Legacy signature-based antivirus (Symantec, McAfee, Trend Micro, ESET) is end-of-life for ransomware defence. Modern EDR — CrowdStrike Falcon, SentinelOne Singularity, Sophos Intercept X, or Microsoft Defender XDR — is the upgrade path. This is the realistic 6-8 week UK rollout playbook.
Week 1 — EDR selection + commercial
Run vendor selection — see our 7-question framework or head-to-head comparison.
Commercial negotiation — net UK pricing typically 25-40% off vendor list. Servnet handles.
Sign master services agreement + EDR licensing.
Weeks 2-3 — Pilot deployment
Deploy to 50-100 pilot endpoints covering: typical user laptops, power-user workstations, terminal servers, file servers, domain controllers, dev / test workloads.
Configure exclusions + tuning — every environment has false-positive sources (custom software, dev tools, vendor management agents).
Validate against legacy AV — both should run side-by-side during pilot to confirm no protection gap.
Weeks 4-6 — Mass deployment
Phased rollout via SCCM, Microsoft Intune, Jamf Pro (Mac), or ansible (Linux).
Typical pace: 200-500 endpoints per day for a competent IT team.
Per-OS phases: Windows first (largest fleet, lowest risk), then macOS, then Linux servers last.
Weeks 7-8 — Legacy AV decommission
Once new EDR confirmed deployed + reporting healthy: uninstall legacy AV via existing management console.
CRITICAL: never uninstall legacy AV before new EDR is fully deployed + tuned + reporting. Sequence matters.
Keep legacy AV management console accessible for 90 days for audit + historic incident review.
Common gotchas
Conflicting kernel-level drivers — never run two EDRs on the same endpoint. They conflict.
McAfee / Trend Micro embedded in network appliances (firewall AV, email gateway AV) — separate decision from endpoint AV. EDR doesn't replace network AV.
Exclusion list — legacy AV exclusions don't translate directly. Rebuild from current vendor's recommendations + your specific custom software list.
Server protection — some environments use different AV on servers vs endpoints. Check before assuming single-platform replacement.
What Servnet does
Servnet runs AV → EDR migrations as a defined practice across CrowdStrike, SentinelOne, Sophos, and Microsoft Defender. Typical UK engagement: 6-8 weeks end-to-end for 500-2,000 endpoints.