Schedule a Demo
CASE STUDY

The EDR agent was missing. The SOC wasn't.

A client endpoint dropped off coverage and attackers found it before anyone did. Here’s the seven days it took Cyflare’s SOC to catch it, contain it, and close it out anyway.

Book a working session
Inside Managed EDR

900+

Suspicious events logged, this incident

7 days

First alert to remediation complete

30+

EDR integrations managed, SOC-wide

8.3 min

Critical-case MTTR, SOC-wide average
Incident figures from Cyflare SOC case files, December 2024. Service-wide figures from internal Cyflare data, YTD 2026.
 

One endpoint nobody was watching

In December 2024, Cyflare’s SentinelOne-powered detection flagged lateral movement using privileged credentials at 4:11 a.m. That part worked as it should. What didn’t: the systems the attacker moved into weren’t running an EDR agent at all- unmanaged and invisible to the platform.

When automation stalls, a human picks it up

Automated escalation didn’t fire twice. That’s not buried in the fine print; it’s why a staffed SOC exists. Both times, an analyst pushed the escalation forward by hand instead of waiting for the system to do it.

Confirmed, contained, and closed

The client confirmed the Fog ransomware infection the same day isolation began. Full containment took coordination on their side too, forensics, insurance, and a full server reinstall, not just a Cyflare fix. Systems were reinstalled and remediation verified within seven days of the first alert.

THE LESSON

Coverage gaps aren't rare. Catching them is the job.

Every MSP has an asset like this one somewhere: onboarded late, migrated off a retired tool, never quite added to the rollout. Cyflare’s TechOps team checks that the agent is actually deployed and reporting, across every client, so a gap gets caught during a coverage review instead of during an incident.

"An agent gap and an automation miss happened in the same incident. Neither one turned into a missed breach, because the response didn't depend on either one working perfectly."

The layers beneath this reponse

Managed Detection and Response

The 24/7 SOC caught this one twice, on the alert and on the recurrence.

Managed EDR

Deployment, tuning, and coverage checks on the agent itself, not just its alerts.

SOC as a Service

The analyst team behind every escalation in this timeline, staffed around the clock.

Managed XDR

For clients running more than endpoints, the same operating model across every layer.

COMMON QUESTIONS

What partners ask about incidents like this one

You don’t catch it through the agent. You catch it through what the agent-covered systems around it see, in this case, lateral movement from a privileged account into unmanaged machines. It’s why SOC-level correlation matters as much as the endpoint tool itself.
A human catches it. That’s the design, not a fallback. Every alert has an analyst behind it who can push an escalation manually when the automation doesn’t, which is exactly what happened twice in this incident.
Both, as far as our scope goes. Our SOC drove isolation and gave the client’s IR and insurance teams the evidence they needed. Full remediation is a joint effort, and we say so rather than claiming credit for the client’s own work.
With mEDR Connect, you bring your own EDR platform and our SOC monitors it. With mEDR Complete, our TechOps team also manages the platform itself, which is the layer that would have flagged this specific gap before an attacker did.
Almost certainly, somewhere. Unmanaged assets are common, not rare. The question isn’t whether a gap exists. It’s whether anything catches it before it’s used.

DON'T FIND OUT FROM A RANSOM NOTE

Find your coverage gaps before an attacker does

This client’s gap got caught because a SOC was watching everything around it, not just the endpoint itself. Worth a conversation before it’s an incident.

Book a working session