What Is Endpoint Detection and Response (EDR)?
On this page
Endpoint Detection and Response (EDR) is security software that watches endpoints for malicious behavior and gives responders the tools to act fast. Where antivirus asks “is this file known malware?”, EDR asks “is this endpoint behaving like it is compromised?” — a shift that catches the fileless attacks, living-off-the-land techniques, and active intrusions that signatures miss.
What does EDR do?#
Three capabilities define it:
- Record — continuous telemetry of process, file, registry, and network activity on the host.
- Detect — flag suspicious behavior mapped to ATT&CK techniques, not just known files.
- Respond — isolate a host from the network, kill a process, or collect forensics remotely.
That response capability is crucial: when an endpoint shows signs of compromise, an analyst can contain it in seconds without physically touching it.
EDR vs antivirus#
| Antivirus | EDR | |
|---|---|---|
| Primary method | Signature matching | Behavioral detection + telemetry |
| Catches novel/fileless | Poorly | Well |
| Investigation data | Minimal | Rich activity history |
| Response | Quarantine file | Isolate host, kill process, forensics |
Modern endpoint protection blends both — signatures to cheaply stop known threats, behavior to catch the rest — and feeds telemetry into a SIEM and SOC.
EDR is behavioral defense at the endpoint. More at the Defense & Hardening hub.
Frequently asked questions#
What is EDR?
Endpoint Detection and Response (EDR) is security software on endpoints — laptops, servers — that continuously records activity, detects malicious behavior, and lets responders investigate and act (isolating a host, killing a process, collecting forensics). It goes far beyond blocking known malware to catching the behaviors of an active intrusion.
How is EDR different from antivirus?
Traditional antivirus mainly matches files against known-malware signatures, so it misses novel or fileless attacks. EDR focuses on behavior — suspicious process activity, unusual network connections, credential access — and records detailed telemetry for investigation and response. Antivirus prevents known threats; EDR detects and responds to active ones.