Our Security Stack: Tools Behind Leonidas Cybersecurity

People often ask us what's in the Leonidas security stack — which products, which platforms, which integrations. The honest answer is that the specific products matter less than the layered architecture they fit into. A well-chosen tier-two EDR plus a disciplined identity policy outperforms an elite EDR with permissive identity controls. What follows isn't a vendor list — it's the layered architecture we build for clients and the tool categories that occupy each layer.

Layer 1: Identity

Identity is the new perimeter, and identity-layer controls are the most consequential security investment for most businesses. The core elements at this layer: multi-factor authentication enforced on every account (with phishing-resistant MFA — security keys or platform authenticators — wherever risk warrants), conditional access policies that limit sign-ins by location, device posture, or risk score, privileged access management that puts admin credentials behind just-in-time elevation rather than persistent assignment, and continuous monitoring of identity events for impossible-travel and credential-stuffing patterns.

For most clients, this layer is built on Microsoft Entra ID (formerly Azure AD) with conditional access policies tuned to the business's actual risk profile, paired with privileged access management to control administrative access. The investment here pays back disproportionately — most of the high-impact breach scenarios start with credential compromise.

Layer 2: Endpoints

The endpoint is where most attacks become visible. Modern endpoint protection includes:

• EDR (Endpoint Detection and Response) — behavioral detection of anomalous process behavior, not just signature matching
• MDR (Managed Detection and Response) — for clients without internal analyst capacity, layering human analyst review on top of EDR telemetry
• Patch management — automated, monitored, with separate fast-track for critical CVEs
• Full-disk encryption — BitLocker on Windows, FileVault on Mac, enforced via policy
• Application allow-listing — where the environment allows it, restricting what binaries can execute

The MDR layer is often the right answer for SMB clients. They get the value of a 24/7 SOC without having to build one internally. The tooling at this layer typically includes platforms like SentinelOne, CrowdStrike, or Microsoft Defender for Endpoint depending on the existing environment.

Layer 3: Network

Network controls have evolved past "firewall in the closet." The current stack includes proper network segmentation (separating user, server, IoT, and guest networks at L3, not just VLANs), modern firewall policy with deep packet inspection and TLS inspection where appropriate, DNS-layer filtering to catch malware command-and-control beaconing and phishing-domain access at the network egress, and secure access service edge (SASE) or zero trust network access (ZTNA) for remote and hybrid workers.

For most SMB environments, this layer runs on platforms like Cisco Meraki, Fortinet, or similar managed firewalls paired with a cloud-delivered DNS security service.

Layer 4: Data and Backup

The data layer combines protection of data at rest and in motion, classification of data sensitivity, and resilient backup with restoration testing. The critical attribute at this layer is immutability — backups must be unreachable from compromised credentials, which means cloud-stored backups with separate authentication or air-gapped on-premises backups with tamper-resistant retention. Regular restoration testing — not just backup completion alerts — is the other non-negotiable. Backups don't exist until they've been restored.

Layer 5: Monitoring and Response

The monitoring layer ties everything together with centralized log collection, correlation across data sources (identity events, endpoint detections, network anomalies), detection rules that surface real incidents above the noise, and an incident response workflow that turns detection into action. For clients with full-time security teams, this is a SIEM platform with internal analyst coverage. For clients without, it's a managed SOC service. Either way, the goal is the same: turn telemetry into action quickly enough to limit damage.

If you're trying to figure out which layers of your current security stack are solid and which have gaps, a free 30-minute assessment covers the architecture-level review without requiring deep document gathering up front.