What Is EDR? Endpoint Detection and Response Explained

Most people meet EDR on the day it takes a laptop off the network. The machine is still on and the screen still works, and the only thing that has changed is that nothing can reach it except one security console. Something decided that what was running on that laptop looked like an intrusion and cut it off mid sentence. That action, rather than the alert that preceded it, is the argument for the whole category. What follows is what the agent was watching, how it decided, where it is blind, and whether a company your size should be buying the software or buying the people who run it.

What Is EDR?

Endpoint detection and response is a security product that continuously records activity on the devices people work on and uses that record to find and stop attacks. An endpoint is anything running an operating system that holds or reaches data: laptops, desktops, servers, virtual machines, and in most products phones and tablets.

The name is two jobs bolted together and both halves carry weight. Detection watches process launches, command lines, file writes, registry changes, script execution and outbound connections, then decides which combinations look like an attacker rather than an accountant. Response acts on that decision: killing the process, quarantining the file, blocking the hash fleet wide, or isolating the host.

Microsoft's documentation for Defender for Endpoint describes the capability as near real time and actionable attack detections, with alerts sharing attack techniques or an attacker grouped into one incident. That grouping is most of what separates an EDR console from an antivirus pop-up. One tells you a file was blocked. The other tells you a story with a beginning.

A Gartner analyst named the category in July 2013, settling on endpoint threat detection and response as the label for tools that detected and investigated suspicious activity on hosts rather than only blocking known bad files. The middle word dropped out and the acronym was EDR by 2015. Almost everything sold as endpoint protection now does both jobs, which is why the antivirus comparison below is less either-or than it sounds.

How Does EDR Work?

The agent runs below the applications and beside the operating system's own logging, so it sees what no log file records. Every process that starts, what started it, the full command line it was handed, which files it touched, which registry keys it changed, which addresses it reached. That stream goes to a console, usually a cloud tenant the vendor operates, where it is kept for a retention window and analyzed.

Detection works on behavior rather than identity. Antivirus asks whether a file matches something already known to be bad. EDR asks whether a sequence looks like an attack: a spreadsheet spawning a script interpreter, that interpreter reaching an address nobody has visited before, a process requesting the memory of the operating system component that holds credentials. None of those is a file anyone can add to a blocklist, which is why the record has to be behavioral.

Then it responds, and this is where automation earns its keep. NIST's incident response guidance suggests configuring security technologies to carry out some containment actions without waiting for a human, naming quarantining malware and moving a compromised endpoint to an isolated remediation network as the examples worth automating, in SP 800-61r3. Host isolation is the version almost every EDR product ships: one rule or one click, and the machine talks to nothing but the console that isolated it.

Notice that the attacker in step five does not stop because an alert appeared. Nothing about a detection interrupts an intrusion on its own. The gap between step four and step seven is whatever it takes for a human to look, and two federal advisories later in this article are about what happens when nobody does.

Key Capabilities of EDR

Strip the marketing off any product here and the same seven capabilities are underneath. Products differ mostly in how well each one is done.

Retention is the specification buyers skim past and regret. A thirty day window means an intrusion that began five weeks ago cannot be reconstructed, and intrusions frequently began five weeks ago.

EDR vs Antivirus

The framing that survives contact with reality is that antivirus is a filter while EDR is a recorder that can also act.

The practical difference shows up against attacks that involve no malicious file. An attacker who signs in with a stolen password and uses the tools already on the machine, the technique known as living off the land, presents antivirus with nothing to inspect. PowerShell is not malware. PowerShell reading credential memory at two in the morning is the detection, and only a product recording behavior can make it.

The signature model also ages badly. IBM's Cost of a Data Breach Report 2026 records a 56 percent rise in AI-driven attacks, led by deepfake impersonation and AI-enabled malware. Malware generated freshly per target has no signature to publish, and a defense built on a list of known malware arrives after the first victim.

Do you need antivirus if you have EDR?

In practice you already have both. Nearly every EDR product includes a prevention engine, and Windows ships with Defender Antivirus enabled whether or not you buy anything. The real decision is whether to keep two of them.

EDR vs XDR vs MDR

Three acronyms get compared as though they were three competing products. Two are products and one is a service, and getting that straight settles most of the confusion.

EDR covers endpoints. XDR is the same idea widened to more sources, pulling identity, email, cloud and network signals into one console so an alert about a laptop and an alert about a sign-in from another country become one incident. MDR is not software at all. It is a contract for people who watch a console, triage what appears on it, and act inside agreed limits, normally on top of an EDR or XDR product you own or they provide.

