Overview
Direct Answer
Endpoint Detection and Response (EDR) is a cybersecurity platform that continuously monitors endpoint devices—such as desktops, laptops, and servers—to identify, investigate, and contain advanced threats in real time. It combines behavioural analytics with forensic capabilities to detect malicious activity that traditional antivirus solutions may miss.
How It Works
EDR agents installed on endpoints collect telemetry data including process execution, network connections, file modifications, and registry changes. This data is analysed against threat intelligence and behavioural baselines to identify anomalies. Upon threat detection, EDR platforms enable security teams to isolate affected devices, terminate malicious processes, and perform deep forensic investigation to understand attack scope and origin.
Why It Matters
Organisations require EDR because sophisticated attackers bypass signature-based defences; EDR's behavioural detection reduces detection time from hours to minutes, minimising breach impact. Regulatory frameworks increasingly mandate threat detection capabilities, and EDR provides the forensic evidence required for incident response and compliance audits.
Common Applications
Financial institutions deploy EDR to detect insider threats and data exfiltration. Healthcare organisations use it to protect patient data from ransomware. Manufacturing firms leverage EDR to identify industrial espionage and supply chain compromise attempts.
Key Considerations
EDR generates high volumes of telemetry requiring significant infrastructure investment and skilled analysts to investigate alerts; false positive rates vary significantly between platforms. Endpoint visibility is limited to managed devices, leaving unmonitored infrastructure and shadow IT exposure unaddressed.
More in Cybersecurity
Biometric Authentication
Identity & AccessUsing unique biological characteristics like fingerprints, facial features, or iris patterns to verify identity.
Extended Detection and Response
Offensive SecurityA unified security platform that integrates multiple security tools and data sources for comprehensive threat detection.
Supply Chain Attack
Offensive SecurityA cyberattack targeting the less-secure elements of a supply chain to compromise a primary target.
Cyber Kill Chain
Offensive SecurityA model describing the stages of a cyberattack from reconnaissance through data exfiltration.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
Man-in-the-Middle Attack
Offensive SecurityAn attack where the attacker secretly relays and potentially alters communication between two parties.
Blue Team
Offensive SecurityA group of security professionals who defend against both real attackers and simulated attacks from red teams.
Attack Surface
Offensive SecurityThe total number of points where an unauthorised user can try to enter or extract data from a system.