It works because it looks like a Tuesday morning.

If your staff have ever been contacted by an IT provider they did not expect, and did anything other than hang up and call back on a number they already had, this one is worth ten minutes of your time.

What actually happens

Microsoft set out the chain in detail. The short version:

1. First contact through Teams. The attacker operates from an external Microsoft 365 tenant and starts a chat or call posing as internal IT or helpdesk. Common pretexts include a security update, a spam filter update, account verification, or a warning that an account is about to be deactivated. Sometimes they phone as well, so the instructions never appear in the chat log.
2. The user grants remote control. They are talked through approving a “request control” prompt during a Teams screen share, or opening Quick Assist and reading back the connection code. From the user’s side this feels exactly like being helped.
3. Software gets installed silently. Inside that session the attacker runs PowerShell to pull down an installer package from cloud storage and installs it with the interface suppressed. The user sees nothing. The files are named things like “devfix” and “Hotfix” to fit the helpdesk story.
4. The attacker sets up camp. The package stages a legitimate, signed JavaScript runtime downloaded from the official source, then uses it to run an encrypted implant. Because every component is legitimate and signed, tooling that only looks for unsigned executables has nothing to flag. Persistence is set up under an update-themed name so it restarts every time the user logs in.
5. They look around, then move. Screenshots of the desktop are captured periodically. The attacker enumerates domain accounts and servers, then pivots across the network toward domain controllers and certificate authorities.

Microsoft is direct about what that pattern usually precedes: data theft, extortion, ransomware.

The part worth sitting with is that nothing here was hacked. Teams shows external contact warnings, an accept or block prompt, and phishing indicators. The whole attack depends on persuading one person to click past them.

Why this is a small business problem, not just a large one

It is easy to read “domain controllers” and “certificate authorities” and file this under enterprise. Two reasons not to.

First, the entry point is the same everywhere. A 12-person care agency and a 12,000-person bank both run Teams, both have someone who answers messages, and both have staff who have been trained for years that the helpful thing to do is cooperate with IT.

Second, smaller organisations are easier to impersonate. In a large company, an unexpected message from “IT” is odd because nobody knows the IT team anyway, so the culture is to check. In a 10-person firm that outsources IT, staff are used to a named external person contacting them from outside the organisation. That is the normal state. The attacker is not fighting your culture. They are using it.

If you outsource IT, external contact from IT is not a red flag for your staff. It is Tuesday. That is the gap.

Four controls that actually close this

Microsoft’s guidance runs long. Four things carry most of the weight for a small regulated firm.

1. A verification rule your staff can follow under pressure.

Not awareness training in general. One rule, written down, that survives someone sounding urgent and authoritative:

Nobody from IT will ever contact you out of the blue and ask for remote access. If it happens, end the conversation and call the support number yourself. You will never be in trouble for checking.

That last sentence matters more than the rest of it. Most people who fall for this had a doubt and pushed past it, because raising it felt rude. Give them explicit permission and the rule works. Without it, it does not.

If you want to see how your own team would do, our Spot the Phish quiz takes two minutes and is a useful thing to put in front of staff at a team meeting.

2. Restrict who can reach your staff in Teams.

Teams external access can be limited to trusted domains. Most small firms leave it open to the entire world by default and have no idea. If your staff only ever collaborate with a handful of outside organisations, the setting should reflect that. It is a configuration change, not a purchase.

3. Phishing-resistant MFA and Conditional Access.

MFA on its own does not stop someone who has been handed live control of a logged-in machine. Conditional Access, requiring a managed and compliant device, limits what that session is worth. This one also has a compliance edge: under Cyber Essentials Requirements for IT Infrastructure v3.3, effective 27 April 2026, MFA is mandatory on every cloud service where it is available, including where it costs extra. Not enabling it is an automatic fail. If you are certifying or renewing this year, our Cyber Essentials readiness checker will tell you where you currently stand.

4. Control which remote support tools can run at all.

Quick Assist and general-purpose remote support tools are the delivery mechanism here. If your IT provider uses one specific tool, the others should not be usable on your machines. Restricting remote assistance software removes the attacker’s easiest route, and it takes an afternoon.

