AI did not invent new attack techniques. It removed the cost, skill, and time that used to limit them, and MSPs absorb that shift across every client at once. Todyl unifies layered security on one platform and one console, so correlation is the default instead of an integration project.
Offered as-a-service. No annual contracts, no hardware required.
Recognized by the channel and reviewed by the people who run it
The techniques are familiar. The economics are not. When an attack costs almost nothing to run, more attackers hit more targets faster, and a provider feels it across every client at once.
Working exploits now appear before the vendor advisory does. That breaks the assumption monthly patch cycles are built on, because there is no quiet window between disclosure and attack. Some flaws are exploited before a patch is available. TK · source
Automation made attacking the two-hundredth company as cheap as attacking the first, so attackers stopped skipping small businesses. Extortion malware showed up in 88% of SMB breach incidents. Being small is no longer a reason attackers skip a target. TK · source
82% of detections involve no malware at all. Attackers buy or steal credentials and session tokens, then sign in and look like an employee. There’s no file to quarantine and no failed login to alert on, so anything watching only for malware misses it. TK · source
97% of ransomware victims compromised through credentials already had MFA somewhere in the environment. The problem is coverage, not presence. Legacy authentication, dormant service accounts, VPNs, and admin consoles are usually where MFA never reached. TK · source
Endpoint alerts land in one console, identity events in another, and network and cloud activity often go unwatched. An attack that moves across all four looks minor in each one. Identity logs are the clearest example: if you don’t collect them, credential abuse leaves no trace at all.
Twenty-nine minutes is the average time from first access to lateral movement. Business-hours triage can’t keep up on its own. The real question isn’t who is watching at 3am, it’s how an attack gets contained when nobody is awake. TK · source
The answer isn’t another product category. It’s an architecture that does four things well and can show its work.
Prevention at the network and endpoint stops commodity malware, phishing, and opportunistic intrusion at the lowest cost per event, which covers the large majority of attempts. SASE replaces flat VPN reachability with identity-aware access and adds Secure DNS, content filtering, firewall policy with IPS, and microsegmentation that removes the mechanism ransomware uses to spread. Endpoint security evaluates process lineage rather than signatures alone. What matters is which techniques a layer stops, not the category it is sold under.
Todyl ingests and normalizes network, identity, endpoint, and cloud telemetry to a common schema, with retention long enough to reconstruct an intrusion, not just alert on it. Detection quality is bounded by telemetry coverage and retention. A control plane you don’t collect from is a bigger gap than a missing control, because nothing reports on it.
Correlation turns three unremarkable events into one case. A blocked DNS request, an atypical sign-in, and a script interpreter launch on the same account within twenty minutes are one intrusion, not three alerts. Behavior-based identity analytics score each user against their own rolling baseline and then a peer cohort of comparable roles and comparably sized organizations, so a new tenant or a new hire is covered on day one without commingling tenant data.
Built-in GRC draws evidence from the same telemetry that drives detection and maps once across overlapping regimes, so an audit request becomes a query rather than a project. That evidence answers the insurer asking what percentage of authentication paths enforce MFA, the board asking for residual risk against a named framework, and the enterprise buyer whose questionnaire gates the contract.
SASE, Endpoint Security, SIEM, MXDR with behavior-based identity analytics, and GRC share a platform and a console. One agent carries SASE, Endpoint Security, and SIEM. Fewer agents, fewer consoles, and predictable pricing that packages a 15-seat client and a 500-seat client alike. Turning on another layer later doesn’t mean onboarding another vendor or pushing another install.
One to twenty-five endpoint clients, mostly single-location small businesses on Microsoft 365 or Google Workspace with default security settings. The constraint is time, not expertise.
Twenty-five to three hundred-plus endpoint clients, no dedicated SOC, business-hours triage, and identity logs that are frequently not ingested. Standardize what secure means, then apply it without rebuilding it per tenant.
Fifty to five hundred-plus endpoints per client, multi-site environments, some in-house security capability, and regulated verticals where clients face questionnaires, audits, and insurance attestations.
A global manufacturing client was running four internet-facing RDP servers in Azure on public IPs, reached over an OpenVPN tunnel. That is the flat, credential-trusting access automated reconnaissance looks for. After a ransomware incident, Blueclone replaced the arrangement with Todyl SASE.
“End users have shared that they love that they log in to their PC and it just works, whether they are in one of the office locations, at home, or traveling.”
Each capability sits under the outcome it delivers, with what it actually stops, sees, catches, or proves. Every module runs on the same platform and the same console.
