EDR

What it means

EDR stands for endpoint detection and response. It is software on laptops, desktops and servers that records what happens on each machine, such as programs started, files changed and network connections made. It looks for patterns that suggest an attack and lets a person isolate the machine or stop the process.

The idea that makes it click: traditional antivirus asks whether a file is known to be bad. EDR asks what is this machine doing, and does it look like an intruder. That helps against attacks that use legitimate tools and leave no obvious malicious file.

Why it matters

Many incidents begin on an ordinary laptop with a stolen password or a bad attachment. Without EDR you may not know until data is gone. With it, you can see which machine, which process and which account, and contain the problem quickly. It also gives you the record for the post-incident review.

Insurers, auditors and customers now often ask whether it is deployed. Using it is also a means of slowing lateral movement, because an intruder who lands on one machine is spotted before reaching the rest. It is a tool for your devices, though, not for the software you ship.

How it shows up

You meet it as an agent installed on every managed device and a console where alerts are reviewed. Capabilities include recording activity, detecting suspicious behaviour, remote isolation of a device and searching across all devices for a sign of compromise. Some vendors add a managed service, see MDR.

Mistakes: devices missing the agent, servers excluded for performance reasons, alerts nobody triages (see alert fatigue), broad exclusions added to silence noise, and no one with the authority to isolate a laptop at night. EDR sees the machine, not your application's logic, so flaws like broken access control need separate testing. Compare SIEM.