The awkward question for anyone who outsources IT

This attack impersonates your IT provider. So ask us, or whoever supports you:

• Which channels will you ever contact my staff on, and what will you never ask them to do?
• What number should my team call to verify that a request came from you?
• Which remote support tool do you use, and are the others blocked on our devices?
• Is Teams external access restricted on our tenant, or open to anyone?
• If someone did grant a stranger remote access on Monday morning, what would tell you, and how fast?

A provider who cannot answer the last one has a monitoring gap, and it is the question that decides whether this is an incident or a disaster.

For our part, Guard IQ contacts clients through three channels only: our support email, our office number on 020 8537 8167, and our published WhatsApp number. Anything else claiming to be us is not us. If in doubt, hang up and call the office. We would rather take a hundred unnecessary calls than one that came too late.

If you want a second opinion

We work with care and healthcare providers, law firms, accountancy practices and other regulated businesses across North West London and the Home Counties, where a breach is not just downtime but a reportable incident with a regulator attached.

If you are not sure whether your Teams external access is locked down, whether Conditional Access is doing anything, or what your staff would actually do if a convincing stranger asked for remote control, book a free consultation or call 020 8537 8167.

Source: Microsoft Security Blog, “Impersonating IT support: how threat actors turn a remote session into enterprise-wide access”, 2 September 2026.

The post Someone calls claiming to be your IT support. How does your team check? first appeared on Guard IQ.

Small and medium-sized businesses are now frequent targets because criminals know many do not have the time, tools, or internal expertise to monitor their systems properly.

Basic antivirus is no longer enough.

That is where Managed EDR comes in.

Not sure if your business is properly protected? Book a free cybersecurity review with Guard IQ.

What Is Managed EDR?

Managed EDR stands for Managed Endpoint Detection and Response.

An endpoint is any device connected to your business systems, such as a:

Laptop
Desktop
Server
Work device

EDR software monitors these devices for suspicious behaviour, unusual activity, and signs of compromise.

The “managed” part means it is not just installed and forgotten. It is monitored by cybersecurity professionals who review alerts, investigate threats, and respond when something looks wrong.

In simple terms, Managed EDR helps detect and stop threats before they turn into serious incidents.

Want stronger protection across your business devices? Speak to Guard IQ today.

How Is Managed EDR Different From Antivirus?

Traditional antivirus usually looks for known threats. It checks files and programs against a database of recognised malware.

That is useful, but modern attacks are often more sophisticated.

Cyber criminals may use:

Stolen passwords
Fake invoices
Malicious scripts
Built-in Windows tools
Phishing emails
Ransomware

Managed EDR goes further by looking at behaviour, not just known viruses.

For example, it can flag activity such as:

A user account suddenly accessing large numbers of files
A device trying to connect to suspicious servers
Malware attempting to disable security tools
Unusual PowerShell or command-line activity
Signs of ransomware encryption starting
A laptop behaving differently from normal

This gives your business a much better chance of spotting an attack early.

If you are only relying on standard antivirus, it may be time to review your setup.

The Main Benefits of Managed EDR

1. Faster Threat Detection

The earlier you detect a cyber attack, the less damage it can cause.

Managed EDR continuously monitors your devices and looks for signs of suspicious behaviour. Instead of waiting until files are encrypted, accounts are compromised, or data is stolen, threats can be identified much earlier.

This is especially important for businesses that hold:

Client data
Financial records
Staff information
Patient or service user records
Sensitive documents

Early detection can be the difference between a small issue and a serious business incident.

2. Expert Monitoring Without Hiring an Internal Security Team

Most small businesses cannot justify hiring a full-time cybersecurity analyst. Even if they could, finding the right person is difficult and expensive.

Managed EDR gives your business access to specialist monitoring without the cost of building an internal security team.

The service provider reviews alerts, investigates issues, and helps decide what action needs to be taken.

This reduces the risk of important warnings being missed or ignored.

Guard IQ can help monitor and manage your endpoint protection, so your team can focus on running the business.

3. Protection Against Ransomware

Ransomware remains one of the most damaging types of cyber attack.

It can lock your files, stop your staff from working, and leave your business facing serious recovery costs.

Managed EDR can help detect early signs of ransomware activity, such as:

Unusual file changes
Suspicious processes
Attempts to disable security software
Activity spreading across devices
Mass file encryption behaviour

In many cases, fast detection and response can make the difference between a contained incident and a major business disruption.

