EDR maturity runs from agents installed on some devices, to full coverage with tuned alerts, to tested response, to detection engineering aligned with attacker techniques. Most gains come from coverage, ownership and practice, not from a bigger product. Find your level, then do the next step.
Level 1: Installed
What it looks like. An agent exists on many laptops, installed by whoever set them up. Alerts go to a shared mailbox. Nobody knows the exact coverage.
Signs. You cannot say how many devices lack the agent. Exclusions were added ad hoc. Servers are not covered.
Next step. Build a device inventory and compare it against agent check ins. Close the gap list.
Level 2: Covered
What it looks like. Agents run on nearly all managed devices, deployed by policy. Servers and developer machines are included or have a recorded exception. Alerts reach a named queue.
Signs. A weekly coverage number exists. New devices get the agent at setup. Alerts are reviewed within a stated working window.
Next step. Assign an owner for alert review and write down who acts after hours.
Level 3: Operated
What it looks like. Someone reviews alerts daily. Common false positives have narrow exclusions. A written procedure covers the top alert types. Containment is allowed by named people.
Signs. You can state a typical time to look at a high severity alert. Exclusion changes are logged and reviewed.
Next step. Practice. Run a tabletop and one harmless live test that exercises isolation and release. NIST SP 800-61 Rev. 3 treats preparation and improvement as part of response, not a bonus.
Level 4: Tested
What it looks like. Response is rehearsed, not assumed. Test activity is run at least yearly and ideally each quarter. Findings from tests lead to changes in rules and procedures. EDR data connects to ticketing and your asset register.
Signs. You know which attacker behaviors are detected and which are not. After each real incident, a review produces a change.
Next step. Move from reacting to alerts to writing detections for the gaps tests reveal.
Level 5: Engineered
What it looks like. A person or team writes and tunes detections, mapped to techniques in a shared vocabulary such as MITRE ATT&CK. Telemetry is joined with identity and cloud data. Threat information from sources such as the CISA Known Exploited Vulnerabilities catalog feeds hunting and priorities. Automation handles routine containment with approval.
Signs. Detection coverage is tracked against techniques. Hunts are scheduled and write down results, including empty ones.
Next step. Keep pruning. Retire rules that never fire and review exclusions for drift.
How do you assess yourself?
| Question | Level it points to |
|---|---|
| Do you know exact coverage? | Below 2 if no |
| Does one person own alert review daily? | Below 3 if no |
| Have you tested isolation in the last year? | Below 4 if no |
| Do you track coverage by technique? | Below 5 if no |
Be honest. A single no answer caps the level.
Common traps
- Buying advanced features at Level 1. They need people and coverage first.
- Treating a high alert count as maturity.
- Excluding developer machines, which makes them the easiest target.
- Skipping the tests at Level 4 because "nothing has happened."
How long does each level take?
There is no fixed timeline, and any number would be a guess. The time depends on staff, estate size and how much change your organization tolerates. A practical approach is to set one level as the goal for the next two quarters, name an owner, and review progress monthly. Moving from Level 1 to 2 is often mostly administrative work: inventory and deployment. The jump from 3 to 4 needs people to rehearse, which means scheduling time that competes with other work, so protect it on the calendar.
Where Safeguard fits
EDR is not part of Safeguard and Safeguard does not replace it. Safeguard focuses on the application and software supply chain: reachability analysis, policies and gates at build, CI and release, and compliance evidence. A mature endpoint program still benefits from controls that keep bad packages from reaching endpoints in the first place.
What to do
- Place yourself on the table above, answering each question honestly.
- Close coverage gaps before adding features.
- Name an alert owner and an after hours plan.
- Schedule a safe containment test within the next quarter.
- Review exclusions every quarter.
Quick check
Is more telemetry a sign of maturity?
No. Maturity shows in coverage, ownership, practice and learning from tests, not in the volume of data collected.
What is the cheapest improvement?
Measuring real coverage against your device inventory. Many teams discover gaps they can close with no new spending.
Sources
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
- MITRE ATT&CK
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-137, Information Security Continuous Monitoring
Last reviewed: 18 October 2026.
