Hardware and Endpoint Refresh
Some machines cannot be secured. They can only be replaced.
A workstation that will not take current baselines is not a hardening problem, it is a hardware problem. Knowing which is which is the difference between spending money and wasting it.
Assessment
What we look at
- Endpoints that cannot meet the Defender and attack surface reduction baseline
- Machines without TPM 2.0 or Secure Boot, which blocks BitLocker and modern attestation
- Operating systems past end of support, or on a version that no longer gets security updates
- Firmware and driver support status from the manufacturer
- Storage and memory headroom, since an endpoint that cannot run EDR without crawling gets EDR turned off
- Devices still joined to nothing, unmanaged and invisible to policy
Scope
What the engagement looks like
You get an inventory that separates replace now, replace this budget cycle, and fine as is, with the reason for each. Not a vendor quote dressed up as a recommendation.
For the machines that need replacing we specify what they should be, so the replacement clears the baseline for its whole service life rather than only on the day it is bought. When the hardware arrives we stand it up hardened: disk encryption on, baseline applied, enrolled in policy, EDR reporting before it reaches a desk.
Procurement stays yours. We are not a reseller and take no margin on hardware, which means the recommendation is not a sales tool.
Fit
Who this is for
Small businesses running a mix of machines of unknown age, where nobody can say which ones are actually a risk. Common after a few years of replacing computers one at a time as they die.
It pairs with an assessment. The assessment finds the gaps, and this answers the part of the answer that configuration alone cannot fix.
Where to next
- Not sure you need this yet? The free domain check reads your public DNS in about ten seconds and tells you what the rest of the internet can already see.
- Most of this work is covered by Security Essentials, at $395 onboarding then $199 a month for teams up to 20.
- Want the whole picture first? The assessment covers identity, email, endpoints and backups, and everything else starts from what it finds.
Better security starts with knowing what is missing.
Start with a focused assessment. Fix the highest-priority gaps. Add the right layers over time.