What is EDR (endpoint detection and response)?

What EDR is

EDR stands for endpoint detection and response. It is security software that lives on your endpoints, the laptops, servers, and workstations people use, and continuously watches what each device is doing so it can spot an attack and help you respond. The defining feature is the agent: EDR works by placing a small program on each device it protects, and that agent is its eyes and hands, observing the machine from the inside and able to act on it.

EDR emerged as the answer to the limits of traditional antivirus. For years the standard defense kept a list of known-bad files, their signatures, and blocked anything that matched. That worked until attackers began changing their malware constantly and running attacks that used no malicious file at all. Antivirus, looking only for known signatures, missed them. EDR changed the question from is this a known-bad file to is this device behaving the way it should, a shift from signatures to behavior that is the essence of the category.

EDR versus antivirus

The two terms are often used interchangeably, but the distinction is real. Traditional antivirus is largely preventive and signature-based, trying to block known threats at the door. EDR is detective and behavioral, assuming something might get in, watching continuously for the behavior of an attack, and providing the tools to investigate and respond when it sees one. Most modern endpoint products combine both, antivirus-style prevention plus EDR-style detection and response, which is why you sometimes hear the umbrella term endpoint protection platform.

In practice this means EDR can catch things antivirus cannot, such as a brand-new strain with no known signature or a file-less attack that abuses legitimate tools already on the machine. In exchange, EDR generates far more data and depends on someone, a security team or a managed service, to investigate what it surfaces.

How EDR works, step by step

Every EDR product follows the same basic loop, and understanding it demystifies the category.

• Collect: the agent on each endpoint continuously records activity, the processes that run, the files they open, network connections, and user logins.
• Analyze: that telemetry is checked against known attack signatures and, more importantly, against behavioral models that flag activity resembling an attack.
• Detect: when something crosses a threshold, EDR raises an alert, ideally with context about what happened and how serious it looks.
• Investigate: responders use the recorded telemetry to trace the attack, what started it, what it touched, and how far it spread.
• Respond: EDR can take action, isolating the endpoint from the network, killing a malicious process, or quarantining a file, to stop the attack on that device.

What EDR does well

EDR is genuinely valuable, and any serious security program should have it. On the devices it covers, it provides a depth of visibility that nothing else matches: it can reconstruct exactly what a process did, trace the chain of an attack, and give responders the evidence to understand and contain it. It catches both known malware and many novel, behavior-based attacks that signature tools miss, and it can respond automatically on the endpoint, isolating a compromised laptop in seconds. For a fleet of managed computers that the organization controls and can install software on, EDR is close to essential.

Where EDR reaches its limits

EDR's great strength, that it lives on the device, is also the source of its two defining limits. The first is coverage. EDR only exists where its agent can be installed, and a huge class of connected devices cannot host one. Medical equipment, industrial control systems, and much legacy and embedded hardware run closed or unsupported operating systems that forbid third-party software. Research has found that while roughly half of connected medical devices run a version of Windows, only about 10% carry active anti-malware protection. To EDR, the rest are invisible, which is exactly why attackers favor those devices as entry points.

The second limit is that detection is not continuity or recovery. EDR's job is to detect a threat and help you respond to it on an endpoint. It is not designed to keep an organization running through an attack, to contain a threat across an entire network in a safety-aware way, or to restore systems after encryption. When an attack gets through, EDR tells you it happened; it does not, by itself, bring you back.

Why it matters, and what pairs with it

None of this is an argument against EDR. It is a foundational layer, and removing it would be a mistake. The point is that EDR is one layer, not the whole answer, and knowing its limits lets you build a defense that covers them. In a device-heavy environment such as a hospital, EDR pairs with two things it cannot provide on its own: agentless, network-level coverage for the devices it cannot run on, and the containment and recovery that keep an organization operating and restore it when an attack lands. Understood that way, EDR is the strong first layer of a defense that still needs more to be complete.