What Is EDR? Endpoint Detection and Response Explained

Defining Endpoint Detection and Response

Endpoint detection and response (EDR) is a category of security technology that continuously monitors endpoints (laptops, desktops, servers, and increasingly cloud workloads) to detect, investigate, and respond to cyber threats. The term originated with the analyst firm Gartner, and the category has evolved from a niche forensic tool into a foundational component of modern security operations.

At its simplest, EDR answers the question: what is happening on my endpoints right now, and is any of it malicious? Unlike legacy antivirus, which relies on static file scanning to block known malware, it provides continuous visibility into endpoint activity and uses behavioural analysis to detect threats that file-based scanning would miss entirely.

How EDR Works: The Agent Architecture

These platforms deploy a lightweight software agent on each endpoint. This agent operates at the kernel or near-kernel level to capture a rich stream of telemetry, including:

• Process creation and termination: Every process launched on the endpoint, including its parent process, command-line arguments, and associated user account.
• File system activity: File creations, modifications, deletions, and renames, particularly in sensitive directories such as system folders, startup locations, and user profile areas.
• Registry modifications (Windows): Changes to registry keys that affect system configuration, persistence mechanisms, and security settings.
• Network connections: Outbound and inbound network connections initiated by processes, including destination addresses, ports, and protocol details.
• Module and library loading: Dynamic-link libraries (DLLs) and shared objects loaded by processes, which can reveal injection techniques and malicious code loading.
• User authentication events: Login attempts, privilege escalation, and credential-related activity.

This telemetry is streamed to a central analysis engine, typically cloud-hosted, where it is processed against detection logic, correlated across the endpoint fleet, and stored for retrospective investigation.

Core EDR Detection Techniques

Modern platforms employ multiple detection techniques in concert:

Signature and IOC Matching

The most basic detection layer compares file hashes, process names, network indicators, and other observables against databases of known threats. While essential for catching commodity malware quickly, signature matching cannot detect novel or customised threats.

Behavioural Analysis

Behavioural detection focuses on what processes do rather than what they are. Common behavioural rules include:

• A Microsoft Office application spawning PowerShell or cmd.exe (indicative of macro-based malware; see MITRE ATT&CK T1059.001, PowerShell)
• A process injecting code into another process's memory space (T1055, Process Injection)
• A newly created executable in a temporary directory making outbound network connections
• Rapid file encryption across multiple directories (ransomware behaviour)
• Credential-dumping tools accessing the LSASS process (T1003.001, LSASS Memory)

Behavioural analysis is effective against fileless malware, living-off-the-land attacks, and zero-day threats because it does not require prior knowledge of the specific malware being used. Research on living-off-the-land attacks describes the problem plainly: adversaries hide malicious activity behind programs already installed on the machine, may create no malicious files, and so evade anti-virus scanning (Ongun et al., RAID, 2021). Microsoft's own fileless threats guidance makes the same point: scripts such as PowerShell run inside a clean, legitimate interpreter, so there is no binary for a file scanner to inspect, and behaviour monitoring and memory scanning are the counter.

Machine Learning

Many platforms now incorporate machine-learning models trained on large datasets of malicious and benign endpoint telemetry. These models can classify unknown files and behaviours with high accuracy, providing a layer of detection that complements both signatures and behavioural rules.

Threat Intelligence Integration

These platforms ingest threat intelligence feeds that provide context on emerging threats, attacker infrastructure, and indicators of compromise. This integration enables rapid detection of threats identified by the broader security community.

EDR vs Antivirus: Understanding the Difference

While EDR and antivirus both protect endpoints, they differ in approach, scope, and capability:

The retrospective column is the one that matters most during an incident. NCSC's logging guidance recommends storing your most important logs for at least six months, because incidents are often discovered long after they begin. Endpoint telemetry retention is where an EDR platform meets that requirement or fails it.

