Before signing for EDR, ask about platform coverage, performance impact, detection evidence, response actions, data ownership and exit terms. Demand a trial on your own machines, and score the answers against your needs. These fifteen questions are grouped so you can send them in one email.
Coverage and fit
- Which operating systems and versions are supported, including older ones we still run? Ask for the list in writing and check the oldest machines you own.
- How does the agent handle servers, containers and short lived build runners? Ephemeral hosts are often poorly covered.
- What happens on a machine that is offline for weeks? Ask how it catches up and whether it still protects itself.
Performance and safety
- What is the measured impact on CPU, memory and disk on machines like ours? Ask to run a trial on a build server and a developer laptop, not just office machines.
- How are agent updates delivered, and can we stage them? A bad update that stops many machines is a known risk. Ask how the vendor avoids it and what the rollback is.
- Can an attacker with admin rights remove the agent? Ask about tamper protection and what alerts if the agent is stopped.
Detection quality
- How do you show why something was flagged? You want the process tree, file and network events, not a score alone.
- How do we test detection? Ask for a safe, documented way to trigger test alerts, and check the trial against your own harmless tests.
- What is the typical alert volume for a company of our size, and how do we tune without blind spots? Be wary of an answer that promises no tuning.
- How do you handle our developer workflows, scripts and admin tools, which often look suspicious?
Response and operations
- Which response actions exist, such as isolate host, kill process, collect files, and who can run each? Check role based limits.
- Is there a managed service, and what exactly does it commit to: hours, response times, authority to act? Get the commitment in the contract, not the brochure. NIST SP 800-61 Rev. 3 is a good outline of the incident response activities you must split between you and a provider.
Data and contract
- Where is our telemetry stored, for how long, and can we export it in a documented format? Ask what happens to it after termination.
- How does pricing change with device count, retention, and add on modules? Ask for a written example using your numbers, and what happens at renewal.
- What is the exit plan? Ask how long removal takes across your fleet and whether you can run two products during migration.
How should you run the trial?
Pick three machine types: one developer laptop, one server and one office laptop. Run two weeks in detect mode. Keep a log of alerts, false positives, performance complaints and support responses. Trigger a safe test event and time the path from alert to isolation. Ask one awkward support question and note the answer time.
Treat every answer as a claim to verify. If a claim matters, put it in the contract.
How does EDR relate to your software program?
EDR sees behavior on endpoints. It does not tell you which library in your build is vulnerable. Safeguard focuses on the application and software supply chain side, with reachability analysis and policy gates, and does not replace EDR. Share asset lists between both programs.
How should you score the answers?
Make a sheet with the fifteen questions as rows and each vendor as a column. Score each answer from 0 to 2: 0 for no answer or marketing language, 1 for a claim with no evidence, 2 for a claim backed by a demo, document or trial result. Weight the rows that matter most to you, such as server support or managed service commitments, and total them. The sheet will not make the decision, but it shows where answers were thin and gives you a fair record if a stakeholder asks why you chose as you did.
What to do
- Send all fifteen questions in one message and set a reply date.
- Trial on three machine types for two weeks.
- Time a test alert from detection to isolation.
- Get service commitments, data export and exit terms in writing.
- Price a scenario with your own counts.
- Score vendors on the same sheet.
Quick check
Which question reveals the most?
Ask how the agent is updated and rolled back. It shows how the vendor manages risk to your own machines.
Should I trust a score alone as detection evidence?
No. Ask to see the underlying events, such as process tree and network connections, so an analyst can verify and learn from each alert.
Sources
Last reviewed: 18 October 2026.
