What Is EDR (Endpoint Detection and Response)?

EDR, or endpoint detection and response, is security software on each computer and server that continuously records activity, detects behavior that looks like an attack, and can isolate the device to stop the attack from spreading. It has replaced traditional antivirus as the baseline for business endpoints, and most cyber insurers now require it.

How EDR differs from antivirus

Antivirus asks, "Is this file on the list of known bad files?" EDR asks, "Is this device behaving like it is under attack?" That means EDR can catch never-before-seen malware, attacks that use built-in Windows tools, and the moment a ransomware process starts encrypting files.

What EDR does

• Records processes, network connections, file changes, registry changes and credential use.
• Detects suspicious chains of behavior and known attack techniques.
• Responds by killing processes, quarantining files and isolating the machine from the network, automatically or on an analyst's command.
• Investigates with a timeline that shows how the attacker got in and what they touched.

What EDR does not do on its own

It generates alerts. Somebody still has to review and act on them, around the clock. That is the role of managed detection and response; see MDR vs EDR vs antivirus and what is MDR.

Why insurers require it

EDR is one of the controls that most reduces ransomware losses, so it appears on nearly every cyber insurance questionnaire alongside MFA and tested backups. See the cyber insurance requirements checklist.

Deployment notes

EDR should be on every workstation and server, including Macs, with tamper protection on so an attacker cannot disable it. It should be managed centrally so coverage gaps are visible.

Advanced EDR endpoint security is included in every Mentis Group Fully Managed IT plan, and it feeds the MDR and SOC services in our Enhanced Cybersecurity program.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.