Overview
Direct Answer
Endpoint Detection and Response (EDR) is a cybersecurity platform that continuously monitors endpoint devices—such as desktops, laptops, and servers—to identify, investigate, and contain advanced threats in real time. It combines behavioural analytics with forensic capabilities to detect malicious activity that traditional antivirus solutions may miss.
How It Works
EDR agents installed on endpoints collect telemetry data including process execution, network connections, file modifications, and registry changes. This data is analysed against threat intelligence and behavioural baselines to identify anomalies. Upon threat detection, EDR platforms enable security teams to isolate affected devices, terminate malicious processes, and perform deep forensic investigation to understand attack scope and origin.
Why It Matters
Organisations require EDR because sophisticated attackers bypass signature-based defences; EDR's behavioural detection reduces detection time from hours to minutes, minimising breach impact. Regulatory frameworks increasingly mandate threat detection capabilities, and EDR provides the forensic evidence required for incident response and compliance audits.
Common Applications
Financial institutions deploy EDR to detect insider threats and data exfiltration. Healthcare organisations use it to protect patient data from ransomware. Manufacturing firms leverage EDR to identify industrial espionage and supply chain compromise attempts.
Key Considerations
EDR generates high volumes of telemetry requiring significant infrastructure investment and skilled analysts to investigate alerts; false positive rates vary significantly between platforms. Endpoint visibility is limited to managed devices, leaving unmonitored infrastructure and shadow IT exposure unaddressed.
More in Cybersecurity
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
Privileged Access Management
Identity & AccessSecurity solutions that control and monitor access for users with elevated permissions to critical systems.
End-to-End Encryption
Data ProtectionA communication system where only the communicating users can read the messages, with encryption at both endpoints.
Information Security
Security GovernanceThe practice of protecting information by mitigating information risks including unauthorised access, use, and disruption.
Purple Team
Offensive SecurityA collaborative security approach combining red team attack knowledge with blue team defensive capabilities.
Spear Phishing
Offensive SecurityA targeted phishing attack directed at specific individuals or organisations using personalised deceptive content.
Zero-Day Vulnerability
Offensive SecurityA software security flaw unknown to the vendor that can be exploited before a patch is available.
Attack Vector
Offensive SecurityThe specific path, method, or scenario used by an attacker to gain unauthorised access to a system.