Last updated: 23 July 2026. View change log.

This Schedule forms part of the IT Master Services Agreement between you and Cultrix Limited (“Cultrix”, “we”, “us”), and sets out the scope, responsibilities and limits that apply to Endpoint Protection and Security Services.

Security Services give your devices, users and cloud services extra protection, through tools such as antivirus, endpoint detection and response (EDR), security operations centre (SOC) monitoring, SaaS threat detection, cloud backup and other security controls.

These services build on core IT Support, Patch Management, Monitoring and Alerting and Backup and Recovery, but are separate from them. They are generally optional and only apply where they are included in your Order. You may not use all of the services and components described here.

1. Service overview

Endpoint Protection and Security Services are designed to:

  • reduce how likely, and how damaging, malware, ransomware and other attacks are on in-scope devices and accounts;
  • give you enhanced detection, investigation and response through EDR and SOC services;
  • improve the security posture of cloud environments such as Microsoft 365 and Google Workspace;
  • support user-level protections, including cloud backup, phishing defence and awareness training;
  • provide optional endpoint-level backup and business continuity capabilities.

Security Services do not guarantee that security incidents will never happen, but they greatly improve visibility, resilience and your ability to respond effectively when issues arise.

2. Packages and modular activation

Security Services come as a mix of packages and standalone components. In summary:

  • Patch – operating system and software patching only, with no Service Desk access and no security tooling.
  • Support – adds Service Desk access to Patch, but does not include Shield, Guardian or User Protection by default.
  • Support + Shield – Support plus the Shield security stack and enhanced security policy management and support.
  • Guardian – Support + Shield plus SOC monitoring (RocketCyber) for higher levels of security incident visibility and response.
  • Shield (standalone) – you can also buy the Shield security stack on its own, without a Support package.
  • User Protection – a separate package focused on user and cloud security, which you can buy on its own or alongside any support package.

We deliver all Security Services on a modular activation basis. This means that, even within a package:

  • individual components (for example specific agents or user protections) can be provided as standalone services; and
  • you do not have to switch on every available component in a package if it is not right for your environment.

Your Order sets out which packages and components are in place, and for which devices, users, tenants or environments.

3. Endpoint Protection (devices)

Endpoint Protection focuses on physical and virtual devices such as desktops, laptops, servers and covered endpoints. Where purchased, it may include some or all of the following:

  • Shield – an endpoint security stack delivered through enterprise-grade security tools, made up of:
    • Antivirus;
    • Endpoint Detection and Response (EDR);
    • ransomware protection features; and
    • DNS filtering to block known malicious destinations.
    You can buy Shield as a standalone product, or as part of Support + Shield or Guardian.
  • Guardian – the Shield stack plus Security Operations Centre (SOC) monitoring via RocketCyber and integrated SIEM tooling. Guardian gives you 24/7 triage and escalation of security alerts raised from in-scope devices and environments.
  • Vulnerability scanning – where purchased, vulnerability scanning on in-scope devices and systems (for example using Vulscan or equivalent tooling) to highlight missing patches, misconfigurations and known vulnerabilities.
  • Endpoint backup and business continuity – where purchased, endpoint-level backup and the ability to recover covered endpoints as virtual machines (for example in the cloud) after a device fails. These services are described further in the Backup and Recovery Schedule and linked to Endpoint Protection for entitlement and packaging.
  • On-premise BCDR appliances – where purchased, suitable backup and business continuity appliances for server-level backup, disaster recovery and business continuity, as described in the Backup and Recovery Schedule.

Endpoint Protection applies only to devices that are correctly onboarded to the relevant security tooling and remain reachable by those tools.

