What is endpoint detection and response (EDR)?
Endpoint detection and response (EDR) is security software on laptops, desktops and servers that records activity, detects malicious behavior and lets responders isolate a device or stop a process. Extended detection and response (XDR) adds signals from email, identity and cloud.
How it works
EDR goes beyond signature-based antivirus by watching behavior, such as a document opening a script that contacts an unknown server, and keeping a timeline for investigation.
Endpoint events tied to a person, such as repeated malware blocks or disabled protections, are useful signals of human risk.
Why it matters
Endpoints are where most attacks execute. EDR gives responders visibility and a way to contain an attack before it spreads.