The distinction that decides a budget is product against service. No license creates a person. That person is either on your payroll inside a security operations center or on somebody else's under an MDR contract, and there is no third option in which the console reads itself. A SIEM sits alongside all of this rather than competing with it: EDR is the deepest record of one layer, a SIEM a shallower record of every layer.

What Is an Example of an EDR?

Named as examples of a category rather than as recommendations, the products people mean by EDR include CrowdStrike Falcon Insight XDR, Microsoft Defender for Endpoint, SentinelOne Singularity, Palo Alto Cortex XDR, Sophos Intercept X and Cisco Secure Endpoint. On the open source side, Wazuh and Velociraptor cover parts of the same ground for organizations with the staff to run them.

There is no authoritative ranking of that list. What separates products for a given buyer is duller than the brand argument: which operating systems the agent supports, how long telemetry is retained, whether tamper protection is on by default, whether response actions are included or sold as another module, and whether the vendor will sell you the people to run it.

Is CrowdStrike an EDR?

Not quite. CrowdStrike is a company, and its Falcon platform is a set of modules of which one, Falcon Insight XDR, carries the endpoint detection and response capability. People use the company name for the product the way they use brand names for tissues. On a purchase order it matters, because the platform is sold in bundles and the two cheapest, Falcon Go and Falcon Pro, do not include endpoint detection and response at all. Buying Falcon does not automatically mean buying the EDR piece or the service that watches it.

Is Microsoft Defender an EDR?

Defender is two products sharing one name. Microsoft Defender Antivirus ships with Windows and is antivirus, not EDR. Microsoft Defender for Endpoint is separately licensed and adds the recording, investigation and response capability described in the documentation cited above. Organizations paying for Microsoft 365 E5 or Defender for Business often already own an EDR they have never deployed.

What EDR Does Not Cover

An EDR agent sees what happens on a machine where the agent is installed, and a modern company keeps most of its data somewhere else. The blind spots are not exotic, and they are where this year's breaches actually happened.

The unmanaged ring is the one that bites. The 2026 Verizon Data Breach Investigations Report found 31 percent of breaches beginning with vulnerability exploitation, the first time in nineteen years it has passed stolen credentials, and breaches involving a third party now account for 48 percent of the total. An internet-facing server nobody remembered to enroll, or a supplier's tenant holding your customer list, is not a problem an endpoint product can reach. Neither is the firewall in front of it, which is why zero trust treats identity rather than location as the control point.

Can Attackers Disable EDR?

Yes, and it is a catalogued technique rather than a theoretical worry. MITRE ATT&CK carries Disable or Modify Tools as technique T1685, and endpoint detection and response tools are the first example it names among the security software adversaries disable, degrade or tamper with. The methods it lists are ordinary: killing processes, deleting configuration files and registry keys, blocking the agent from updating, and abusing legitimate drivers to render the tool non-functional.

Evasion is the quieter half of the problem. In a 2026 red team engagement, CISA's own operators used a modified Active Directory collection tool customized specifically to avoid static EDR signatures and mapped the domain without triggering the detections a stock version would have set off. Attackers with a budget do the same.

MITRE's mitigation is free and almost nobody runs it. Under audit, it recommends periodically confirming that every host you expect is checking in to the central console, and reviewing the EDR for exclusion paths nobody added deliberately. An exclusion covering an entire drive, added eighteen months ago to make a backup job stop alerting, is a hole with a business justification attached.

Do You Need EDR?

The answer turns less on company size than on who is available at three in the morning, and two CISA advisories make that case better than any vendor page.

In the first, CISA responded at a federal civilian agency after its EDR raised alerts on a file dropped on a SQL server. The intrusion had begun roughly three weeks earlier through a known vulnerability in a public-facing GeoServer, and the attackers had reached three more servers in the meantime. Among the three lessons CISA recorded was that EDR alerts were not continuously reviewed and some public-facing systems lacked endpoint protection. The product worked. The coverage and the reading of it did not.

The second is starker. CISA's red team ran comparable operations against two organizations. One had a baseline and tuned alerting, and its analysts spotted the activity and acted. The other received medium and low severity EDR alerts on the same behavior and responded to none of them, because thousands of false positives from ordinary business activity, many at higher severity, buried them. CISA's summary belongs on the purchase order: detection tools are only as effective as the people, processes and procedures supporting them.

How to Implement EDR

Deployments fail in the same five places, and none of them is the software.