What is included in WithSecure Elevate (1/0)?

Threat Validation – WithSecure analysts confirm whether a detection is a real attack.
Elevation from the console – Cases are raised directly from Broad Context Detections.
24/7 analyst access – Service runs every day, with validation targeted within two hours.
Written expert summary – You receive findings and concrete guidance on how to respond.
Seven-day telemetry window – Validation draws on estate data from the previous seven days.
Important – Add-on service; a separate WithSecure Elements EDR subscription is required.

What are the main benefits of WithSecure Elevate (1/0)?

WithSecure Elevate (1/0) is an add-on service for WithSecure Elements Endpoint Detection and Response that lets your own team hand a difficult detection to WithSecure's threat analysts instead of moving to a fully managed service. It is operated entirely from the cloud-based Elements Security Center, and was sold as Elevate to F-Secure in the F-Secure Rapid Detection & Response era before the vendor renamed itself to WithSecure.

Fewer wrong calls – An analyst decides instead of guessing on an ambiguous alert.
No retainer needed – Expert help is bought in advance and used on demand.
Out-of-hours cover – Nights and weekends are covered without staffing a shift.
Documented findings – The written verdict supports your incident record and reporting.
False positive filter – Analysts separate genuine attacks from technically false detections.
No extra agent – The existing Elements Agent supplies all data analysts need.

Best antivirus? Why Windows Defender alone is not enough
Explains where preventive endpoint protection stops working and why detection and response is the layer that catches what gets through.

Which company size is WithSecure Elevate (1/0) suitable for?

Elevate is built for organisations that operate Elements EDR themselves and occasionally hit a detection they cannot judge with confidence. That situation is most common in companies staffed with one or two IT generalists rather than a dedicated security team, and least common in organisations that already run a security operations centre.

Does WithSecure Elevate (1/0) meet the requirements of Swiss cybersecurity legislation?

The revised Information Security Act obliges operators of critical infrastructure in Switzerland to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Most SMEs are not affected; the obligation targets sectors such as energy and water supply, transport, healthcare, finance, information and communication, and cantonal and municipal administrations. Elevate supports that deadline in one concrete way: a validated verdict on whether a detection is a genuine attack, with a two-hour target for starting validation, is usually the fact that determines whether a report is due at all. What it does not do is write the report, track the 14-day deadline for completing it, contain the attack, or replace an internal incident process, because the analysts provide guidance and your team acts on it. It also covers nothing outside Elements EDR, so an attack that begins on an unmonitored system produces no detection to elevate in the first place. This description is not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does WithSecure Elevate (1/0) meet the requirements of European cybersecurity legislation?

No software product or expert service makes a company compliant with the NIS 2 Directive. NIS 2 requires essential and important entities to establish risk analysis and security policies for information systems, incident handling, business continuity, supply chain security, and reporting of significant incidents to the relevant national authority. Elevate contributes to the incident handling category: expert classification of a detection into genuine threat, actionable suspicious activity, accepted risky behaviour or false positive, plus a written record of what was found and recommended. It contributes nothing to risk analysis, business continuity, supply chain security, or the governance and training duties the directive places on management. Because it is a reactive service used case by case, it also does not deliver the continuous monitoring that entities under stricter supervision are normally expected to demonstrate.

Does WithSecure Elevate (1/0) help with security questionnaires from large customers?

Partly, and mainly in one section. Security questionnaires from large customers typically ask whether you operate EDR, whether detections are triaged by qualified staff, how quickly an incident can be classified, and whether findings are documented. Elevate lets you answer the triage and expertise items credibly: cases go to WithSecure analysts on a 24/7 basis with a two-hour target for starting validation, and each case closes with a written verdict you can attach as evidence. It answers nothing about continuous monitoring, mean time to respond, log retention beyond the Elements EDR data window, penetration testing, secure development, or supplier risk management, because it performs none of those functions. If a questionnaire fails on continuous monitoring rather than on expertise, moving up within the same WithSecure family to a managed detection and response service is usually cheaper and easier to evidence than adding a second vendor's tooling next to Elements.

What is the difference between WithSecure Elevate (1/0) and WithSecure Elevate Package (2/1)?

The decisive difference is whether the deeper Threat Investigation phase is available to you at all. The notation describes the service scope of the package: the first figure covers Threat Validation cases, the second covers Threat Investigation cases. With (1/0) a detection can be validated and classified, but if the analyst confirms a genuine attack and you want the full event timeline, cross-referenced threat intelligence and a concrete containment plan, that phase is not part of this package. The same applies to any detection older than seven days, which bypasses validation and goes straight to investigation. Neither package includes the separate WithSecure Incident Response service.

Which limitations should you know before buying?

Three limitations matter most. The Elevate service itself is delivered in English only, which is a real constraint for Swiss and European teams whose on-call staff work in German, French or Italian: the Elements Security Center interface is localised, the analyst dialogue is not. Second, Elevate follows the coverage of Elements EDR, which protects workstations and servers, so a compromise on a mobile device or on any system without the Elements Agent generates no detection that could be elevated. Third, WithSecure analysts supply analysis and guidance rather than executing containment in your environment, and if a case reaches the vendor's Major Incident Threshold, such as more than five infected devices or a compromised business-critical asset, the recommendation will be to escalate to the separate Incident Response service, which is not part of this product.

Data loss is expensive: How backups help you avoid outages
Covers the recovery side that expert guidance does not replace, and what an outage actually costs a business.

Frequently asked questions about WithSecure Elevate (1/0)

Where is the data that WithSecure analysts examine stored?

Behavioural event data collected by the Elements Agent is stored on AWS infrastructure in the European Union (Ireland) for one year on a rolling basis during the engagement, and is deleted within two months after the engagement ends. Raising an Elevate case grants the analysts access to the metadata surrounding that specific detection.

Do WithSecure analysts change anything on our devices?

No. Elevate delivers the verdict and the response guidance through the Elements Security Center. Isolating a host, terminating a process or removing files remains an action your own administrator performs from the console.

Can our service provider raise Elevate cases on our behalf?

Yes, if the provider manages your Elements environment. Elements Security Center has a partner-managed mode, and Elevate is triggered from the same Broad Context Detections view, so a provider with console access can elevate a case for you.