Bitdefender GravityZone
Done Properly
One Agent. Three OSes.
EDR, XDR, Patch Management, Full Disk Encryption and Email Security, deployed and tuned by an MSP that has lived in the GravityZone portal since 2018. Windows, macOS and Linux from a single console.
Endpoint security as most SMEs have it, versus done properly.
What we typically find on a first audit, and what changes after a GravityZone deployment.
Most SMEs we audit have antivirus. Almost none have EDR. The gap is where breaches live.
AV catches the known-bad file. It does not catch the attacker who has already bypassed the AV and is now using Windows' own signed binaries, certutil.exe to decode a payload, bitsadmin.exe to download from a CDN, mshta.exe to execute a script from a remote server. None of these are malware. All of them are standard Windows tools. AV sees signed binaries doing things signed binaries do. EDR sees the sequence, and the sequence is the attack.
The dwell time problem makes this worse. The average time between initial compromise and detection in an SME environment is still measured in weeks. The attacker spends that time mapping the network, identifying the backup target, locating the finance shares, harvesting credentials. By the time a ransom note appears, lateral movement happened days ago. EDR doesn't always prevent the initial foothold, but it does dramatically compress the window between entry and detection.
The mixed-fleet version of this is worse. Defender-only shops have meaningful telemetry on Windows endpoints and none at all on macOS or Linux. Every attacker who has read a penetration testing report knows that Macs in a Windows-centric org are under-monitored. Linux servers running web apps on AWS with no EDR are a free pivot point once someone exploits the web app. "Linux doesn't get viruses" was approximately true in 2005. The attackers didn't get that memo.
A fully patched Windows fleet with Defender on Business Premium and someone who reads the alerts is genuinely decent endpoint security, for a 100% Windows org with no Linux and no Macs. The moment that stops being true, the gaps appear fast. We will tell you honestly whether you need to move.
The cyber-insurance angle is no longer theoretical. Renewal questionnaires for 2026 explicitly ask whether EDR with continuous monitoring is deployed. "We have antivirus" used to satisfy underwriters. It does not now. POPIA Section 19 requires appropriate technical measures, South African regulators are interpreting that with EDR-shaped expectations for anything handling regulated data. The compliance case for EDR is no longer optional for most businesses we work with.
GravityZone Modules We Deploy
Three things most GravityZone deployments get wrong
The licence is the easy part. Policy build, OS-specific tuning, and the mixed-fleet blind spots are where self-managed rollouts run into trouble.
01. Policy build: default settings will quarantine your backup software
GravityZone ships with sensible defaults that are not the right defaults for your environment. Default Advanced Threat Control settings flag backup agents, RMM tools, and legitimate admin scripts as suspicious, because they are behaviourally indistinguishable from malware. A rollout that goes straight to maximum sensitivity without a pilot phase will have your backup software quarantined and your IT team fielding calls within 48 hours.
The correct sequence: pilot group of 10–20 endpoints across your actual OS mix, observe for two weeks in Detection-only mode, tune ATC exclusions for known-legitimate tooling, validate Patch Management schedules don't fire during business hours, then roll to the full fleet. We write the exclusion list as part of the engagement. You get a policy that is actually tuned to your environment, not the same BEST template every MSP ships unchanged.
02. Mixed fleet: macOS and Linux need specific attention
The GravityZone macOS agent requires a set of system extension approvals (full disk access, network filtering extension, device management profile) that are not automatically granted on user-provisioned Macs. MDM deployment, via Intune or Hexnode, is the correct path. On an unmanaged Mac, the approval workflow requires physical user interaction at the device, which scales poorly past ten endpoints. We handle the MDM profile push as part of the rollout rather than leaving it as a user self-service step.
Linux is different again. The correct agent variant depends on the kernel version and distribution. Ubuntu 22.04 LTS needs a different kernel module build than Amazon Linux 2023. On RHEL-family systems, the SELinux policy interaction matters. We have run these combinations on actual client servers, Ubuntu, Debian, Rocky Linux, SUSE Enterprise, Amazon Linux, and know which edge cases to check before declaring an agent healthy. "Green in the console" is not the same as "kernel module loaded and on-access scanning active."
03. AV removal: two security products on one endpoint is not a transition state
Two AV products on the same endpoint compete for file-system hooks, slow each other down, and produce conflicting quarantine actions. Some combinations cause boot loops. The transition window, old AV still present, GravityZone agent just installed, needs to be measured in hours, not days. We script removal of common products as part of every deployment: Sophos, ESET, Kaspersky, Trend Micro, Norton, McAfee, Avast, AVG. Windows Defender gets pushed to passive mode automatically by the GravityZone installer, but it is worth verifying passive mode actually engaged rather than assuming.
The other side of this is the Defender-integrated tooling that stops working when Defender goes passive. If your organisation uses Defender for Endpoint Plan 2 for its Conditional Access device-health integration, switching to GravityZone breaks that signal. We check for Defender dependencies before removal, not after. If your Intune Conditional Access policies depend on Defender health status, that conversation needs to happen at scoping, not at go-live.
How We Deploy GravityZone
Free GravityZone health check or pre-sales scoping: endpoint count, OS mix, current AV, compliance drivers (POPIA, GDPR, cyber-insurance), and incident history. We size the licence tier honestly. You will not get upsold to XDR if EDR is what you need.
Test group of 10–20 endpoints across your actual OS mix. We build BEST policies from a known-good baseline and tune Advanced Threat Control before any wide rollout. We want to surface false positives on the pilot, not after.
Group-by-group deployment with old-AV removal scripts where needed. We have written removal flows for Sophos, ESET, Kaspersky, Trend Micro, Norton, McAfee, Avast and AVG over the years. Patch Management and FDE switch on once endpoints are stable.
Weekly Risk Management dashboard review, monthly patch reporting, EDR incident triage as alerts arrive. Quarterly policy refresh as Bitdefender ships new detection content and the picture changes.
GravityZone vs Defender for Business vs DIY
The honest comparison, for when you're deciding whether to move.
| Capability | GravityZone EDR OSH managed |
Defender for Business M365 Business Premium |
GravityZone Self-managed |
|---|---|---|---|
| Windows endpoint protection | |||
| macOS EDR coverage | Limited | ||
| Linux server EDR | |||
| Third-party app patching (~150 apps) | |||
| Central FDE key management | Via Intune | ||
| Policy tuned to your environment | Defaults only | ||
| ZAR billing · SA-based support |
Defender for Business ships with M365 Business Premium. GravityZone is licensed separately through OSH, we quote against your existing AV renewal.
Get a Free GravityZone Health Check
If you already run Bitdefender, we will audit your policies, patch posture, EDR coverage and Risk Management score, and send you a written report. If you don't, we will scope a pilot against your current AV. No obligation. Real engineer. Real findings.
GravityZone Questions We Get Every Week
Get a Free GravityZone Health Check
If you already run Bitdefender, we will audit your policies, patch posture, EDR coverage and Risk Management score, and send you a written report. If you don't, we will scope a pilot against your current AV. No obligation. Real engineer. Real findings.
