Choose EDR by testing four things on your own machines: coverage across your operating systems, the depth and retention of telemetry, the response actions available, and who will actually act on alerts. Compare in a trial with the same scenarios for each candidate. This guide ranks no vendors.
Start with who will respond
The most important decision is not a feature. It is whether your own staff will watch alerts at night and on weekends. If not, you need a managed service, or a tool plus a provider, and the evaluation changes: you are buying a team's performance, so ask for their response targets in writing.
A constructed example: a company of 150 with two IT staff buys a top tier agent and enables every detection. Alerts arrive at 2 a.m. and sit until morning. A smaller tool paired with a service that isolates hosts overnight would have fit better.
Criteria that matter
Platform coverage. List every operating system and version in use, including older servers, Linux hosts, virtual machines, containers and mobile devices if relevant. Ask which are fully supported and which get reduced features.
Telemetry depth. What events does the agent record: process creation, file writes, network connections, registry or configuration changes, logins? Ask how long data is kept and whether longer retention costs extra. Investigations often begin days after the event.
Detection approach. Ask how detections are built and updated, and whether they map to techniques in MITRE ATT&CK. Mapping lets you see which techniques are covered and which are not. Be wary of vague claims about artificial intelligence with no description of what it detects.
Response actions. Can an operator isolate a device, end a process, collect a file or remove a persistence mechanism from the console? Ask whether actions work when a device is off the corporate network.
Performance and stability. An agent that slows developer laptops or crashes servers gets switched off. Test on your busiest machines.
Tamper resistance. Can an attacker or an administrator disable the agent easily? Ask how tampering is detected and reported.
Integration. Check export to your log system, ticketing and identity tools, and the quality of the API.
Privacy and data location. Telemetry can include user activity. Check where it is stored, who at the vendor can see it and what your works council or regulators expect.
Exit. Can you export alerts, rules and history? How is the agent removed?
How to run a fair trial
- Pick 20 to 50 machines that represent your mix, including a few awkward ones.
- Run each candidate on similar groups for at least two weeks.
- Agree benign test scenarios in advance, such as safe simulations of common techniques from a recognized test set, run with permission.
- Record how many real alerts needed action, how many were noise and how long triage took.
- Compare what each tool showed during one shared scenario.
Keep the test defensive and approved by IT. Do not run anything harmful on production systems.
Red flags
- Refusal to let you trial on your own devices.
- Pricing based on factors you cannot predict, with no cap.
- No documentation of what is collected.
- A single score presented as proof of quality.
Where Safeguard fits
EDR protects running endpoints. Safeguard focuses on the application and software supply chain side, such as dependencies, code and builds, and does not replace endpoint tooling. The two address different stages: one watches what runs, the other checks what you build and pull in before it runs.
What do contracts hide?
Three clauses deserve a careful read. Retention: the default period may be shorter than your needs, and longer storage can be a paid add on. Minimum commitments: some agreements fix a device count for the term, so a layoff or sale of a business unit leaves you paying for agents that no longer exist. Data use: check whether the vendor may use your telemetry to improve its products, and whether you can opt out.
Also ask about the support model. When the agent breaks a build server at midnight, is there a named contact, or a ticket queue? A constructed example: a vendor update causes a spike in processor use on database hosts. A good provider has a documented staged rollout so you can test updates on a small group first, and a way to pin a version. Ask for both.
Finally, plan the day you leave. Agent removal across thousands of devices takes months if there is no clean uninstall and no tamper protection key handover. Settle that now, while you still have bargaining power.
What to do
- Decide who responds out of hours.
- List all operating systems and counts.
- Define five trial scenarios and success measures.
- Run a two week trial with each shortlisted option.
- Negotiate retention, export and removal terms before signing.
Quick check
What is the first question to ask an EDR vendor?
Who responds to an alert at 3 a.m., and what are they allowed to do without calling you?
How long should telemetry be kept?
Long enough for your investigations and audits. Many teams find that is longer than the default, so ask what extended retention costs.
Sources
Last reviewed: 18 October 2026.
