Endpoint Detection and Response (EDR)

Endpoint detection and response (EDR) is security software that watches what actually happens on a device — every process launched, file written, registry change, and network connection — rather than just scanning files against a list of known malware. That telemetry is analyzed for malicious behavior, and when something fires, responders can investigate the full timeline and act remotely: kill the process, quarantine the file, or isolate the machine from the network while keeping their own connection to it.

How it works

An agent on each endpoint streams events to a detection backend, where behavioral rules and machine-learning models look for patterns no signature would catch: a Word document spawning PowerShell, an unsigned binary reading browser credential stores, an office laptop beginning to encrypt file shares. This behavioral approach matters because modern intrusions often use no conventional malware at all — living-off-the-land techniques drive legitimate admin tools toward malicious ends, and an infostealer may run for seconds before deleting itself. When detection fires, the recorded history lets analysts answer how did this start — which, in most cases, traces back to a human action: a link clicked, a fake update run, a pasted command.

How to defend with it

EDR earns its keep as the safety net for the moments people are deceived. In one widely reported 2024 case, a North Korean operative hired as a remote developer at KnowBe4 passed four video interviews and a background check — and was caught within minutes of his company laptop arriving, when EDR flagged the malware he immediately tried to load. The lesson cuts both ways: detection worked, but every control before the keyboard had failed. Treat EDR coverage as a baseline (unmanaged personal devices holding corporate logins are a standing gap stealer operators exploit), tune it alongside your SOC so alerts get human attention, and remember what it cannot see — a convincing phone call, a payment-change email, or an employee typing their password into a perfect replica login page. Those attacks are invisible at the endpoint, which is why EDR belongs alongside, not instead of, training that targets the human layer.