Identity-aware access replaces flat VPN reachability, so a contractor laptop reaches one application rather than a routable subnet. Secure DNS and content filtering block newly registered and known-malicious destinations before anything executes, TLS inspection scans the encrypted sessions that carry most modern threats, and LAN microsegmentation removes the peer-to-peer SMB and RDP paths ransomware uses to spread.
Prevention evaluates process lineage rather than signatures alone: documents spawning interpreters, encoded PowerShell, reflective DLL injection, LSASS access. Application control, device control, and tamper protection are enforced rather than advisory.
Continuous assessment surfaces the exposures attestations miss: legacy authentication, dormant service accounts, standing global admin rights, OAuth grants, and public exposure.
Ingestion and normalization to a common schema across all four control planes, so events from different planes correlate automatically instead of by hand. Retention supports reconstruction, not just alerting. As a working standard, 30 days is a floor, 90 days defensible, and six months aligns with advisory guidance. TK · product for included retention by module and tier.
Identity sign-in and directory audit logs, without which credential abuse leaves no trace, plus cloud control-plane activity: inbox forwarding rules, mailbox delegation, external sharing changes, access key creation, and audit logging being disabled.
Process, registry, and network records that make malware-free intrusion visible, retained long enough to reconstruct what happened rather than confirm that something did.
Flow and DNS records from every agented session, plus encrypted traffic analysis where inspection is impractical.
Detection engineers work a unified case record across host, account, network, and cloud. Behavior-based identity analytics score deviation against each user’s own rolling baseline and then a peer cohort of comparable roles and comparably sized organizations. A 15-seat firm and a 500-seat manufacturer are each judged against their own normal, with no commingling of tenant data.
Prebuilt anomaly detections, threat intelligence enrichment, ATT&CK coverage mapping, correlation rules, and custom rule authoring when a client environment needs something specific.
Isolate the host, disable the account and revoke sessions and refresh tokens, block the indicator, capture volatile evidence. Decisions are made and rehearsed before an incident, with explicit authority for what can be actioned without waking anybody.
Findings are weighted by how many attack stages they span and how consistently independent signals agree, so the queue is ordered by likely severity rather than arrival time.
Map once across overlapping regimes as client obligations accumulate: CIS v8.1, NIST CSF 2.0, PCI DSS v4.0.1, NIST SP 800-171 where CMMC Levels 1 and 2 apply, and HIPAA. A policy library, control-state dashboards, and artifacts show operation over a period rather than a screenshot from one afternoon.
Evidence comes from the same telemetry that drives detection, so an audit request becomes a query against retained data rather than a collection project across four consoles.
Measured detection and response times, documented containment authority, and a defined escalation path. These are the operational facts underwriters, boards, and enterprise buyers ask providers to produce. TK · service delivery for published figures.
Agent deployment coverage and EDR capability reporting, in the form insurers and regulators ask for it: what percentage of endpoints run the agent, and what the agent is enforcing.
The alternatives most providers are choosing between, judged on what layered security has to deliver rather than on feature counts.
Scroll table horizontally →
Comparison reflects the typical architecture of each approach, not any single named competitor. Individual products and licensing tiers vary. The Todyl column reflects published Todyl product documentation and the current campaign messaging brief. Claims sourced only to the brief need product confirmation before launch.
“Before Todyl, we were using about 8 tools per machine, which was a hassle to image and onboard. Now, we just use Todyl and our RMM, and have cut our onboarding time down to less than an hour.”
“Consolidating networking and security into a single platform and agent just makes sense from an overall business perspective.”
“With Todyl, my team can deliver better security through a single-pane-of-glass with robust reporting that we didn’t have with multiple vendors.”
Not the techniques. The cost, the skill required, and the time involved. Capable attacks no longer require capable attackers. Exploitation begins in minutes rather than days once a vulnerability is known, and weaponization now frequently precedes the advisory. Automation made the two-hundredth target as cheap to attack as the first, so organizations once dismissed as too small to target are now attacked because they are easier to compromise.
For a provider the practical consequence is volume and simultaneity: more attacks against more entry points across more environments than manual, business-hours triage can keep pace with.
No, and treating it that way is what leaves the gaps. Prevention, detection, and response have different success criteria, and each has to hold across network, identity, endpoint, and cloud. Several point tools deployed alongside one another produce the seams an intrusion crosses. A unified approach is judged by whether signals from those layers arrive as one case.
The useful evaluation question for any layer is the same three-part one: which attacker techniques does this stop, what would we need to see to catch what it does not, and what can we prove afterward?
