Endpoint detection and response (EDR)
Also known as: EDR, endpoint detection, next-gen antivirus, NGAV, XDR
Endpoint detection and response (EDR) is security software on your computers and servers that watches for suspicious behaviour, not just known viruses.
It can automatically isolate a compromised device, record what happened for investigation, and help responders stop an attack in progress, catching threats that traditional antivirus misses.
Endpoint detection and response (EDR), explained at three levels
At home
Traditional antivirus is like a bouncer with a list of banned faces: if you're on the list, you're out. EDR is like a security guard who watches behaviour. A stranger with a clean record who starts trying every door handle still gets stopped. On your computer, EDR notices when a program suddenly starts encrypting hundreds of files or disabling backups, and halts it even if it has never been seen before.
At work
Endpoint detection and response (EDR) is security software on each computer and server that records activity, detects suspicious behaviour, and lets responders contain threats remotely. Unlike basic antivirus, it can isolate an infected machine from the network with one click and show exactly what happened. For a business, it is often the control that catches ransomware early, and cyber insurers now commonly require it.
At home
EDR has two halves. A small agent on the computer records events: which programs start, what they launch, which files they change, and where they connect. That telemetry streams to a cloud console, where detection rules and machine learning look for patterns that match attacks. Products such as Microsoft Defender for Endpoint, SentinelOne, and CrowdStrike Falcon all follow this design, and some can roll back files that a ransomware process changed.
At work
In a business, the EDR console gives responders three powers: detection, investigation, and response. Detection flags behaviour such as PowerShell downloading code or a process dumping passwords from memory. Investigation shows the full process tree, from the email attachment to every action that followed. Response lets an analyst isolate the device, kill a process, or delete a file remotely. Someone must watch those alerts around the clock, which is where MDR comes in.
At home
EDR's real strength is correlation. A single event, such as a script running or a scheduled task being created, is usually harmless. EDR links events into a chain and maps them to attacker techniques in the MITRE ATT&CK framework, so a sequence like credential dumping, then remote login, then disabling backups stands out. While false alarms happen, in my view behavioural detection is the right model, because attackers change files far faster than signatures can follow.
At work
Mature deployments extend EDR into XDR, correlating endpoint, identity, email, and cloud signals in one console. Automated playbooks isolate hosts and revoke sessions. Known failure modes include coverage gaps on unmanaged devices, alerts nobody triages, and attackers loading signed but vulnerable drivers to kill the EDR agent, a technique called BYOVD. The July 2024 CrowdStrike outage also showed the risk of kernel-level agents, so staged update rings matter.
Real-world examples
At home
Thomas's laptop began encrypting files after he opened a malicious attachment. His EDR detected the ransomware behaviour within seconds, killed the process, isolated the laptop from the network, and rolled back the encrypted files, containing what could have been a company-wide disaster.
At work
Carlos's firm switched from free antivirus to managed EDR. When an attacker used a legitimate remote-admin tool to move between machines (invisible to old antivirus) the EDR flagged the unusual behaviour, and the MSP's responders isolated the affected systems the same night.
How it compares
| feature | Traditional antivirus | EDR |
|---|---|---|
| Detection method | Known signatures | Behavior + signatures |
| Catches new/novel threats | Poorly | Yes |
| Investigation data | Minimal | Detailed activity recording |
| Response actions | Quarantine file | Isolate device, roll back, hunt |
| Needs monitoring | Set and forget | Alerts need a responder (or MDR) |
For analysts
EDR is now a baseline expectation: many cyber insurers require it. For a small business, the practical choice is usually managed EDR or MDR, so trained responders act on alerts around the clock instead of alerts piling up unwatched.
History & origin
Traditional antivirus relied on signatures (recognizing known malware by its fingerprint) which failed against new and file-less attacks. The term EDR was coined in 2013 to describe tools that instead watch behaviour and record endpoint activity for investigation. As attacks grew stealthier, EDR became essential, and cloud-managed versions brought it within reach of small businesses through MSPs.