Do not wait until your files are encrypted. Put protection in place before an incident happens.

4. Better Incident Response

When something goes wrong, speed matters.

Managed EDR can help identify:

Which device is affected
What happened
Where the threat came from
Whether it has spread
What needs to be done next

Depending on the setup, it may also allow the affected device to be isolated from the network to stop the threat spreading.

This gives your business a clearer, faster response plan instead of guessing under pressure.

Need a stronger incident response process? Guard IQ can help you put one in place.

5. Improved Compliance and Client Confidence

Many businesses now need to show that they take cybersecurity seriously.

This is particularly important for sectors such as:

Care providers
Law firms
Accountants
Professional services
Healthcare providers
Finance-related businesses

Clients, insurers, regulators, and supply chain partners increasingly expect businesses to have appropriate security controls in place.

Managed EDR can support wider requirements linked to:

Cyber Essentials
Cyber Essentials Plus
DSPT
Insurance questionnaires
Data protection expectations
Client due diligence

It shows that your business is not only trying to prevent attacks, but also actively monitoring for them.

Preparing for Cyber Essentials, DSPT, or a client security questionnaire? Guard IQ can help.

6. Reduced Downtime and Business Disruption

A serious cyber incident can stop a business from operating.

Staff may lose access to:

Emails
Files
Business systems
Client records
Billing and finance tools

Managed EDR helps reduce this risk by detecting threats early and supporting a faster response.

For many businesses, the cost of downtime can quickly exceed the cost of proper protection.

If your business cannot afford days of disruption, Managed EDR should be part of your security strategy.

7. Clearer Visibility Across Your Devices

Many businesses do not have a clear view of what is happening across their laptops, desktops, and servers.

Managed EDR provides better visibility into device activity, security events, and potential risks.

It can help answer important questions such as:

Which devices are protected?
Has anything suspicious happened?
Are any machines behaving unusually?
Where did an incident start?
Has the threat spread anywhere else?

Without this visibility, businesses are often working blind.

Guard IQ can help you understand what is happening across your devices and where your risks are.

Who Needs Managed EDR?

Managed EDR is especially useful for businesses that:

Handle client, patient, or financial data
Use Microsoft 365 heavily
Have staff working remotely
Need to meet compliance or insurance requirements
Cannot afford prolonged downtime
Do not have an internal cybersecurity team
Want stronger protection than basic antivirus

For small businesses, it is one of the most practical ways to improve cyber resilience without overcomplicating things.

Not sure whether Managed EDR is right for your business? Book a free consultation with Guard IQ.

Is Managed EDR Worth It for Small Businesses?

Yes, for many businesses it is.

The cost of a cyber incident is rarely limited to fixing the infected device.

It can include:

Emergency IT support
Lost working time
Data recovery
Regulatory reporting
Reputational damage
Loss of client trust
Lost revenue

Managed EDR is not just another security product. It is a way of reducing business risk.

It gives you stronger protection, expert oversight, and a much better chance of stopping threats before they cause serious damage.

The real question is not just “Can we afford Managed EDR?” It is “Can we afford to be without it?”

How Guard IQ Can Help

At Guard IQ, we help businesses put the right cybersecurity protections in place without unnecessary complexity.

We can help with:

Managed EDR deployment
Threat monitoring
Alert investigation
Device protection
Microsoft 365 security
Cyber Essentials support
DSPT support
Backup and monitoring
Incident response planning
Ongoing IT support

We make sure your business has practical protection in place, without overloading you with jargon or unnecessary tools.

If you are not sure whether your current antivirus is enough, we can review your setup and recommend the right level of protection.

Final Thoughts

Cyber attacks are becoming more common, more automated, and harder to spot.

Managed EDR gives your business a stronger line of defence by combining advanced detection technology with expert human monitoring.

For businesses that rely on their systems, data, and client trust, it is no longer a luxury. It is becoming a sensible baseline for modern cybersecurity.

Ready to strengthen your business security?

Book a free consultation with Guard IQ today and find out whether Managed EDR is the right fit for your business.

Visit: www.guardiq.co.uk

The post What Is Managed EDR and Why Does Your Business Need It? 🛡️ first appeared on Guard IQ.