Overview
Direct Answer
Endpoint Detection and Response (EDR) is a cybersecurity platform that continuously monitors endpoint devices—such as desktops, laptops, and servers—to identify, investigate, and contain advanced threats in real time. It combines behavioural analytics with forensic capabilities to detect malicious activity that traditional antivirus solutions may miss.
How It Works
EDR agents installed on endpoints collect telemetry data including process execution, network connections, file modifications, and registry changes. This data is analysed against threat intelligence and behavioural baselines to identify anomalies. Upon threat detection, EDR platforms enable security teams to isolate affected devices, terminate malicious processes, and perform deep forensic investigation to understand attack scope and origin.
Why It Matters
Organisations require EDR because sophisticated attackers bypass signature-based defences; EDR's behavioural detection reduces detection time from hours to minutes, minimising breach impact. Regulatory frameworks increasingly mandate threat detection capabilities, and EDR provides the forensic evidence required for incident response and compliance audits.
Common Applications
Financial institutions deploy EDR to detect insider threats and data exfiltration. Healthcare organisations use it to protect patient data from ransomware. Manufacturing firms leverage EDR to identify industrial espionage and supply chain compromise attempts.
Key Considerations
EDR generates high volumes of telemetry requiring significant infrastructure investment and skilled analysts to investigate alerts; false positive rates vary significantly between platforms. Endpoint visibility is limited to managed devices, leaving unmonitored infrastructure and shadow IT exposure unaddressed.
More in Cybersecurity
Encryption
Data ProtectionThe process of converting plaintext data into ciphertext using an algorithm, making it unreadable without the decryption key.
Compliance Framework
Security GovernanceA structured set of guidelines and best practices for meeting regulatory requirements and industry standards.
Man-in-the-Middle Attack
Offensive SecurityAn attack where the attacker secretly relays and potentially alters communication between two parties.
Cyber Insurance
Security GovernanceInsurance coverage protecting organisations against financial losses from cyberattacks, data breaches, and related incidents.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
Attack Surface
Offensive SecurityThe total number of points where an unauthorised user can try to enter or extract data from a system.
Threat Intelligence
Offensive SecurityEvidence-based knowledge about existing or emerging threats to an organisation's digital assets and infrastructure.
Cloud-Native Application Protection
Offensive SecurityAn integrated security platform that protects cloud-native applications across the full lifecycle, combining workload protection, configuration management, and runtime security.