In short: The Todyl Security Platform is a modular, cloud-native security service that combines SASE and zero trust access, endpoint protection (EDR and NGAV), a managed SIEM, managed extended detection and response (MXDR), LAN microsegmentation, governance and compliance tooling and security automation. Modules share one agent and one console and are chosen per organisation.
What Todyl is
Most small and mid-sized organisations end up with a VPN from one vendor, antivirus from another, a log tool nobody looks at and no one watching overnight. Todyl's answer is a single platform where those pieces are modules of one service, deployed with a single agent and managed from the Todyl console.
Todyl positions the platform for managed service providers, IT teams and security professionals, so it is often delivered by an IT partner rather than run by an in-house security team.
The Todyl modules
| Module | What it does |
|---|---|
| SASE | Connects users through Todyl's Secure Global Network of cloud points of presence. Includes a secure web gateway, secure DNS and web filtering, a next-generation firewall with SSL inspection and identity-based zero trust network access with custom conditional access rules. Static IPs are optional |
| LAN Zero Trust | Microsegmentation for devices on the local network, combined with SASE to limit what each device can reach internally and so restrict lateral movement |
| Endpoint Security (EDR + NGAV) | Next-generation antivirus and endpoint detection and response in one agent, with machine-learning behavioural analytics and automated responses such as isolating a device, quarantining a file or stopping a malicious process |
| SIEM | Todyl's managed, cloud-hosted SIEM. Native integrations with common work applications, identity providers and security tools, plus syslog collectors, with a library of pre-built detection rules, natural-language search and flexible retention policies |
| MXDR | Managed extended detection and response: 24/7 detection and response across endpoints, networks and users, including identity-based attacks such as adversary-in-the-middle and account takeover, with an assigned Detection and Response Account Manager |
| GRC | Governance, risk and compliance tooling: compliance mapping, security assessments, framework tracking, policy documentation and dashboards that integrate with the Todyl SIEM |
| Security Automation | Automated response playbooks: recommended out-of-the-box playbooks plus a builder for your own |
SIEM retention is set by policy, so you can keep a short window for day-to-day detection or a longer one where a regulator, insurer or contract demands it.
How the modules combine
The point of Todyl is that the modules feed each other. SASE and endpoint telemetry flow into the SIEM automatically, the MXDR team works from that same data, and response actions (isolating a device, blocking a connection, disabling a session) can be taken from the same console. Common combinations we see are:
- Secure access only: SASE with zero trust access to replace a VPN and add web filtering for hybrid staff
- Protect and detect: SASE plus Endpoint Security, with SIEM for visibility and log retention
- Fully managed: SASE, Endpoint Security, SIEM and MXDR, so someone is watching and responding around the clock
- Compliance-led: SIEM and GRC added where evidence for audits, insurers or frameworks such as NIST CSF or CIS Controls is the priority
Because the modules share the same agent and console, you can start small and add layers later without replacing what is already deployed.
Who Todyl suits
Todyl is a good fit for:
- SMBs supported by a managed IT provider that want one platform rather than several point products
- Organisations without a security operations centre that need 24/7 detection and response, see our guide to managed detection and response
- Businesses with log retention obligations that cannot justify running a SIEM themselves
- Hybrid workforces where office and remote devices need the same protection
It is less suited to large enterprises with an established SOC and SIEM, or to organisations that have standardised on Microsoft Defender XDR and Microsoft Sentinel and want to stay inside the Microsoft stack.
Todyl compared with alternatives
| If you are weighing up | Consider |
|---|---|
| Todyl vs a standalone business VPN | NordLayer is simpler if you only need remote access and DNS-level protection. Todyl adds endpoint, SIEM and MXDR |
| Todyl vs a firewall vendor's SASE | WatchGuard FireCloud suits estates already built on WatchGuard Firebox and WatchGuard Cloud |
| Todyl MXDR vs other MDR services | Compare response authority, coverage beyond the endpoint and Microsoft 365 integration in our MDR guide and EDR vs XDR vs MDR |
| Todyl EDR vs dedicated endpoint platforms | See the options in endpoint security and XDR, including Sophos Intercept X |
Deployment and licensing
Todyl is cloud-native, so there is no hardware to install. Deployment is a single agent pushed through your device management tool (for example Microsoft Intune), followed by policy configuration in the Todyl console and, if you take SIEM, connecting your identity provider and cloud apps.
Todyl does not publish prices: cost depends on the modules you choose, the size of your estate, SIEM retention and options such as static IPs. Licensing detail is on Software Licensing UK. For your own figures, ask us for a quote.
We scope which modules you actually need, deploy the agent, tune web and firewall policy, connect log sources and agree with you how MXDR escalations reach your team. Contact us to talk it through.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Todyl?
Todyl is a cloud security platform that combines SASE and zero trust access, endpoint protection, a managed SIEM, managed XDR, LAN microsegmentation and compliance tooling. The modules use one agent and one console, and each organisation picks the modules it needs.
Is Todyl an MDR service?
Todyl MXDR is a 24/7 managed extended detection and response service that runs on the Todyl platform, with an assigned Detection and Response Account Manager. It is one module: you can also use Todyl for SASE, endpoint security or SIEM without the managed service.
Does Todyl replace a VPN?
Yes. The SASE module provides identity-based zero trust access to private resources through Todyl's cloud points of presence, so it can replace a traditional remote access VPN while also filtering web traffic.
How much does Todyl cost?
Todyl does not publish a price list. Cost depends on which modules you take, how many users and devices you protect, the SIEM retention you need and options such as static IPs, so ask us for a quote.
Does Todyl help with Cyber Essentials?
Todyl's endpoint protection, web filtering and access controls support several Cyber Essentials controls, but certification depends on your whole environment. Our Cyber Essentials team can check readiness alongside any platform you choose.