Endpoint Detection and Response, or EDR, is a cybersecurity technology focused on continuously monitoring endpoint activity, detecting suspicious behaviour, supporting investigation and enabling response actions. Endpoints can include desktops, laptops, servers, virtual machines and other computing devices. Modern EDR systems collect detailed telemetry such as process execution, file activity, network connections, user actions and system changes, then analyse that information for evidence of malicious or abnormal behaviour. Microsoft describes EDR as a solution that monitors endpoint activity, detects suspicious behaviour and helps security teams investigate and respond to threats in real time.
EDR evolved from limitations in traditional antivirus approaches. Conventional antivirus historically relied heavily on known malware signatures, whereas EDR expanded monitoring towards behaviour, process relationships, command execution, network connections and historical activity. This does not mean EDR eliminates signatures or traditional malware detection; rather, it adds richer telemetry and behavioural analysis. The distinction is important because many modern attacks involve legitimate administrative tools, stolen credentials, scripting engines or other components that may not look like conventional malware files. EDR can record how these components are used and provide evidence that would be unavailable from file-signature detection alone.
A typical EDR architecture uses an endpoint agent to collect telemetry and transmit relevant information to a central management or analysis platform. The agent may observe process creation, command-line parameters, parent-child process relationships, file modifications, registry or configuration changes, network connections and authentication activity, depending on the operating system and product. Central analytics then apply detection logic to this information and produce alerts or incidents. Investigation interfaces commonly provide timelines and process trees so analysts can reconstruct what happened. Some systems also provide advanced-hunting capabilities that allow analysts to query raw or structured endpoint telemetry for patterns not captured by predefined detections.
EDR response capabilities can include isolating a device from the network, terminating a process, quarantining or deleting a file, collecting additional evidence, disabling access or initiating other containment actions. The exact capabilities depend on the operating system, agent privileges and product design. Automated response can reduce the time between detection and containment, which is particularly relevant for rapidly spreading threats such as ransomware. However, automated actions must be designed carefully because an incorrect response against a legitimate process or critical server can cause operational disruption. Many environments therefore use different automation thresholds for user workstations, servers and highly sensitive systems.
EDR is especially valuable for investigating activity that occurs after an endpoint has been compromised. A network alert might identify communication with a suspicious destination, but endpoint telemetry can reveal which process initiated the connection, which user context it operated under, what command launched it and what files it touched. Process trees can expose relationships such as a document application spawning a scripting interpreter, while historical timelines can show the sequence leading to compromise. This forensic context allows analysts to move beyond a simple alert and investigate the scope, persistence and actions associated with an intrusion.
EDR does not provide complete security coverage by itself. It concentrates on endpoints and therefore may have limited visibility into unmanaged devices, network infrastructure, identity systems, cloud control planes, email services or application-layer activity unless those domains are separately integrated. Attackers can also exploit visibility gaps by operating where endpoint telemetry is absent or by tampering with security agents. EDR agents require deployment, configuration, updates, connectivity and sufficient permissions, while telemetry volumes can create storage and analytical requirements. Effective coverage therefore depends on asset inventory, agent health monitoring and integration with other security controls.
EDR has strong relationships with vulnerability management, threat intelligence, SIEM, XDR and security operations. Vulnerability management identifies weaknesses that may expose endpoints, whereas EDR provides evidence of activity occurring on those endpoints. Threat intelligence can enrich detections with information about known indicators and attacker techniques. SIEM can receive EDR events for broader correlation, while XDR can correlate endpoint activity with identity, email, cloud and network telemetry. SOC analysts use these combined sources to prioritise incidents, investigate affected systems and coordinate containment.
Common EDR use cases include ransomware detection, investigation of compromised accounts or devices, identification of suspicious scripting, detection of lateral movement, threat hunting and post-incident reconstruction. EDR can also provide detailed records of security activity useful for incident response and audit requirements. Its greatest conceptual distinction from prevention-only endpoint controls is that EDR emphasises continuous visibility, investigation and response rather than merely deciding whether a file should execute. As security architectures evolve, EDR increasingly functions as a foundational endpoint telemetry and response layer within broader detection-and-response platforms rather than as an isolated endpoint product.
