Your customers have antivirus.Their servers still answer.
You already sell the protection for what runs on a device. SSHepherd® covers what endpoint protection was never built to remove: servers that answer the network. Same customers, one more line on the quote, nothing ripped out.
Antivirus watches the device.SSHepherd removes the door.
They answer different questions, so neither makes the other redundant.
"Is something malicious running on this machine?"
- Scans files, email attachments and downloads.
- Detects and blocks malware and ransomware behaviour.
- Protects laptops and servers from what users open.
- Can firewall ports and flag attacks on exposed services.
"Can anyone reach this server's services at all?"
- Closes the server's listening ports: SSH, RDP, databases, applications.
- Admins connect outbound, through a C3 server the customer hosts.
- Records SSH and RDP sessions, with a live kill switch.
- Keeps protected servers invisible to an infected laptop on the same network.
Who stops what.Neither stops everything.
Each layer is strongest where the other isn't. Here are the routes attackers use, and which layer is built for each.
| Attack path | Endpoint protection | SSHepherd® |
|---|---|---|
| A malicious attachment or downloadEdge: Endpoint | Built for thisDetects and blocks the file, or what it does, on the device. | Not its jobDoesn't inspect files, email or downloads. |
| An infected USB drive or copied fileEdge: Endpoint | Built for thisScans files as they arrive on the device. | Not its jobDoesn't inspect files. |
| Brute force or an exploit against exposed RDP or SSHEdge: SSHepherd | Detects and blocksCan detect attacks and firewall the port. The service itself keeps running. | Nothing to attackThe service can be switched off, so there is no listener to guess passwords against. |
| A new flaw in a server service, before the patchEdge: SSHepherd | May catch the behaviourMay detect the exploit as it runs, if it recognises it. | UnreachableA service that doesn't listen can't be exploited over the network. |
| An infected laptop hunting for serversEdge: SSHepherd | On the infected deviceCan detect the malware on that laptop, if it recognises it. | Nothing to findProtected servers show no open ports, even from inside the network. |
| Ransomware running on a deviceEdge: Endpoint | Built for thisDetects and stops it on the device. | Not its jobDoesn't stop malware on a device. It keeps it from reaching protected servers. |
| A rogue or hijacked admin sessionEdge: SSHepherd | May flag activityEndpoint detection may flag suspicious commands on the server. | Watched and stoppableSSH and RDP sessions are recorded and can be terminated live. |
- Built for it
- Helps, with limits
- Not its job
Antivirus stops what gets in.SSHepherd leaves nothing to answer.
One infected laptop is a bad day. One infected laptop that can reach every server is the headline. Endpoint protection handles the first. SSHepherd keeps it from becoming the second.
The same customer.A second line on the quote.
The IT or security lead who renews your endpoint licences also owns the servers. No new relationship to build.
The customer keeps the endpoint protection you sold them. SSHepherd adds a layer; it doesn't ask them to switch anything.
There's no identical product to quote against SSHepherd, so the conversation is about impact, not discount.
Scan a server before and after. The open ports disappear, in about ten minutes per server.
Three questions.Then the demo.
- AskWhich servers accept RDP or SSH, and from where?
Most customers know their endpoint count to the seat. Few can say which servers still answer the network.
- AskWhat happens if one laptop gets infected?
Endpoint protection should catch it. If it doesn't, can that laptop reach every server? With SSHepherd, it finds nothing to reach.
- OfferKeep the antivirus. Add SSHepherd to the servers.
No rip-and-replace and no network redesign. A demo on one of their own servers makes the case in minutes.
What endpoint resellers ask.
Is SSHepherd an antivirus?
No. It doesn't scan files or detect malware. It closes the listening ports on servers and controls who reaches them, so it sits alongside endpoint protection, not in place of it.
Will it clash with the endpoint agent my customer already runs?
We check the SSHepherd agent alongside the customer's existing endpoint protection on their own servers during the proof of concept, before anything is rolled out.
Does SSHepherd protect laptops?
Its agent runs on Windows 10 and 11 Pro or Enterprise as well as on servers, so it can close a workstation's listening ports too. It still doesn't stop malware on the device; that stays the job of endpoint protection.
If a laptop is infected, what does SSHepherd change?
The infected laptop scans the network for servers to move to. Servers protected by SSHepherd show no open ports, so one infected laptop stays one infected laptop instead of reaching every server.
How is it sold?
Per protected server, billed annually or quarterly, through authorised partners. Margins are shared once we have talked about your customers and segments.
Can my team deploy it?
Yes. We train your engineers to install and support it: about ten minutes per server, with no network redesign.
More on SSHepherd: how it works · how it compares with ZTNA products · the partner programme.
Sell the layerthey’re missing.
Tell us which endpoint products you sell and the customers you serve. We will set up a partner call and reply within one business day.