<h2 style="margin-top: 0px; margin-bottom: 10px;">What is included in WithSecure Elevate Package (2/1)?</h2>
<p style="margin-top: 0px; margin-bottom: 0px;"><strong>Elements EDR add-on</strong> – Requires an active WithSecure Elements EDR subscription.<br /> <strong>Two Validation Tokens</strong> – Analysts confirm whether a detection is a genuine threat.<br /> <strong>One Investigation Token</strong> – Deeper analysis with attack timeline and containment advice.<br /> <strong>24/7 analyst access</strong> – Validation starts within two hours of the request.<br /> <strong>Console-based workflow</strong> – Elevation and results stay in Elements Security Center.<br /> <strong>Important</strong> – No continuous monitoring; you elevate detections yourself.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">What are the main benefits of WithSecure Elevate Package (2/1)?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">WithSecure Elevate is an on-demand expert service that the administrator of Elements EDR triggers from the Elements Security Center when a Broad Context Detection is ambiguous. WithSecure is the former F-Secure Business, and the module this service attaches to was previously sold as Elements Endpoint Detection and Response before being consolidated into Elements Endpoint Security.<br /><br /> <strong>Expertise on demand</strong> – Buy analyst time only when a detection is unclear.<br /> <strong>Faster triage</strong> – Analysts sort detections into genuine, suspicious or false positive.<br /> <strong>Documented findings</strong> – Written summary you can show management or an auditor.<br /> <strong>Historical context</strong> – Seven days of estate telemetry inform each threat validation.<br /> <strong>Nothing to deploy</strong> – No separate installer, agent or portal is needed.<br /> <strong>Clear escalation path</strong> – Analysts say when full Incident Response becomes necessary.</p>
<p style="margin-top: 15px; margin-bottom: 15px;"><a href="#" target="_blank" data-ke-doc="windows-defender-not-enough"><strong>Best antivirus? Why Windows Defender alone is not enough</strong><br />Explains where built-in Windows protection stops and why detection, investigation and response are separate disciplines.</a></p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Which company size is WithSecure Elevate Package (2/1) suitable for?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">Elevate fits organisations that already run Elements EDR themselves but do not employ a dedicated security analyst. A company with its own security operations centre rarely needs bought-in validation tokens, while a company without any EDR cannot use the service at all, because there are no detections to elevate.</p>
<table style="width: 100%; border-collapse: collapse; background-color: #efefef; margin-top: 15px; margin-bottom: 15px; font-size: 14px; line-height: 1.35;">
<tbody>
<tr><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: left; font-weight: bold; background-color: #dedede;">Requirement</th><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: center; font-weight: bold; background-color: #dedede;">Small business</th><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: center; font-weight: bold; background-color: #dedede;">Medium-sized company</th><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: center; font-weight: bold; background-color: #dedede;">Large company</th></tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Reporting obligation Switzerland</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">By sector</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">By sector</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">NIS 2 in the European Union</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #d9534f; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✕</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">By sector</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Security questionnaire from large customers</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">Occasional</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Own analyst for EDR detections</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #d9534f; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✕</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">Partial</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">This product fits</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">With partner</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">Limited</td>
</tr>
</tbody>
</table>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Does WithSecure Elevate Package (2/1) meet the requirements of Swiss cybersecurity legislation?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">The reporting obligation under the revised Information Security Act applies to operators of critical infrastructure, such as energy and drinking water supply, transport undertakings and cantonal and communal administrations, and not to every Swiss company. Those organisations must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering it, and may complete the report within a further 14 days. The report has to describe the type of attack, its effects and the countermeasures already taken, and this is exactly where a Threat Validation helps: it establishes quickly whether an ambiguous detection is a genuine attack at all, which in practice is the decision that starts the clock. A Threat Investigation goes further and produces a written reconstruction of the attack timeline that can be attached to the report or handed to the authorities. What Elevate does not do is detect the attack in the first place, which is the job of Elements EDR, submit the report on your behalf, or watch your console overnight, so an unnoticed detection is still an unreported detection. This text is general product information and not legal advice; whether your organisation falls under the reporting obligation should be clarified with qualified legal counsel.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Does WithSecure Elevate Package (2/1) meet the requirements of European cybersecurity legislation?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">No product creates compliance with the NIS 2 Directive, because the directive addresses organisational measures, governance and accountability rather than any single piece of software. NIS 2 requires essential and important entities to implement measures in categories including incident handling, risk analysis and information system security policies, business continuity and crisis management, supply chain security, and the use of cryptography. Elevate contributes to exactly one of those categories, incident handling, by supplying qualified human analysis of an endpoint detection and a documented investigation result that can serve as evidence of a structured process. It contributes nothing to business continuity, backup, cryptography or supply chain assessment, and it does not produce or transmit any incident notification. It also does not provide continuous monitoring, so an organisation that relies on Elevate alone still has no assurance that a detection outside working hours will be seen in time.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Does WithSecure Elevate Package (2/1) help with security questionnaires from large customers?