The Limitations of Standalone EDR

Despite its strengths, EDR operating in isolation has notable limitations:

• Endpoint-only perspective: EDR sees what happens on the endpoint but lacks visibility into network-layer activity between endpoints. An attacker moving laterally with valid accounts over legitimate remote services such as SSH, RDP or SMB (T1021, Remote Services) may generate minimal endpoint telemetry on the source machine while being highly visible on the network.
• Alert fatigue: Enterprise deployments can generate a high volume of alerts every day. Without additional context from network and identity data, analysts struggle to prioritise which endpoint alerts represent genuine threats. A systematic survey of alert prioritisation in security operations centres finds that the increasing volume of incidents has overwhelmed analysts and led to alert fatigue (Jalalvand et al., ACM Computing Surveys, 2024).
• Coverage gaps: Agents cannot be deployed on every device: IoT devices, legacy systems, BYOD mobile devices, and some operational technology environments remain unmonitored.
• Evasion techniques: Sophisticated attackers actively target the agent itself, using techniques such as direct system calls, unhooking, and kernel-level manipulation to blind or disable endpoint detection. MITRE ATT&CK catalogues this as Impair Defenses (T1562). An empirical assessment of EDR products against APT attack scenarios found that they failed to prevent and log the bulk of the attacks tested, and described how an adversary can tamper with EDR telemetry providers to attack more stealthily (Karantzas and Patsakis, Journal of Cybersecurity and Privacy, 2021).

The Case for a Unified Approach

These limitations have driven the industry toward platforms that combine endpoint detection with network and identity analytics. Rather than deploying separate EDR, NDR, and UEBA tools and manually correlating their outputs, organisations increasingly seek unified platforms that provide:

• Cross-domain correlation: Automatically linking endpoint alerts with related network anomalies and identity events to build a complete picture of an attack.
• Reduced alert volume: By cross-validating signals across multiple data sources, unified platforms can suppress false positives that would trigger in any single domain and surface only high-confidence alerts.
• Simplified operations: A single console, a single data model, and a single investigation workflow reduce the cognitive load on analysts and eliminate the integration tax of managing multiple point solutions.

Getting Started with EDR

For organisations evaluating endpoint detection, the following steps provide a practical starting point:

1. Audit your endpoint estate. Count and classify what you need to cover: operating systems, servers, cloud workloads, remote and unmanaged devices. The gaps list matters as much as the coverage list.
2. Define detection priorities. Map the techniques most relevant to your organisation to MITRE ATT&CK and ask each vendor to show coverage per technique, not a percentage.
3. Set a retention floor. Decide how long endpoint telemetry must be searchable. NCSC recommends at least six months for your most important logs; check what each platform includes as standard.
4. Plan for integration. Work out how the platform will connect to your SIEM, SOAR, identity provider and network infrastructure, or evaluate a platform that unifies those domains from the start.
5. Invest in operationalisation. The best technology delivers no value if alerts are ignored. Confirm the processes, playbooks and staffing to act on detections before go-live.

Endpoint detection and response has become table stakes for modern security operations. The question is no longer whether to deploy it, but how to deploy it in a way that maximises detection coverage while minimising operational overhead.

Sources

• MITRE ATT&CK, Command and Scripting Interpreter: PowerShell (T1059.001), accessed 20 September 2026
• MITRE ATT&CK, Process Injection (T1055), accessed 20 September 2026
• MITRE ATT&CK, OS Credential Dumping: LSASS Memory (T1003.001), accessed 20 September 2026
• MITRE ATT&CK, Remote Services (T1021), accessed 20 September 2026
• MITRE ATT&CK, Impair Defenses (T1562), accessed 20 September 2026
• Microsoft Learn, Fileless threats, 18 March 2022, accessed 20 September 2026
• NCSC, 10 Steps to Cyber Security: Logging and monitoring, accessed 20 September 2026
• Talha Ongun, Jack W. Stokes, Jonathan Bar Or, Ke Tian, Farid Tajaddodianfar, Joshua Neil, Christian Seifert, Alina Oprea, John Platt, "Living-Off-The-Land Command Detection Using Active Learning", RAID 2021 (24th International Symposium on Research in Attacks, Intrusions and Defenses), ACM, 2021, https://doi.org/10.1145/3471621.3471858 (open access: https://arxiv.org/abs/2111.15039)
• Fatemeh Jalalvand, Mohan Baruwal Chhetri, Surya Nepal, Cécile Paris, "Alert Prioritisation in Security Operations Centres: A Systematic Survey on Criteria and Methods", ACM Computing Surveys, 2024, https://doi.org/10.1145/3695462 (open access)
• George Karantzas, Constantinos Patsakis, "An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors", Journal of Cybersecurity and Privacy, 2021, https://doi.org/10.3390/jcp1030021 (open access: https://www.mdpi.com/2624-800X/1/3/21)

Related reading:

• EDR Solutions Compared for 2026
• MDR vs EDR: Service vs Technology, and Which You Need

How SenseOn writes, checks and corrects its content: editorial standards.