EDR

What it means

EDR, endpoint detection and response, is security software on end devices: computers, laptops and servers. Unlike classic antivirus, it does not just look for known malware samples but watches how programs behave and flags suspicious activity that may be the start of an attack.

A typical example is a program that starts encrypting files en masse, or a process trying to switch off backups or read passwords from memory. EDR stops such activity, can isolate the device from the network and records what happened so the attack can be analysed.

EDR records are valuable in incident response: they show when and how the attacker got in, which devices were affected and whether data were reached. Without them a company often cannot say whether personal data were leaked.

How it works in practice

Smaller companies can now get EDR as a subscription managed by the provider, who assesses the alerts on the company’s behalf. It is especially worthwhile where sensitive client data, payroll or bank access are handled.

EDR does not replace other measures. Patch management, offline backups, two-factor authentication and staff training are still needed. It is another layer that catches what slips past the rest.

Insurers increasingly ask whether a company uses EDR when underwriting cyber insurance, and without it they may offer worse terms or decline. For companies within the scope of NIS2, incident detection is part of the mandatory measures.

What to watch out for

The most common mistake is deploying EDR and then nobody reads the alerts. A system that reports suspicious activity on a server at night helps only if someone responds. The company needs either a person who handles alerts or a managed service.

Watch out for devices left uncovered, such as an old server, the director’s laptop or a computer in the warehouse. Attackers look for exactly the weakest point, and one unprotected device can be enough.