EDR for hospitals: why endpoint detection falls short in healthcare, and what to add

What EDR was actually built for

Endpoint detection and response was designed for a corporate IT environment: a managed fleet of laptops, servers, and workstations, all running operating systems the organization controls and can install software on. In that world EDR is excellent. It watches each machine from the inside, catches malicious behavior, and gives responders rich telemetry to investigate. If a hospital were only a collection of office computers, EDR would come close to being enough.

A hospital is not that. It is a clinical operation where the computers are a minority of the connected things on the network, where taking a system offline can endanger a patient, and where the goal is not just to catch an attack but to keep caring for patients through one. EDR was never designed for that environment, and asking it to be the whole answer sets a hospital up to discover its limits during an actual attack.

Shortfall one: the medical devices EDR cannot see

This is the big one. A large hospital runs tens of thousands of connected medical devices, infusion pumps, patient monitors, imaging systems, lab analyzers, and the overwhelming majority cannot host an endpoint agent. They run closed, certified, or unsupported operating systems that forbid third-party software, and a large share are years past vendor support. Research has found that while roughly half of connected medical devices run a version of Windows, only about 10% carry active anti-malware protection. The rest are invisible to EDR by design.

That invisibility is not a theoretical concern, it is where attacks start. Ransomware operators deliberately target the unmonitored device, because they know it is a reliable blind spot and a safe place to hide while they move toward the systems that matter. An endpoint-only strategy in a hospital has a hole shaped like the entire medical-device fleet, and that hole is precisely the attacker's preferred entrance.

Shortfall two: detection is not continuity or recovery

Even where EDR works perfectly, it does a specific job: it detects a threat and helps you respond to it. It is not designed to keep a hospital operating while an attack is underway, and it is not designed to restore clinical systems after one. When ransomware lands, and in an environment this complex something eventually will, EDR tells you it happened and gives you telemetry. It does not, on its own, contain the spread across the network in a patient-safe way or heal the systems that went dark.

For a hospital that distinction is everything, because the measure of success is not whether you detected the attack but whether care continued and how fast you recovered. The 2024 attack on Change Healthcare disrupted care and billing across the entire US system and exposed data on an estimated 190 million-plus people; the attacks that forced UK and US hospitals onto paper and diverted ambulances all shared the same shape. In none of them was the problem that nobody detected the attack. The problem was continuity and recovery, which is exactly what detection tooling is not built to provide.

Shortfall three: attackers now disable EDR on purpose

The third shortfall is that EDR has become a target in its own right. Modern ransomware crews routinely try to blind the endpoint tool before they strike, using so-called EDR killers and bring-your-own-vulnerable-driver techniques to disable or evade it, and increasingly operating without any malware file for a signature to catch, living off legitimate tools already present on the system. When the endpoint agent is the whole defense and the attacker has just switched it off, there is nothing left watching.

This is not an argument that EDR is bad, it is an argument that a single layer which attackers have learned to disable cannot be the only layer. A hospital needs defenses that keep working even when the endpoint agent has been blinded, which means visibility and containment that live somewhere the attacker cannot simply uninstall, namely the network.

What to add, without ripping EDR out

None of this is a case for removing EDR. Keep it, and run it well on every endpoint that can take it. The case is for adding the three things EDR cannot provide in a hospital, so the whole environment is covered rather than just the part that runs software.

• Agentless, network-level coverage for the connected medical devices EDR cannot see, so the fleet attackers target most is no longer a blind spot.
• Care-aware containment that isolates a threat in seconds and quarantines a device at the network layer, without shutting down equipment attached to a patient, and gates care-impacting actions behind one-click approval.
• Self-healing recovery from immutable, air-gapped backups, so clinical systems are restored in care-priority order, validated clean, in hours rather than weeks, and no ransom is needed.
• Network-based visibility that keeps working even if the endpoint agent is disabled, so blinding the EDR does not blind the defense.

The resilience layer a hospital needs

Put together, those additions turn an endpoint-centric program into a resilient one. The difference is the difference between security and resilience: security tries to stop the attack, resilience makes sure that when an attack gets through, care keeps running and recovery is fast and clean. In a hospital, where the stakes are measured in patient safety, resilience is the standard to hold a program to.

This is the gap we were built to close. We complement your EDR rather than competing with it: agentless protection for the medical devices it cannot reach, care-aware containment that respects clinical decisions, and self-healing recovery that keeps a hospital running through an attack. For the broader argument see our pillar on why EDR alone is not enough, for the attacker techniques see our look at evasive ransomware, and for the device problem specifically see our medical device security guide. EDR watches the endpoints it can. We cover the devices it cannot, and we keep the hospital running when something gets through.