In short
Endpoint detection and response (EDR) is security software that records activity on laptops, desktops and servers, such as processes, command lines, file changes and network connections, analyses it for signs of attack and lets you investigate and respond: isolating a device, killing a process or rolling back changes. It needs someone, in-house or a vendor's managed service, to act on its alerts.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What EDR is and why it exists
Traditional antivirus and next-generation antivirus try to stop malicious files and scripts before they run. That still matters, but many attacks today do not rely on a malicious file at all. An attacker signs in with a stolen password, runs PowerShell or a remote admin tool that is already on the machine, and moves quietly from one device to the next. Nothing they use looks like malware, so prevention has nothing to block.
Endpoint detection and response closes that gap. A lightweight agent on each device records what happens, sends the telemetry to a cloud console, and looks for patterns that point to an attack. When it finds one, it raises an alert with the context an analyst needs and gives them the tools to contain the device and clean up.
In the industry, "EDR security" usually means this combination of continuous recording, behavioural detection, investigation and response. Most current products ship EDR and prevention in the same agent; our guide to EDR vs antivirus explains how the two fit together, and our sister site endpointprotection.uk covers antivirus and endpoint protection products.
What EDR records
The value of EDR comes from the data it keeps. The exact fields vary by vendor, but a typical agent records:
- Process activity: which programs started, what started them (the parent process), the full command line and the user account involved.
- File and registry changes: files created, modified, renamed or deleted, and changes to the Windows registry that attackers use to persist.
- Network connections: which process connected to which address and port, which helps spot command-and-control traffic and lateral movement.
- Logons and privilege use: local and remote sign-ins, new accounts and elevation of privileges.
- Script and memory activity: script interpreters, injected code and other in-memory techniques used in fileless attacks.
That history is what lets an analyst answer the questions that matter after an alert: where did this start, what else did it touch, and is it still running anywhere? Retention varies: SentinelOne, for example, lists 14 days of searchable EDR telemetry as standard in Singularity Complete, with longer retention as an option. If your insurer or incident response provider expects a longer look-back, factor that in when you choose. The NCSC's guidance on logging and protective monitoring for devices is a good companion read.
How EDR detects attacks
EDR does not rely on one technique. Platforms layer several:
- Behavioural analytics: machine learning and rules that flag suspicious sequences, such as an Office document launching a script that downloads and runs a file, or a process encrypting many files in quick succession.
- Indicators of attack: patterns that describe what an attacker is trying to do (credential theft, persistence, defence evasion), rather than indicators of compromise, which describe artefacts already known to be bad, such as a file hash or address.
- Threat intelligence: matching activity against known attacker infrastructure and tools.
- MITRE ATT&CK mapping: most platforms label detections with the tactics and techniques in the public MITRE ATT&CK knowledge base, so an analyst can see at a glance whether an alert is reconnaissance, credential access or lateral movement.
- Correlation: related alerts are grouped into one incident or storyline, often across several devices, so you investigate one attack rather than fifty alerts.
Good EDR also explains itself. A detection that says what happened, on which device, under which account and what to do next is far more useful to a small IT team than a raw event list.
Response actions
Detection is only half the job. EDR consoles give you, or a managed service acting for you, ways to contain and clean up:
| Action | What it does | When it helps |
|---|---|---|
| Isolate the device | Cuts the device off the network while keeping its connection to the security console | Stops an attacker or ransomware spreading while you investigate |
| Kill process and quarantine | Stops a malicious process and moves its files out of reach | Ends the immediate threat on that device |
| Roll back | Reverses changes made by the attack, including files encrypted by ransomware, where the product supports it | Recovers quickly without restoring the whole device from backup |
| Remote shell or live response | Gives an analyst audited command-line access to the device | Collecting evidence, removing persistence, running clean-up scripts |
| Block indicators | Blocks a file hash, domain or address across every device | Stops the same attack landing elsewhere |
| Automated playbooks | Runs response steps automatically when certain detections fire | Contains fast-moving attacks out of hours |
Rollback is worth looking at closely if ransomware is your main worry. ThreatDown EDR can restore files encrypted, modified or deleted by ransomware up to seven days back, and SentinelOne's agent can roll a device back to its pre-attack state on supported systems. Rollback is not a substitute for backups. Our guide on how to prevent ransomware attacks covers the full picture.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
What EDR needs from you
EDR produces alerts. Someone has to look at them, decide whether they are real and act, and attacks rarely wait for office hours. Before you buy, decide which of these fits:
- Your own team triages alerts during the working day, with automatic response rules (for example, isolate on confirmed ransomware behaviour) covering the rest.
- A vendor-run managed service, where the vendor's analysts monitor, investigate and respond within a policy you agree. Our sister site explains managed detection and response and compares EDR vs XDR vs MDR.
- Proactive hunting, where people search the telemetry for attackers who have not triggered an alert. See threat hunting.