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">Partly, and it is worth knowing precisely which lines it fills in. It lets you answer yes to questions about documented incident analysis, about access to specialist security expertise outside your own headcount, and about availability of that expertise around the clock, and the analyst reports give you artefacts to show rather than assertions to make. On retention, Elements EDR event data is kept for one year on a rolling basis during the engagement and manually collected data for three months, which answers the common question about how far back an investigation can reach. It does not let you answer yes to continuous 24/7 monitoring of your environment, to having a named security operations centre, to holding an incident response retainer with a guaranteed response time, or to running regular incident response exercises, because those are separate WithSecure services. If a customer questionnaire fails you on those points, the cheaper route is usually to move up within the same family, to the Co-Monitoring Service or Elements MDR for monitoring and to an Incident Response Retainer for guaranteed response, rather than adding a second vendor and a second console to your estate.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">What is the difference between WithSecure Elevate (1/0) and Elevate Package (2/1)?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">The decisive difference is that the (2/1) package contains an Investigation Token and the (1/0) package does not. Without an Investigation Token you can have a detection validated, meaning an analyst tells you whether it is a genuine threat, suspicious activity or a false positive, but you cannot request the deeper phase that reconstructs the attack timeline and proposes containment steps. That matters in a second, less obvious situation as well: if the detection you want to escalate is more than seven days old, it consumes an Investigation Token directly, so a (1/0) package cannot handle older detections at all. The (2/1) package also gives you two validations rather than one, which in practice means a second ambiguous detection later in the subscription does not leave you empty-handed.</p>
<table style="width: 100%; border-collapse: collapse; background-color: #efefef; margin-top: 15px; margin-bottom: 15px; font-size: 14px; line-height: 1.35;">
<tbody>
<tr><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: left; font-weight: bold; background-color: #dedede;">Capability</th><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: center; font-weight: bold; background-color: #dedede;">Elevate (1/0)</th><th style="border: 1px solid #ffffff; padding: 9px 8px; text-align: center; font-weight: bold; background-color: #dedede;">Elevate Package (2/1)</th></tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Threat Validation</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">One</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">Two</td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Threat Investigation</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #d9534f; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✕</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;">One</td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Attack timeline reconstruction</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #d9534f; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✕</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Detections older than seven days</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #d9534f; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✕</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
<tr>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: left; font-weight: bold; vertical-align: middle;">Elements EDR subscription required</td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
<td style="border: 1px solid #ffffff; padding: 8px; text-align: center; vertical-align: middle;"><span style="color: #32a852; font-size: 24px; font-weight: 800; line-height: 1; display: inline-block; transform: translateY(1px);">✓</span></td>
</tr>
</tbody>
</table>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Which limitations should you know before buying?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">The service is delivered in English only, which is the most relevant restriction for buyers in Switzerland, Germany, France and Italy, because the analyst dialogue and the written investigation report will not be in your local language even though the Elements console itself is localised. Elevate is reactive by design: nobody at WithSecure watches your console, so someone in your organisation has to notice the detection and press the button, and a detection discovered on Monday morning was unattended all weekend. The analysts provide guidance and explicit directions, they do not log in and remediate for you, and if the case reaches the Major Incident Threshold, which includes more than five infected devices, a compromised business-critical asset, or a compromised device without EDR coverage, they will recommend a separate Incident Response engagement that is not part of this package. Tokens are consumed per case and unused tokens expire at the end of the subscription period, so a quiet year means unused tokens rather than carried-over credit. Finally, the two-hour figure is a target for starting the validation, not a contractual response guarantee, which matters if you need an SLA-backed commitment for a customer or an auditor.</p>
<p style="margin-top: 15px; margin-bottom: 15px;"><a href="#" target="_blank" data-ke-doc="data-loss-backups-avoid-outages"><strong>Data loss is expensive: How backups help you avoid outages</strong><br />Covers why analysis and guidance alone do not restore operations, and what a working recovery layer needs to look like.</a></p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Frequently asked questions about WithSecure Elevate Package (2/1)</h3>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Does WithSecure Elevate require its own installation?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">No. There is no separate Elevate installer or agent. Once the Elements Agent is deployed and the EDR module is active, the Elevate button appears on Broad Context Detections in the Elements Security Center and the token balance is visible in the subscription view.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">How far back can an analyst look when investigating a detection?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">A Threat Validation draws on telemetry collected from your estate over the previous seven days. The underlying Elements EDR event data is retained for one year on a rolling basis for the duration of the engagement, and manually collected data for three months, which is what allows a Threat Investigation to reconstruct a longer sequence of events.</p>
<h3 style="margin-top: 30px; margin-bottom: 10px;">Is Elevate the same as Managed Detection and Response?</h3>
<p style="margin-top: 0px; margin-bottom: 0px;">No, and confusing the two is the most common mistake with this product. Elevate assumes you run your own EDR and want expert backup on individual difficult cases, while Managed Detection and Response hands the monitoring, detection and response work to WithSecure entirely. If you have nobody looking at the console during evenings and weekends, Elevate is the wrong answer to that problem.</p>
<div class="ke-block mceNonEditable" data-ke-block="blogteaser" data-topics="sec-edr,sec-endpoint,compliance-ch-isg" data-audience="b2b" data-count="3"> </div>