4. User Protection (accounts and cloud services)

User Protection focuses on identities, accounts and cloud services rather than physical devices. Where purchased, it may include:

  • Cloud Backup (cloud-to-cloud backup for Microsoft 365 and/or Google Workspace) – backup of supported Microsoft 365 data such as Exchange Online, OneDrive, SharePoint Online and, where supported, Teams, and of supported Google Workspace data such as Gmail, Google Drive, Shared Drives and other Google Workspace user data. We sometimes call this “Cloud Backup”, and it is also described in the Backup and Recovery Schedule.
  • Cloud Threat Detection and Response (SaaS Alerts or equivalent) – monitoring of in-scope SaaS platforms (for example Microsoft 365 and Defender) for suspicious activity, misconfigurations and risky behaviour, with alerts fed into our security workflows.
  • Dark Web Monitoring (DarkWebID or equivalent) – monitoring for exposed credentials linked to your domains, to help identify where passwords may have been compromised.
  • Email Security – advanced phishing and email threat protection, currently provided via Graphus and moving to Inky or equivalent, typically marketed as “Email Security”. This may include link and attachment scanning, impersonation detection and other controls.
  • Phishing simulations and cybersecurity awareness training (BullPhish or equivalent) – regular phishing simulations and related training content to help users recognise and report suspicious emails.

You can buy User Protection as a bundle or as individual components. It is typically licensed per user and may not cover everyone in your organisation unless your Order says so.

5. Standalone and add-on security services

As well as the packages above, some security services are available as standalone or add-on options. You can use them alongside Endpoint Protection, User Protection or on their own. They include, but are not limited to:

  • Password management – for example Keeper or a similar password manager;
  • Virtual Private Network (VPN) services – secure remote access for in-scope users and devices;
  • Vulnerability scanning – periodic or continuous scanning of in-scope networks, endpoints or servers;
  • Penetration testing – scheduled penetration tests (for example using Vonahi or equivalent) to check how well security controls work;
  • Security posture improvement – targeted initiatives such as Microsoft Secure Score improvement (“Fortify”), as set out in your Order;
  • Other specialist security tools and services – where we agree them separately in writing.

Unless your Order says otherwise, we treat these services as add-ons, and they may be chargeable on either a recurring or project basis.

6. Service boundaries and exclusions

Endpoint Protection and Security Services are designed to strengthen your security posture, but they have important boundaries. Unless your Order says otherwise, Security Services do not include:

  • guaranteed prevention of all attacks, breaches, malware infections or data loss;
  • coverage of any device, user, tenant or environment that has not been onboarded into the relevant security tooling;
  • coverage of devices where security agents are repeatedly disabled, removed or blocked from communicating;
  • design and delivery of full security architectures, Zero Trust implementations, firewall rule sets, segmentation designs or MDM/BYOD rollouts (we deliver these as projects under separate arrangements);
  • comprehensive compliance programmes (for example CE/CREST/DORA/PCI/ISO) beyond using security tools that may support such programmes;
  • response and recovery for incidents outside the scope of the tools and services in place.

Where we detect an incident, we usually carry out remedial work under IT Support, Backup and Recovery or project arrangements, depending on the nature and scale of the incident.

7. Customer responsibilities

To keep Endpoint Protection and Security Services effective, you must:

  • give us, and keep up to date, accurate records of in-scope devices, users, domains and tenants;
  • allow us to install and run the required security agents and integrations, and avoid disabling or tampering with them;
  • keep systems and endpoints powered on and connected where practical, so updates and security functions can run;
  • encourage users to follow reasonable security practices, including MFA, password hygiene and awareness training;
  • tell us about significant changes (for example new systems, mergers or major expansions) that may affect coverage;
  • act on reasonable recommendations we make to maintain or improve your security posture.

8. Dependencies on third-party platforms

Security Services rely on various third-party tools and platforms, which may include (but are not limited to) security monitoring platforms, endpoint protection tools, email security services, password management solutions, VPN providers, and cloud platforms such as Microsoft 365 and Google Workspace.

The availability, performance and feature sets of these platforms are outside our direct control. We will act reasonably to work with our suppliers and adapt our services where vendors make changes, but we are not responsible for vendor outages, product retirements or feature changes.

9. Changes to this Schedule

We may update this Schedule to reflect changes in security tooling, vendor capabilities, best practice or the range of Endpoint Protection and Security Services we offer. We will publish updated versions on our website and, for material changes, give reasonable notice.