Because 82% of detections are malware-free, and credentials and session tokens change hands more often than malicious files. When an attacker authenticates successfully, there is no malware to find and no failed login to alert on. The evidence is behavioral, and it only exists if identity telemetry is being ingested. TK · source
97% of credential-compromise ransomware victims had MFA somewhere in the environment. Strong authentication remains necessary and is no longer sufficient. The exposure is coverage rather than presence, and the gaps are consistently in the same places: legacy authentication, dormant service accounts, VPNs, and management consoles. Session token theft also bypasses the prompt entirely, so post-authentication behavior has to be monitored. TK · source
Enough to reconstruct an intrusion, not just alert on it. As a working standard: 30 days is a floor, 90 days is defensible, and six months aligns with advisory guidance. If retention expires before the investigation starts, part of the incident can never be explained to the client, the insurer, or the regulator.
Identity threat detection and response covers the intrusion that never touches a file: an authenticated session, an inbox rule, a token replay, a permission grant. Most endpoint-centric MDR sees identity as sign-in alerting, if at all. ITDR scores behavior after authentication succeeds and correlates it with what the host and the network were doing at the same moment.
Normal differs sharply between a 15-seat firm and a 500-seat manufacturer, and between a traveling executive and a back-office clerk. That’s why generic thresholds fail in both directions, creating noise in busy environments and silence in quiet ones.
Todyl scores each user against their own rolling baseline and then against a peer cohort of comparable roles in comparably sized organizations. The cohort covers a brand-new tenant or a new hire on day one, and it works without commingling any tenant’s data.
It’s the decision, made in advance, about which response actions can be taken without waking somebody up: isolate the host, disable the account and revoke sessions and refresh tokens, block the indicator, capture volatile evidence. With average eCrime breakout time at 29 minutes, the question isn’t who is watching at 3am, it’s who is permitted to act when nobody is awake. TK · source
Partly, and the boundaries matter. Native signal across identity, mail, and endpoint inside Microsoft 365 is broad, but capability is gated behind licensing tiers, is frequently not enabled, and default retention is short and expensive to extend. Visibility is weakest outside Microsoft: network traffic, unmanaged hosts, and non-Microsoft SaaS.
There is also a structural issue worth raising with clients: the same control plane is both the primary target and the primary detector. Tuning, correlation, 24x7 triage, attack surface reduction at the network, and the evidence layer all remain the provider’s responsibility.
Todyl GRC maps once across overlapping regimes so effort isn’t duplicated as client obligations accumulate: CIS v8.1, NIST CSF 2.0, PCI DSS v4.0.1, NIST SP 800-171 where CMMC applies, and HIPAA. Artifacts show controls operating over a period rather than a point in time.
Open items: TK · product. The campaign brief cites NIST SP 800-171 Rev. 2 and the live SASE page cites Rev. 3. Confirm which revision is supported and align both pages, and confirm whether GDPR and CMMC Levels 1 and 2 belong in this list.
Specific, quantified control operation: what percentage of authentication paths enforce MFA, what percentage of endpoints run the agent, whether backups are tested, what the measured time to containment is. Attested controls that don’t match operational reality create the exposure. Evidence drawn from live telemetry is more reliable than a questionnaire answered from memory.
For providers there is a second dimension. National authorities now publish due-diligence checklists clients use to assess their MSP, so the provider’s own posture is part of the sale.
Compare it against the cost of a serious incident and against the labor line that never appears on a license. Normalization, correlation, retention, detection content, tuning, and after-hours coverage are real costs wherever they sit. A DIY or point-tool assembly moves them onto your engineers, where they compete with billable work. Todyl is offered as-a-service with no annual contracts, and packages a 15-seat client and a 500-seat client alike.
Every module below runs on the same platform and the same console, and one agent carries SASE, Endpoint Security, and SIEM. Enable what you need, when you need it.
Identity-aware access, ZTNA, Secure DNS, NGFW with IPS, TLS inspection, and LAN microsegmentation.
Learn more ModuleEDR and next-gen antivirus with behavioral prevention on process lineage, application and device control.
Learn more ModuleCloud-native collection, normalization, and correlation across network, identity, endpoint, and cloud.
Learn more Module24x7 detection engineers with behavior-based identity analytics (ITDR) and pre-decided containment authority.
Learn more ModuleAutomated framework mapping, posture assessment, and evidence drawn from the same telemetry as detection.
Learn more ModulePlaybook-driven response and workflow automation across the platform.
Learn moreA vendor-neutral walkthrough of what layered security requires, organized by the decisions a provider has to make.
How SASE and ZTNA improve on traditional VPN security, and what to migrate first.
Identity and device-level access control applied to unsanctioned AI tools.
The evaluation questions for each layer, and what to ask any vendor about telemetry and evidence.
See how Todyl reduces the attack surface, unifies the telemetry, detects inside the breakout window, and produces the evidence your clients are asked for, on one platform and one console.
No hardware required. Offered as-a-service, with no annual contracts.