For years cybersecurity has been approached at the network level and at endpoint level. Best practices are good but sometimes user behavior makes the difference between a compromised system and a safe one. Most of the times they don’t understand if something went wrong. What if they knew? The solution that I am going to present brings the tools available in a SOC to the user level, at the endpoint. It combines some of the best practices in security (like backup and DLP) with SOAR solutions and LRA in order to prevent loss of data and ensure rapid automated reaction to cybersecurity incidents.