Glossary
EDR (endpoint detection and response)
Also called: Endpoint detection and response
In one sentence
EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
Traditional antivirus compares files against a list of known bad ones. EDR goes further: it watches what programs actually do on an endpoint — a laptop, desktop or server — and flags behavior that looks like an attack, such as a Word document launching PowerShell, a program encrypting hundreds of files in a minute, or someone dumping stored passwords. It keeps a timeline so you can see what happened and where it started.
The “response” part matters as much as detection. With EDR, a suspicious device can be cut off from the network in one click (or automatically), malicious files can be quarantined across every machine, and an investigator can look at the device remotely. Microsoft Defender for Business is an EDR product built for organizations up to 300 users.
Why it matters: modern ransomware crews often use legitimate tools already on your computers, which plain antivirus doesn't flag. Many cyber insurers now ask specifically whether you have EDR on every device. For a practice, EDR is often the difference between one infected workstation and a locked-up practice-management server.
Example: a front-desk PC at a medical office opens a malicious attachment. EDR notices the attachment spawning a script that tries to disable backups, blocks it, isolates the PC from the network and raises an alert. The IT team reviews the timeline, cleans the machine and confirms nothing else was touched — and the rest of the office keeps working.
EDR generates alerts that someone has to look at, which is where MDR comes in. See also our ransomware protection guide.
Related terms
- XDR (extended detection and response)XDR connects security signals from computers, email, sign-ins and cloud apps so an attack can be seen and stopped as one connected incident instead of scattered alerts.
- MDR (managed detection and response)MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
- Microsoft Defender for BusinessMicrosoft Defender for Business is Microsoft's endpoint security product for organizations of up to 300 users, combining next-generation antivirus with EDR and automated investigation.
- EndpointAny device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
- SOC (security operations center)A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.