Archives des cybersecurity

Tag: cybersecurity

20 February 2026 0 Comments

Focus, Official Sponsor of MCCE 2026

Focus, Official Sponsor of MCCE 2026: Three Days of Expertise, Innovation, and Meaningful Exchanges

From February 10 to 12, 2026, Focus Corporation participated as an official sponsor of the Maghreb Cybersecurity & Cloud Expo (MCCE 2026), alongside its technology partners Dell Technologies and Fortinet.

This flagship event of the regional IT landscape brought together decision-makers, experts, and key players from the public, industrial, and services sectors to discuss the challenges and opportunities related to Cloud, cybersecurity, and artificial intelligence.

A Three-Day Sector-Based Format

MCCE 2026 was structured into three thematic days, each dedicated to a strategic sector:

Acceleration of industrial digital transformation, IT/OT convergence, operational resilience, and security of connected environments.

Modernization of public services, data sovereignty, adoption of Cloud and AI with a strong focus on compliance and digital trust.

Innovation, customer experience, business continuity, and integration of Cloud and AI technologies to enhance operational efficiency.

This structure enabled discussions tailored to each sector’s business context, fostering rich and relevant exchanges between professionals, decision-makers, and technology experts.

Insightful Exchanges Through Expert Panels

Several panels highlighted key topics shaping digital transformation:

“From IT Cybersecurity to Industrial Cybersecurity: Achieving Alignment” explored how to align IT and OT cybersecurity strategies to ensure the resilience of industrial environments.
“Cloud & AI in the Public Sector: Opportunities, Cyber Risks & Compliance Requirements” provided insights into security, governance, and compliance requirements within public services.
“Critical Services and AI: How to Build Resilient and Secure IT Environments” addressed the challenges of integrating AI into critical infrastructures while maintaining security, performance, and resilience.

The contributions of Focus, Dell Technologies, and Fortinet were praised for their relevance, practical approach, and actionable recommendations.

Interactive Live Demonstrations at the Booth

At its booth, Focus showcased several live demonstrations of its key solutions:

SOC as a Service, in collaboration with Fortinet, demonstrating continuous monitoring, advanced threat detection, and automated incident response.
Presentations of Cloud Solutions Ready for AI workloads, featuring GPU as a Service demos.
Demonstrations of QAverse, an AI-augmented software testing platform tailored to enterprise needs.

These demos sparked valuable discussions with visitors, raising technical questions related to use cases, security, and performance.

3 Focus Workshops Dedicated to Each Day

Focus also hosted three targeted workshops, aligned with the themes of each day:

Industry Sector:

Securing Industry 4.0: AI-Driven Cybersecurity for IT/OT Convergence

Public Sector :

AI, Cybersecurity and Sovereign Cloud as Pillars for Modern Public Sector

Service Sector :

AI-Powered Services: Enhancing Customer Experience and Operations

These sessions provided a platform for deep discussions on AI integration, cybersecurity, and digital transformation, offering concrete insights and forward-looking perspectives.

Focus Remains Committed Beyond MCCE

Focus’s participation in MCCE 2026 reaffirms its role as a trusted partner supporting organizations in their Cloud, cybersecurity, and AI challenges.
Whether through managed services, AI-Ready platforms, or strategic advisory support, Focus continues to put its expertise at the service of sustainable and resilient digital transformation

Ready to explore the Cloud and IA with Focus?

If you would like to learn more about our solutions or discuss how we can help you overcome your IT challenges, do not hesitate to book an appointment with our experts. You can also test the capabilities of our Cloud solutions or start by auditing your IT infrastructures to map out your modernization path powered by the IA.

News

7 January 2026 0 Comments

EDR and Advanced Endpoints Protection: Stronger Security Against Ransomware and Intrusions

The New Foundation of Modern Cybersecurity

The endpoint (user workstation, laptop, server, smartphone, virtual machine, industrial terminal, etc.) has become attackers’ preferred entry point.
Remote work, cloud, SaaS, BYOD, VPNs, and remote access: traditional IT boundaries have faded, and endpoints remain the most exposed link.
In this context, EDR is no longer “just another tool,” but a central building block to detect, understand, and stop attacks that bypass traditional antivirus solutions.

What Is an EDR, in Practical Terms?

An EDR (Endpoint Detection and Response) is a security solution installed on endpoints that continuously monitors activity, detects suspicious behavior, and enables fast response (isolating a device, killing a process, blocking a connection, collecting evidence).

The key difference compared to a traditional antivirus is that EDR does not simply look for a known “signature.”
It observes behavior: a sequence of abnormal actions, suspicious privilege escalation, mass file encryption, execution of an unusual PowerShell script, persistence set up at startup, and so on. EDR is therefore particularly effective against modern attacks, often “fileless” or stealthy.

Why Antivirus Is No Longer Enough in 2026 ?

