EDR, endpoint detection and response, is software on laptops and servers that records what happens on them, looks for signs of attack, and lets a defender investigate and contain a machine remotely. It watches behaviour, not only known malware files, and it keeps history so you can reconstruct events.
What does an EDR agent actually do?
A small program runs on each device and watches activity: which processes start, what they launch, which files change, which network connections open and which accounts log in. It sends that stream, or a filtered version of it, to a central service.
Detection rules and models look at the stream for patterns that fit attacker behaviour. A word processor that launches a command shell, then downloads a file, then adds a startup entry is the kind of chain a rule can flag even if no single step is malicious.
When something looks wrong, an analyst opens the timeline, reads the chain of events and decides what to do.
How is it different from antivirus?
Traditional antivirus compares files to known signatures and blocks matches. EDR keeps a record of behaviour, so it can find attacks that use legitimate tools and leave no obvious malicious file. It also gives you a response path: isolate the host from the network, kill a process, collect evidence.
Many products blend both. The label matters less than the capability, so ask what the product records, how long it keeps it and what actions it permits.
What can you do with it during an incident?
Typical response actions are isolating a machine, ending a process, quarantining a file and pulling a copy of artefacts for analysis. Some tools can run a script remotely.
These are powerful. An isolation action on a production server is an outage. This is why NIST's incident response guidance, SP 800-61 Revision 3, ties response to wider risk management, so that people agree in advance who can take which action.
How do detections relate to attacker techniques?
Most EDR vendors tag detections with technique names from MITRE ATT&CK, a knowledge base of adversary tactics and techniques based on real world observations. That gives you a shared vocabulary: instead of "weird alert 4471" you can say which behaviour was seen.
Use it as a coverage map. If your EDR cannot see a technique that matters to you, you know where to add another control.
What does EDR miss?
Be plain about limits.
- Devices without an agent: personal phones, printers, many network devices, some cloud workloads.
- Activity that never touches an endpoint, such as abuse of a cloud account from a stolen token.
- Flaws inside your own application and its dependencies. EDR may see an exploit run, but it will not tell you which library to upgrade.
- Poor tuning: an agent in a mode that logs but does not alert is a recorder, not a defender.
NIST's glossary entry for EDR points to the source publications for its definition instead of giving one standalone, which fits the reality that vendors define the term in different ways.
One more limit is data volume. Recording everything is costly, so tools filter. Ask which events are kept in full, which are summarised and how long history is retained, because an investigation that starts weeks after the fact needs old data.
How do you judge whether yours works?
Run a constructed test. Agree a harmless simulated behaviour with a trusted tester, run it on a test machine, and see what the tool shows, how fast, and whether a person would know what to do. Repeat after configuration changes.
Also measure coverage: how many managed devices have a healthy agent right now? An EDR deployed to 70 percent of devices leaves a target the attacker will find.
What to do
- Count your devices and count healthy agents. The difference is your first task.
- Confirm the mode: block, alert only or record only. Write it down per device group.
- Decide who may isolate a device, and write that rule before you need it.
- Map detections to ATT&CK and list techniques with no coverage.
- Test with a harmless constructed scenario each quarter.
- Link EDR findings to your software inventory, so an exploited library leads to a fix and not only a cleanup.
Safeguard focuses on the application and software supply chain side and does not replace EDR.
Quick check
Is EDR the same as antivirus?
No. Antivirus mainly blocks known malicious files. EDR records behaviour and offers investigation and response, though many products combine both.
Does EDR protect servers and cloud workloads?
Only where an agent runs and is healthy. Many cloud workloads, containers and devices have no agent, so check coverage rather than assuming it.
Sources
Last reviewed: 18 October 2026.
