Start with one module
Ten modules, each switched on separately. Most small businesses begin with EDR or email protection; the table below tells you which one fits your situation.
One console to detect, investigate and respond. EDR, email, network, threat intel and SOAR integrated — without the complexity of an enterprise SIEM.
Ten modules, each switched on separately. Most small businesses begin with EDR or email protection; the table below tells you which one fits your situation.
Add SIEM when you need central logs, vulnerability management when an audit asks for patch status. Same console, same agent, no migration between products.
Pricing is per endpoint by plan: Starter up to 250 endpoints, Team up to 2,500, Enterprise beyond. Log volume does not change the bill.
Protoxol ingests from Wazuh, Splunk, Elastic, Suricata, Microsoft 365 and Okta, so an existing log source becomes an input instead of a replacement project.
Response automation runs with human approval by default. Your admin confirms an isolation or an account action before it executes.
SaaS hosted in the EU, or installed on your own infrastructure when a customer or regulator requires it. Support in English and Spanish.
Small businesses face the same attacks as large ones — phishing, credential theft, ransomware — with a fraction of the staff. Stacking separate tools for endpoint, email and logs multiplies cost and console-switching instead of reducing risk.
Protoxol brings endpoint protection, email security, log search and response into one console your existing team can run. Start with the modules you need now and add more as you grow. Talk to us and we will map the fit to your environment honestly.
Protoxol has ten modules and you switch each one on separately, on the same console. Nobody needs all ten on day one. Find the row that describes your company and start there; the "add next" column is what usually follows once the first module is running.
| Your situation | Start with | Add next | Why |
|---|---|---|---|
| Antivirus only, no endpoint protection beyond it | EDR | SIEM & search | Ransomware and credential theft start on a laptop. Behaviour detection and remote isolation cover what antivirus misses; central logs make sense once there is endpoint telemetry to correlate. |
| Already have an EDR, no central logs | SIEM & search | Threat intel, response automation | Your EDR knows what happened on the host. A SIEM tells you what happened everywhere else: Microsoft 365, Okta, firewall, servers. Protoxol ingests from Wazuh, Splunk, Elastic and Suricata, so you keep the EDR you have. |
| Phishing is the main incident | Email protection | EDR | If the incidents you actually handle start in a mailbox, protect the mailbox first. The endpoint that opens the attachment is the second layer. |
| Microsoft 365 and remote laptops | EDR + email protection + identity logs in SIEM | Credential exposure | A laptop at home never passes through the office firewall. Endpoint telemetry and sign-in logs from Microsoft 365 are the only signals you get, so collect both. |
| Audit or compliance pressure | SIEM & search + vulnerability management + reporting | Asset inventory | Auditors ask for retained logs, patch status and evidence that someone reviews both. These modules produce that evidence from data you already collect. |
| MSP serving several clients | The platform, multi-tenant | Modules per client | One console across all clients, with modules activated per client. See cybersecurity for MSPs for how that works. |
If central logs are the gap, SIEM for small business explains what to collect first, how the four common pricing models grow your bill, and how to compare SIEM vendors on the alerts a person actually reads.
If you only run antivirus today, EDR for small business puts EDR and antivirus side by side, and covers deployment through your MDM, agent overhead and what happens when you isolate a host.
If you run security for several companies, cybersecurity for MSPs covers multi-tenant operation, per-client module activation, per-client reporting and per-endpoint pricing across your whole client base.
If you already run Wazuh, or someone proposed it, the Wazuh alternative page weighs the free licence against the hours that keep it alive, and shows how Protoxol ingests Wazuh output so you can keep it as a source.
For the full list of the ten modules, the EU-hosted and self-hosted deployment options and the integrations with Wazuh, Splunk, Elastic, Suricata, Microsoft 365 and Okta, read the Protoxol platform overview.
A focused deployment starts with priority endpoints and data sources and delivers operational value from the first days. Full scope depends on your environment; we define it together before you commit.
Pricing is per endpoint and depends on the modules you activate. There are no fixed public prices because environments differ; request a quote and you will get a proposal mapped to your actual scope.