You also need coverage. EDR only sees devices that run the agent, so an up-to-date inventory and a check that every device is reporting are part of running it well. Our EDR deployment guide walks through planning, piloting and measuring coverage.
EDR platforms we supply
We supply several EDR platforms, so we can recommend the one that fits your devices and who will respond, not the one we happen to stock. Names below are the vendors' own.
| Vendor | EDR offering | Investigation and response highlights | Managed option from the vendor |
|---|---|---|---|
| CrowdStrike | Falcon platform; CrowdStrike's EDR is Falcon Insight XDR | Real Time Response, Falcon Fusion SOAR, Charlotte AI-assisted investigation, MITRE ATT&CK mapping | Adversary OverWatch threat hunting (Advanced Defend and Complete Defend bundles) and Falcon Complete Next-Gen MDR (Complete Defend) |
| SentinelOne | Singularity Complete | Storylines, 14 days of searchable telemetry as standard, rollback, remote shell, Purple AI | Wayfinder MDR, formerly Vigilance MDR, listed by SentinelOne as an add-on to its Commercial and Enterprise packages |
| ThreatDown | ThreatDown EDR | Network, process and desktop isolation, seven-day ransomware rollback, guided remediation | ThreatDown MDR and Managed Threat Hunting |
| Bitdefender | GravityZone EDR | Cross-endpoint incident correlation, attack-chain view, MITRE ATT&CK context, Historical and Live Search | Bitdefender MDR |
| WatchGuard | Endpoint Security Prime, 360 and Elite | Isolation, MITRE ATT&CK-mapped alerts with root cause analysis; Elite adds advanced investigation tools | WatchGuard MDR |
| Sophos | Sophos EDR | MITRE ATT&CK-mapped detections, isolation, Live Response, AI search | Sophos MDR |
| Check Point | Harmony Endpoint EDR (Check Point Endpoint Security) | Automated forensics mapped to MITRE ATT&CK, threat hunting, anti-ransomware with file restoration | Check Point MDR |
| TrendAI | TrendAI Vision One Endpoint Security Essentials (EDR sensor) | XDR for Endpoints telemetry investigated in TrendAI Vision One | TrendAI managed detection and response services |
We supply CrowdStrike through its Falcon Defend, Advanced Defend and Complete Defend bundles, so which Falcon detection and response features you get, and through which bundle, is confirmed at quote.
For a buying framework, see best EDR solutions; for smaller organisations, EDR for small business. Licensing detail for many of these is on our EDR software pages, and the endpoint security vendors directory lists everything we supply. Pricing depends on device numbers, options and term, so ask us for a quote.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
How we help
We start with what you have today: devices and operating systems, the agent you run now, your Microsoft 365 licences and, most importantly, who would act on an alert at 7pm on a Friday. From there we can:
- Recommend an EDR platform and, where it fits, the vendor's managed service, with the reasoning written down
- Help plan and run the rollout, from pilot group to servers, including moving off your existing product
- Set up response policies so the right people are told and the right actions are pre-approved
- Arrange licensing, with pricing confirmed at quote
Contact us to talk through endpoint detection and response for your organisation.
EDR guides
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is EDR in cyber security?
EDR stands for endpoint detection and response. It is software that records activity on endpoints such as laptops, desktops and servers, detects signs of attack in that activity, and gives you tools to investigate and respond, for example by isolating a device or rolling back changes.
How does endpoint detection and response work?
An agent on each device records process, file, registry, network and logon activity and sends it to a console. Behavioural analytics, threat intelligence and rules look for attack patterns, often mapped to MITRE ATT&CK. Related alerts are grouped into incidents, and analysts use the console to investigate and take response actions.
Is EDR the same as antivirus?
No. Antivirus focuses on preventing malicious files and scripts from running. EDR records what happens on the device so attacks that get past prevention, such as those using stolen credentials or legitimate admin tools, can be detected and contained. Most business platforms now include both in one agent.
Do I need someone to monitor EDR?
Yes. EDR raises alerts that need a person to triage and act on them, including outside office hours. If you do not have that in-house, several vendors we supply run their own managed detection and response services on top of their EDR.
What are examples of EDR tools?
Examples include CrowdStrike Falcon Insight XDR, SentinelOne Singularity Complete, ThreatDown EDR, Bitdefender GravityZone EDR, WatchGuard Endpoint Security, Sophos EDR, Check Point Harmony Endpoint and TrendAI Vision One Endpoint Security. We supply platforms from all of these vendors and can recommend what fits, with editions confirmed at quote.
Does EDR help with Cyber Essentials?
Cyber Essentials requires malware protection, which EDR platforms can meet through their built-in anti-malware prevention. EDR goes further than the scheme requires by adding detection and response. The current requirements are explained on our Cyber Essentials site.
Still have a question about endpoint detection and response (EDR)?
Ask us and a member of our team will reply by email.