Why you run SAS as a realtime protection and keep MBAM as on-demand? Is it because you don't have an MBAM license or you think SAS is better than MBAM as a realtime security solution.