EDR, endpoint detection and response, is software on laptops and servers that records activity, spots attacker behaviour and lets staff contain a machine remotely. For a CFO, it is the equivalent of cameras and a lock on every computer, plus staff who watch the feed. Its value depends on coverage and on someone responding.
Why does the board care?
Endpoints are where staff work and where many attacks land. If one laptop is compromised, an attacker may reach files, email and internal systems. EDR shortens the time between "something bad happened" and "we contained it", and it keeps a record that shows what happened afterwards.
That record matters for more than security. Insurers, regulators and customers may ask what happened and what data was affected. Good records answer faster and with less guessing.
What does it not do?
State the limits plainly, to avoid false comfort.
- It covers only devices with a healthy agent. Personal phones, some cloud workloads and network equipment may be outside.
- It sees device activity, not everything. Abuse of a cloud account with a stolen token may never touch an endpoint.
- It does not fix flaws in the software you build. It may see an exploit run, but you still need to patch the library.
- It needs people. An alert nobody reads is a recording, not protection.
NIST's glossary entry for EDR points to source publications for its definition instead of giving one standalone, which fits the fact that vendors use the term differently. Ask what a given product records and does.
What are the cost drivers?
We are not quoting prices. The drivers are:
- Number of devices, including servers, which often cost more per unit.
- Data retention, since longer history costs more to store.
- Service level. Software alone, or software plus a managed service that watches alerts around the clock.
- People. Analysts' time, or the cost of a service, usually exceeds the licence.
- Disruption. Agents consume resources, and containment actions can interrupt work.
A fair board question: are we paying for devices that do not exist any more, and are we missing devices that do?
What should the board ask for?
Four numbers, with trends.
- Coverage. Share of managed devices with a healthy agent today. The gap is the attacker's target.
- Time to contain. From alert to containment, for real incidents and for rehearsals. Median and worst case.
- Test results. Did the tool and the team detect harmless simulated behaviour in the last exercise?
- Rule for strong actions. Who may isolate a server, and has it been rehearsed? NIST's incident response guidance, SP 800-61 Revision 3, ties response to wider risk management, so decisions about who may act should be made before an incident.
What should worry you?
- Coverage figures with no denominator. "All devices" means little if the device list is out of date.
- Alert counts as the headline. More alerts may mean more noise.
- No rehearsal. A tool nobody has tested under pressure is unproven.
- A single person who knows how it works. That is a continuity risk.
Should we buy a service or run it ourselves?
A service gives round the clock coverage and shifts some work. It also shifts some decisions, so get the boundary in writing: what they investigate, what actions they may take, and who decides at 3 a.m. Running it yourselves gives control and needs staff. Many mid sized companies do a hybrid.
What about the software we ship?
Endpoint tools watch runtime. They do not tell you which of your own products carry a vulnerable component. Ask management how that gap is covered, for instance with a dependency inventory and checks of whether flagged flaws are reachable.
What to do
- Ask for the coverage figure and the device list it is measured against.
- Ask for the last rehearsal result and the time to contain.
- Confirm who may isolate a server, and that the rule is written.
- Ask what is in the cost base: devices, retention, service level and people.
- Ask how gaps outside endpoints are covered: cloud, identity and the software you ship.
- Review the four numbers every quarter.
Safeguard focuses on the application and software supply chain side and does not replace EDR.
Quick check
Does EDR guarantee we will not be breached?
No. It improves detection and response on covered devices. Attacks can start elsewhere, and a tool with no one to act on alerts adds little. Ask for coverage and rehearsal results.
What is the most useful question for a CFO?
Ask what share of devices have a healthy agent today and how long containment took in the last rehearsal. Those two answers show reach and response.
Sources
- NIST glossary: Endpoint Detection and Response
- NIST SP 800-61 Revision 3
- NCSC Cyber Security Toolkit for Boards
Last reviewed: 18 October 2026.
