Shield360 watches Microsoft Defender on every Windows device and server from one place: protection switched off, definitions out of date, risky exclusions, tamper protection off - or which product protects the device instead (CrowdStrike, SentinelOne, Sophos, ESET and others, servers included). A change reaches you within a minute, with what it means and how to fix it. And when something gets through, it joins what your devices, Microsoft 365 and your firewall see into one incident - and lets you lock the account, stop the process or block the address.
Start a free trial Watch how it works See the pricing Sign in to StreamSoft360
Shield360 is one of the fourteen components of StreamSoft360 - one sign-in, one workspace, one bill.
A walkthrough on the real pages, with captions. Jump straight to the part you need.
Take Shield360 on its own, or in a StreamSoft360 plan with the components that go with it. Priced per device - and a device counts once for Shield360 and Patch360 together. Monthly in Rands, excluding VAT. No setup fee.
More devices in blocks of 10. See every plan and component on the StreamSoft360 page, or talk to us.
Every Windows device and server: is Defender on, is real-time protection on, and are its definitions up to date?
When protection is turned off or a setting changes, the agent reports it straight away - not at the next daily check-in.
What it was, where it came from, which process brought it in and what Defender did - and the ones it couldn't clean, at the top.
An email and a notification for an active threat, an outbreak across devices or protection switched off - one for an outbreak, not fifty.
Scan, update definitions or remove threats on one device or all of them - Defender's own actions, each one in the audit log.
Cut an infected laptop off from the network while it stays in touch with Shield360 - it releases itself after 24 hours unless you extend it.
Firewall, BitLocker, SMBv1, macros, attack surface reduction rules and more - 23 checks against Cyber Essentials or Essential Eight level 1, 2 or 3.
A whole drive, the Downloads or Temp folder, .exe or PowerShell excluded from scanning - the holes malware walks through.
Whether Defender is locked against being quietly switched off - by malware, or by someone with admin rights.
Cloud-delivered protection, behaviour monitoring and unwanted-app blocking - the parts that catch new malware.
CrowdStrike, SentinelOne, Sophos, ESET, Trend Micro, Bitdefender, Symantec, Trellix, Kaspersky, Cortex XDR and more are recognised on each device - servers too - with a critical finding if one stops running.
Paste a read-only key and your product's detections and health sit beside Defender's - and, if you allow it, isolating a device goes through the product itself.
How old definitions may get and how often devices must scan - 3 days by default, as Cyber Essentials' "kept up to date" expects.
A finding you've decided to live with is accepted with a recorded reason, and stops counting against the device.
A grade per device, the share of devices protected over 90 days, and every device and finding as CSV.
Live malware-protection, hardening and BitLocker checks in Compliance360 for POPIA, ISO 27001, NIST CSF, CIS, Cyber Essentials, the Essential Eight and Joint Standard 2 - and a risk in Risk360.
It uses Defender's own actions and never changes its settings, so it sits happily next to Intune and Microsoft Defender for Endpoint - and shows which devices are onboarded.
Your data in a database of its own, roles, compulsory two-step sign-in and a full audit trail.
Most break-ins start with a stolen sign-in and end on a laptop. Shield360 joins what your devices, Microsoft 365 and your firewall see into incidents, and gives you the controls to respond - each with a reason, in the audit log.
A risky sign-in, malware on the same person's laptop and traffic to a botnet server become one incident - joined by device, person and address, raised when sign-ins and devices are both involved.
Risky sign-ins, password sprays, new administrators and Microsoft 365 Defender's email alerts, read every 15 minutes through a read-only approval - no key kept.
End every session, require a new password or disable the account - in Entra ID or Active Directory - from the incident, behind a Flow360 approval if you want one. Enable it again just as easily.
Rules on every device watch what programs do - Word starting hidden PowerShell, backups deleted, a new Domain Admin. Only the matches leave the device, with passwords in command lines hidden.
Each detection shows what ran, what started it and what it started, the file's fingerprint and who signed it - and "this is expected" stops your own backup script coming back.
Stop the process, quarantine the file (and restore it), or collect an investigation package - events, processes, autoruns and connections, zipped for you.
MikroTik, FortiGate, Sophos and pfSense logs through one of your servers - blocked traffic, VPN sign-ins and password guessing, and anything to or from an address on a threat feed.
Block an address on your MikroTik, FortiGate or Sophos for as long as you choose - Shield360 lifts it when the time is up. Off until you allow it.
If the agent goes quiet while the device is still seen elsewhere, you're told - someone may have switched it off to work unseen.
Incidents and account response come with Shield360. Detection on the devices, the investigation actions and firewall logs are the Shield360 XDR add-on - R299 a month per 25 devices, and in every free trial.
Fixed ones close by themselves at the next report.