Endpoint detection and response (EDR) is security software that continuously records activity on computers and servers, detects suspicious behaviour and lets defenders investigate and stop attacks.
How EDR works
An EDR agent on each endpoint collects telemetry – processes, command lines, file and registry changes, network connections, logins – and sends it to a central platform. There, behavioural rules, machine learning and threat intelligence look for signs of attacks rather than only known malware signatures. Analysts can then:
- see the full attack chain on a timeline;
- isolate an infected host from the network with one click;
- kill processes, delete files and collect forensic data remotely;
- search all endpoints for an indicator of compromise.
The term was coined by Gartner analyst Anton Chuvakin in 2013. XDR extends the idea to email, identity, cloud and network data, while MDR is a managed service in which an external team monitors the EDR around the clock.
Why EDR matters for security
Modern attacks often use legitimate tools and fileless techniques that classic antivirus misses. EDR is now a standard requirement of cyber insurers and a core tool of a SOC. Because of this, attackers try to blind it: ransomware gangs use “EDR killers” and vulnerable signed drivers to switch agents off. Its deep system access also carries risk – a faulty CrowdStrike update in July 2024 crashed about 8.5 million Windows computers.
Best practices
- Deploy EDR on all endpoints and servers – gaps are where attackers go.
- Enable tamper protection and alert when agents go offline.
- Make sure someone watches alerts 24/7, internally or through MDR.
