Endpoint detection and response is one of those categories that has been marketed hard enough to lose its meaning. Many security vendors now claim to offer it, and many organisations have been told they need it. So it is worth going back to what the technology actually does, and being clear about the circumstances in which it is and is not worth the money.
What is endpoint detection and response?
EDR is software that runs on endpoints, meaning laptops, desktops and servers, and does two things that traditional antivirus does not.
First, it monitors behaviour instead of matching signatures. Traditional antivirus compares files against a list of known-bad hashes and patterns. That works well against commodity malware and much less well against an attacker who writes something new, or who uses no malware at all.
Second, it records. EDR continuously logs process launches, network connections, registry changes, credential access and file activity, and retains that telemetry centrally. When something is discovered, that history is what lets you answer the questions that matter: how did they get in, what did they touch, and did they get to anything sensitive?
Why did signature matching stop being enough?
Many modern intrusions do not involve a malicious file at all. The technique is generally described as “living off the land”: the attacker uses tools that are already present and legitimately installed, such as PowerShell, Windows Management Instrumentation, remote desktop utilities and native administrative commands. In February 2024 the UK’s National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies published joint guidance on these techniques, warning that they remain effective because many organisations lack the detection capability to tell malicious use from legitimate administration.
There is no file to detect, because nothing was installed. What there is instead is a pattern of behaviour that is unusual: a finance workstation suddenly enumerating domain accounts, a server making outbound connections it has never made before, a service account authenticating at three in the morning from a device it has never used.
Signature-based antivirus is not designed to see that kind of activity. EDR is built for it.
What does EDR give you in practice?
Detection of behaviour, not just files. Suspicious process chains, privilege escalation attempts, credential dumping, lateral movement, mass file modification of the kind that precedes encryption.
A forensic timeline. After an incident, the ability to reconstruct exactly what happened on an affected machine, in order, with timestamps. Without it, incident response becomes inference.
Containment. Many EDR platforms allow an analyst to isolate a compromised endpoint from the network remotely, in seconds, while leaving the investigation tooling connected. That capability can decide whether an incident stays on one machine, which is why it matters for ransomware protection.
Threat hunting. Because the telemetry is retained, an analyst can search the estate retrospectively. When a new indicator of compromise is published, you can ask “has this ever appeared here?” instead of hoping it did not.
“EDR is genuinely one of the better returns available in security spending, but only if somebody is watching it,” says AJ Thompson, CCO at Northdoor. “We’ve walked into organisations with an excellent EDR platform, fully deployed, generating high-quality alerts into a console nobody had opened for three months. The tool did its job. The operating model didn’t exist.”
The caveat: EDR is not install-and-forget
This is where most disappointment comes from.
EDR produces alerts, and a meaningful proportion of them are ambiguous. Deciding whether an unusual process chain is an attacker or a developer doing something odd requires context and experience. If nobody has the time or the skill to triage, one of two things tends to happen: the alerts are ignored, or they are all escalated and the organisation stops trusting them.
There is also a tuning burden. Every environment has legitimate behaviour that looks suspicious. Without tuning, the noise floor stays high and the genuine signal gets lost in it.
And EDR has a defined scope. It covers endpoints. It does not cover email in transit, SaaS platform misconfiguration, identity provider abuse, network devices or your third parties. It is one layer in a security strategy.
Do you need EDR, or managed detection and response?
A reasonable way to decide:
- If you hold sensitive personal, financial or client data, yes. The forensic record alone justifies it when you have to tell a regulator what was accessed.
- If you have already had an incident and could not answer “what did they touch?”, yes. That question is exactly what EDR exists to answer.
- If your team cannot commit to monitoring the alerts, buy it as a managed service. Managed detection and response (MDR) bundles the platform with analysts who triage on your behalf, around the clock. For many organisations under a few thousand seats, this is the more realistic option. Northdoor’s managed security services include managed threat detection and response alongside EDR deployment.
- If you are still running unmanaged legacy antivirus across the estate, EDR is likely to be one of the bigger improvements per pound on your roadmap.
- If you have no multi-factor authentication (MFA), no patching regime and no backup testing, fix those first. EDR is a detection layer, and detection matters most once the basics are in place.
Where EDR fits in a layered defence
Think of EDR as the layer that assumes something will get through, and makes sure you find out quickly and can prove what happened. It sits alongside identity controls, email security, network segmentation and zero trust principles, and a backup and recovery regime you have tested.
What this means for your organisation
EDR earns its place once identity, patching and backup are in order, and only if somebody reads the alerts. If you are weighing EDR against a managed detection and response model, we can talk you through which fits your team. Start with our endpoint detection and response page or get in touch.
Further reading
Our earlier articles on EDR: