged in \u2014 and import them into their own browsers. No password needed, which is exactly why passwords alone can\u2019t catch it.<\/li>\n\n\n\n<li><strong>Malicious inbox rules.<\/strong> Flags rules attackers plant to hide their tracks \u2014 auto-forwarding or deleting mail, watching for keywords like \u201cinvoice,\u201d or shunting messages into folders nobody reads.<\/li>\n\n\n\n<li><strong>Rogue OAuth apps.<\/strong> Catches malicious or abused OAuth applications granted access to your tenant \u2014 an attack vector Huntress measured more than doubling year over year in its 2026 threat report.<\/li>\n\n\n\n<li><strong>Impossible travel &amp; shady infrastructure.<\/strong> Spots logins from suspicious locations and unauthorized VPN or proxy infrastructure \u2014 and the SOC confirms real compromise before waking anyone up.<\/li>\n<\/ul>\n\n\n\n<p>Concretely, here\u2019s the kind of thing ITDR resolves for you before it ever reaches your inbox:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Huntress ITDR \u2014 an example detection the SOC handles for you.\nALERT   Suspicious inbox rule created        tenant: acme.onmicrosoft.com\n        user:   ap@acme.com\n        rule:   move messages containing \"invoice\" -> RSS Feeds, mark read\n        verdict: MALICIOUS (analyst-confirmed)      MTTR: 3 min\n        action:  session revoked \u00b7 rule removed \u00b7 password reset forced<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #616E88\"># Huntress ITDR \u2014 an example detection the SOC handles for you.<\/span><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">ALERT<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #A3BE8C\">Suspicious<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">inbox<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">rule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">created<\/span><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #A3BE8C\">tenant:<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">acme.onmicrosoft.com<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #88C0D0\">user:<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #A3BE8C\">ap@acme.com<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #88C0D0\">rule:<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #A3BE8C\">move<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">messages<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">containing<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">invoice<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> -<\/span><span style=\"color: #81A1C1\">&gt;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">RSS<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">Feeds,<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">mark<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">read<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #88C0D0\">verdict:<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">MALICIOUS<\/span><span style=\"color: #D8DEE9FF\"> (analyst-confirmed)      MTTR: 3 min<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #88C0D0\">action:<\/span><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #A3BE8C\">session<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">revoked<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">\u00b7<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">rule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">removed<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">\u00b7<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">password<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">reset<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">forced<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p><em>Set-up note:<\/em> because ITDR is a direct tenant connection rather than an installed agent, it carries a one-time <strong>$195 setup fee per Microsoft 365 tenant<\/strong> \u2014 we establish the integration, grant admin consent as your Microsoft Cloud Solution Provider, enable the audit logging Huntress needs, and verify it\u2019s healthy. The endpoint products have nothing to set up by hand, so they carry no setup fee.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Action1 Patch Management \u2014 every patch, every app, on your schedule<\/h2>\n\n\n\n<p>Unpatched software is an open door for opportunistic attacks. We run Action1 to automate Windows updates <em>and<\/em> third-party applications \u2014 browsers, Adobe, collaboration tools, and more \u2014 patched from a repository built and maintained by Action1\u2019s own patch team, not a community feed.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Risk-prioritized.<\/strong> Vulnerabilities are identified in real time and prioritized by CVSS score, CVE, and CISA Known Exploited Vulnerabilities status \u2014 with audit-ready reports your cyber-insurer will actually accept.<\/li>\n\n\n\n<li><strong>On your schedule.<\/strong> Patching runs in windows you approve; reboots get scheduled for when nobody is logged in. Security updates auto-approve while feature updates wait for review.<\/li>\n\n\n\n<li><strong>Works from anywhere.<\/strong> Work-from-home machines patch exactly like office machines \u2014 no VPN required \u2014 and peer-to-peer distribution lets agents on the same network share downloads, limiting bandwidth per subnet.<\/li>\n<\/ul>\n\n\n\n<p>Patching and EDR feed the same story: what\u2019s covered, what\u2019s exposed, and what got fixed. Here\u2019s a sample of the posture view that rolls up into your monthly report:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>$ rainier posture --org \"Acme Dental\" --report monthly\n\nCoverage \u2014 24 endpoints, 18 M365 identities\n  Managed EDR (Huntress) ....... 24\/24 checking in      OK\n  Managed ITDR (M365) .......... 18\/18 identities        OK\n  Action1 patching ............. 23\/24 compliant         1 pending reboot\n  Microsoft Defender health .... 24\/24 real-time on      OK\n\nOpen vulnerabilities (CVSS, CISA KEV first)\n  CVE-2026-1234   9.8  KEV   Adobe Acrobat    -> scheduled tonight\n  CVE-2026-0777   7.5  ---   Google Chrome    -> auto-approved\n  CVE-2025-9931   6.1  ---   7-Zip            -> auto-approved\n\nReport: acme-dental-posture-2026-07.pdf   (emailed + in portal)<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #88C0D0\">$<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">rainier<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">posture<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">--org<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">Acme Dental<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">--report<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">monthly<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Coverage<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">\u2014<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #B48EAD\">24<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">endpoints,<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #B48EAD\">18<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">M365<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">identities<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">Managed<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">EDR<\/span><span style=\"color: #D8DEE9FF\"> (Huntress) ....... 24\/24 checking <\/span><span style=\"color: #81A1C1\">in<\/span><span style=\"color: #D8DEE9FF\">      OK<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">Managed<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">ITDR<\/span><span style=\"color: #D8DEE9FF\"> (M365) .......... 18\/18 identities        OK<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">Action1<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">patching<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">.............<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #B48EAD\">23<\/span><span style=\"color: #A3BE8C\">\/24<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">compliant<\/span><span style=\"color: #D8DEE9FF\">         <\/span><span style=\"color: #B48EAD\">1<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">pending<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">reboot<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">Microsoft<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">Defender<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">health<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">....<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #B48EAD\">24<\/span><span style=\"color: #A3BE8C\">\/24<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">real-time<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">on<\/span><span style=\"color: #D8DEE9FF\">      <\/span><span style=\"color: #A3BE8C\">OK<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Open<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">vulnerabilities<\/span><span style=\"color: #D8DEE9FF\"> (CVSS, <\/span><span style=\"color: #A3BE8C\">CISA<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">KEV<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">first<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">CVE-2026-1234<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #B48EAD\">9.8<\/span><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #A3BE8C\">KEV<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #A3BE8C\">Adobe<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">Acrobat<\/span><span style=\"color: #D8DEE9FF\">    -<\/span><span style=\"color: #81A1C1\">&gt;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">scheduled<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">tonight<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">CVE-2026-0777<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #B48EAD\">7.5<\/span><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #A3BE8C\">---<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #A3BE8C\">Google<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">Chrome<\/span><span style=\"color: #D8DEE9FF\">    -<\/span><span style=\"color: #81A1C1\">&gt;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">auto-approved<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #88C0D0\">CVE-2025-9931<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #B48EAD\">6.1<\/span><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #A3BE8C\">---<\/span><span style=\"color: #D8DEE9FF\">   <\/span><span style=\"color: #B48EAD\">7<\/span><span style=\"color: #A3BE8C\">-Zip<\/span><span style=\"color: #D8DEE9FF\">            -<\/span><span style=\"color: #81A1C1\">&gt;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">auto-approved<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #88C0D0\">Report:<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">acme-dental-posture-2026-07.pdf<\/span><span style=\"color: #D8DEE9FF\">   (emailed <\/span><span style=\"color: #A3BE8C\">+<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">in<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #A3BE8C\">portal<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Remote Monitoring &amp; Support \u2014 eyes on every machine, and hands when you need them<\/h2>\n\n\n\n<p>Our remote monitoring agent runs on infrastructure <strong>we host and administer ourselves<\/strong> \u2014 not a third-party multi-tenant cloud \u2014 watching disk space, Windows services, event logs, CPU, and memory on every enrolled machine, and alerting us when thresholds are crossed. It\u2019s the difference between \u201cthe server ran out of disk Saturday night\u201d being a Monday-morning disaster and a ticket we already closed.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Proactive checks.<\/strong> Disk, services, event logs, CPU, memory, and custom script output \u2014 problems get flagged before they become outages.<\/li>\n\n\n\n<li><strong>Automated fixes.<\/strong> Cleanup jobs, service restarts, and routine maintenance run in the background on a schedule, without interrupting whoever\u2019s at the keyboard.<\/li>\n\n\n\n<li><strong>Consent-based remote control.<\/strong> Secure attended remote access \u2014 your user is notified or asked for consent before a technician connects. No silent screen-watching.<\/li>\n\n\n\n<li><strong>Infrastructure you can trust.<\/strong> The monitoring platform runs on Rainier IT-controlled infrastructure. Monitoring data and remote-access pathways stay under our administration, not a vendor\u2019s.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">On-demand remote hands \u2014 $95\/hr, billed in 15-minute increments<\/h3>\n\n\n\n<p>With the agent installed, you skip the \u201ccan someone come out?\u201d wait entirely. Something\u2019s broken? We remote in \u2014 with your permission \u2014 and fix it hands-on at <strong>$95\/hr, billed in 15-minute increments<\/strong>. No site visit, no travel charge, no hour minimum. A quick fix costs like a quick fix.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Proof, not promises: the Security Posture Report<\/h2>\n\n\n\n<p>A security stack you can\u2019t see is one you have to take on faith. The optional Security Posture Report is a PDF in your inbox \u2014 <strong>weekly or monthly<\/strong> \u2014 showing exactly what\u2019s protecting your business right now: which machines are covered, which aren\u2019t, and what\u2019s still exposed. Hand it to your cyber-insurance carrier, your board, or your biggest client\u2019s vendor-risk questionnaire.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Agent status across your fleet \u2014 what\u2019s checking in, what\u2019s gone quiet<\/li>\n\n\n\n<li>Microsoft Defender health \u2014 real-time protection, signatures, scan status<\/li>\n\n\n\n<li>EDR coverage \u2014 which endpoints the SOC can actually see<\/li>\n\n\n\n<li>Patch &amp; CVE posture \u2014 open vulnerabilities by severity, and what got fixed<\/li>\n<\/ul>\n\n\n\n<p>Pricing: <strong>$15\/month<\/strong> or <strong>$25\/week<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What it costs<\/h2>\n\n\n\n<p>Every product is priced per unit, per month, and each product\u2019s volume sets its own tier \u2014 your largest single quantity of a product picks the rate that applies to all of that product. EDR and patching and monitoring are billed <strong>per endpoint<\/strong> (a workstation, laptop, or server with an agent). ITDR is billed <strong>per identity<\/strong> (a licensed Microsoft 365 user) and needs no agent at all.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Product<\/th><th>Unit<\/th><th>1\u201310<\/th><th>11\u201325<\/th><th>26\u201350<\/th><th>51\u2013100<\/th><th>101+<\/th><\/tr><\/thead><tbody><tr><td>Huntress Managed EDR<\/td><td>endpoint<\/td><td>$11.00<\/td><td>$10.00<\/td><td>$9.00<\/td><td>$8.00<\/td><td>$7.50<\/td><\/tr><tr><td>Huntress Managed ITDR (M365)<\/td><td>identity<\/td><td>$13.00<\/td><td>$12.00<\/td><td>$11.00<\/td><td>$10.00<\/td><td>$9.00<\/td><\/tr><tr><td>Action1 Patch Management<\/td><td>endpoint<\/td><td>$6.00<\/td><td>$6.00<\/td><td>$6.00<\/td><td>$6.00<\/td><td>$6.00<\/td><\/tr><tr><td>Remote Monitoring &amp; Support<\/td><td>endpoint<\/td><td>$2.50<\/td><td>$2.50<\/td><td>$2.50<\/td><td>$2.50<\/td><td>$2.50<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Per unit, per month. ITDR adds a one-time $195 setup per M365 tenant. Security Posture Report: $15\/mo or $25\/wk. Remote hands: $95\/hr in 15-min increments.<\/figcaption><\/figure>\n\n\n\n<p><strong>Build your stack and see your exact monthly total on the <a href=\"https:\/\/rainier-it.com\/security\/\">\u00c0 La Carte Security<\/a> configurator.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Common questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Do I have to buy all four?<\/h3>\n\n\n\n<p>No \u2014 that\u2019s the whole point. That said, they\u2019re designed to layer: EDR watches for intruders, ITDR watches your M365 accounts, patching closes the holes they come through, and monitoring catches the ordinary failures in between. Most clients start with EDR and add from there.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How does billing actually work?<\/h3>\n\n\n\n<p>Your invoice follows what\u2019s actually installed. We bill against live agent counts \u2014 add three laptops mid-month and they appear next cycle; retire a machine and it drops off. The configurator is a quote, not a commitment to a fixed count.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I cancel?<\/h3>\n\n\n\n<p>Anytime, effective at the next billing cycle. No early-termination fee, no contract to buy out. We uninstall the agents cleanly and hand you an exit summary of what was covered.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What if I\u2019d rather have all of it just\u2026 handled?<\/h3>\n\n\n\n<p>That\u2019s our managed plans \u2014 flat per-user pricing that includes this entire security stack <em>plus<\/em> unlimited remote support, a hardened Windows security baseline, encrypted daily backups, free onboarding, and a monthly health report. \u00c0 la carte covers the tools; managed plans cover everything else.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Not sure what you need?<\/h2>\n\n\n\n<p>Book a free 30-minute call \u2014 no commitment. We\u2019ll listen, ask about your environment, and recommend the smallest stack that actually solves the problem. Or head straight to the <a href=\"https:\/\/rainier-it.com\/security\/\">\u00c0 La Carte Security<\/a> page and build your own.<\/p>\n\n\n\n<p><em>Rainier IT is an Authorized Huntress Partner providing managed IT, cybersecurity, and modern infrastructure for small businesses across Pierce &amp; King County, Washington.<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Sources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Huntress, <a href=\"https:\/\/www.huntress.com\/platform\/managed-edr\" target=\"_blank\" rel=\"noopener\">Managed EDR<\/a> \u2014 8-minute average response time, &lt;1% false-positive rate.<\/li>\n\n\n\n<li>Huntress, <a href=\"https:\/\/www.huntress.com\/\" target=\"_blank\" rel=\"noopener\">platform metrics<\/a> \u2014 ~4.5&nbsp;million endpoints protected.<\/li>\n\n\n\n<li>Huntress, <a href=\"https:\/\/www.huntress.com\/platform\/managed-itdr\" target=\"_blank\" rel=\"noopener\">Managed ITDR<\/a> \u2014 3-minute MTTR for identity threats; session-hijack, malicious-app and login-anomaly detection.<\/li>\n\n\n\n<li>Huntress, <a href=\"https:\/\/www.huntress.com\/press-release\/huntress-surpasses-10-million-microsoft-365-identities-protected-expands-itdr-coverage-to-google-workspace\" target=\"_blank\" rel=\"noopener\">10M+ M365 identities protected<\/a>.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Our full managed-security stack \u2014 Huntress EDR, Managed ITDR for Microsoft 365, Action1 patching, and remote monitoring \u2014 sold per device, per month, with no bundles and no contracts. What each product does, what it costs, and how to build a stack.<\/p>\n","protected":false},"author":1,"featured_media":347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,8],"tags":[35,37,36,38,39,40,42,41],"class_list":["post-345","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-managed-it-services","tag-cybersecurity","tag-edr","tag-huntress","tag-managed-itdr","tag-microsoft-365","tag-patch-management","tag-pierce-county","tag-small-business"],"_links":{"self":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/comments?post=345"}],"version-history":[{"count":1,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/345\/revisions"}],"predecessor-version":[{"id":346,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/345\/revisions\/346"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media\/347"}],"wp:attachment":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media?parent=345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/categories?post=345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/tags?post=345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}