Today’s attacks rely less and less on easily identifiable malware. Attackers use legitimate system tools (PowerShell, WMI, PSExec, macros, RDP), stolen credentials, and lateral movement techniques. As a result, signature-based antivirus can allow a “clean” and silent intrusion to slip through.
EDR provides an operational answer: it gives visibility into the machine’s real activity, rebuilds a timeline, and makes it possible to identify the entry point, the actions performed, and the extent of the compromise.

What an EDR Does During an Attack (Realistic Example)

Detect Abnormal Execution

An EDR monitors execution behaviors to spot what “doesn’t look like” normal activity. For example, encoded PowerShell (often used to hide a command), execution from an unusual directory, or a script launched by an application that has no reason to do so.
It can also detect more advanced attack techniques such as suspicious memory access (credential dumping, code injection), typical of stealth intrusions and modern ransomware.

Correlate Events

Rather than analyzing a single isolated event, EDR reconstructs a chain of actions. It links a “parent” process (e.g., a Word file) to a “child” process (PowerShell), and then to what follows: creation of a scheduled task, persistence at startup, registry modifications, creation of new services, and so on.
This correlation is essential because an attack is rarely visible through one signal alone: it’s the sequence that reveals malicious intent.

Generate a Contextualized Alert

A useful EDR alert does not only say “threat detected.” It specifies who (user account / machine), what (process, command), when (timeline), how (vector: email, browser, USB, etc.), and through which file (name, path, hash).
This context enables IT/SOC teams to qualify the incident quickly, avoid false positives, and decide on the response without wasting time reconstructing the facts manually.

Enable Immediate Action

The value of EDR also lies in response. As soon as activity is confirmed as dangerous, it can isolate the device from the network (while keeping a management channel), kill a malicious process, quarantine a file, or block the executable across the entire fleet.
This rapid action capability is crucial to prevent propagation (lateral movement) and avoid a local incident becoming a global crisis.

Preserve Evidence for Analysis

After the response, analysis is essential: understanding the origin, scope, and objective of the attack. EDR preserves evidence (file hashes, executed commands, dropped artifacts, modified registry keys, outbound connections, contacted domains/IPs).
These traces help confirm compromise, conduct forensic investigation, improve detection rules, and produce clear reporting for management, audit, or compliance.

Advanced Endpoints Protection : Beyond EDR Alone

In practice, modern endpoint protection is not limited to deploying an EDR agent. It relies on a coherent set of complementary controls.
First, EDR must be supported by a hardening policy: patch management, application allowlisting, least privilege, disabling unnecessary services, disk encryption, and log configuration.
Then, EDR delivers its full value when connected to global monitoring: SIEM/SOC, correlation rules, response playbooks, and indicator tracking.
In other words: EDR is the sensor and the actuator at the endpoint level, but advanced protection comes from alignment with identity (IAM), the network, and incident response processes.

EDR, XDR, MDR : Understanding the Differences

These terms are often confused, even though they address distinct needs.

EDR : focused on the endpoint (deep visibility + response on the device).
XDR : expands correlation to other sources (email, cloud, network, identity) for broader detection.
MDR : a managed service (people + tools) that operates detection and response 24/7 for the organization.

For many organizations, the challenge is not only “owning” an EDR, but being able to operate it properly.

How to Succeed with an EDR Project
(Without Falling into the Tool Installed = Secure Trap)

A successful EDR deployment requires a progressive and measurable approach.
The first step is to segment the fleet: user workstations, critical servers, sensitive environments. Organizations often start with a pilot on a representative scope to adjust policies, reduce false positives, and define response procedures. Next, it is essential to formalize scenarios: what do we do if EDR detects exfiltration? Who isolates the machine? How do we restore? What evidence is preserved? Without these rules, EDR becomes an alerting tool, not a response tool.
Finally, the real value of EDR is measured over time: reduced detection time (MTTD), reduced response time (MTTR), improved coverage of endpoints, and fewer recurring incidents.

The Concrete Benefits of EDR for the Business

EDR delivers highly operational gains: deep visibility into what happens on each endpoint, fast detection of abnormal activities, the ability to contain incidents before they spread, and better investigation quality.
But the strategic impact is just as important: EDR strengthens business continuity, secures hybrid environments, and improves the overall posture against targeted attacks (ransomware, credential compromise, silent intrusion).

EDR, an Essential Standard for Endpoint Cybersecurity

Endpoints protection has become a speed battle: detect early, understand fast, contain immediately. EDR addresses this reality by combining continuous monitoring, behavioral detection, investigation, and response actions.
For a modern organization, it is one of the most effective pillars to reduce attack impact and strengthen resilience.

Are your endpoints ready to face modern attacks ?

Deploy EDR to detect suspicious behavior early, isolate compromised devices, and stop threats before they spread across your environment.