EDR: The Difference Between Recognizing a Burglar and Watching One Work
TL;DR:
EDR watches what software actually does on a computer, instead of asking whether it recognizes the file.
Think of it like the difference between a doorman with a photo of known troublemakers and a building full of cameras with a guard watching them. The doorman is useful right up until somebody turns up whose face is not on the list. The guard notices the person trying every door handle on the third floor, and can lock the stairwell before they reach a fourth.
On a good day EDR is invisible. On a bad day it is the thing that cuts one laptop off the network at 3am, before the rest of the building is on fire.
Beyond the Basics:
Here's the shift: attacks stopped arriving as recognizable files, so recognizing files stopped being a strategy.
Traditional antivirus compares what lands on a machine against a list of known-bad signatures. That works on yesterday's malware. It does not work on a script that arrives in memory, a legitimate admin tool used for the wrong reason, or a file recompiled an hour ago to look brand new. EDR takes the other approach and watches behavior.
- An agent records what happens on the endpoint. Processes started, files touched, registry changes, network connections, which program spawned which. Continuously.
- That telemetry is evaluated against attack behavior, not filenames. A signed, legitimate Office process suddenly launching a scripting engine that reaches out to an unknown host is suspicious regardless of what it is called.
- Detections come with the surrounding story. Not "we blocked a file," but the chain: the mail that opened, the process that spawned, the credential it grabbed, where it went next.
- Response happens remotely. Kill the process, quarantine the file, and most importantly isolate the machine from the network while leaving your access to investigate.
That last capability is what earns the R. Containing one endpoint in seconds is the difference between one rebuilt laptop and a ransomware event across every share the user could reach.
In a Microsoft environment this is Defender for Endpoint, managed in the Defender portal, with device isolation and live response available per machine. Licensing matters here: the endpoint plan bundled with Business Premium covers detection and isolation, while the deeper hunting and six-month telemetry retention sit in the higher tier. Most competitors split their products the same way, so compare what each one actually keeps and for how long.
Here's the catch: EDR generates alerts, and alerts need somebody watching them. Software bought and left unmonitored is a recording nobody reviews. That gap is precisely what managed detection exists to fill, and deciding who watches yours is the actual decision, not which product you buy.