Endpoint detection and response (EDR) is security software that watches what happens on laptops, desktops and servers, flags suspicious behaviour, and gives you tools to investigate and contain a threat on that device. An "endpoint" is any device that connects to your network or cloud services: staff computers, office PCs, file servers and cloud virtual machines. Some EDR products also cover phones and tablets.
Traditional antivirus mainly checks files against known malware signatures. EDR adds a second layer: it records activity on the device, such as programs starting, scripts running, network connections and changes to system settings, and looks for patterns that suggest an attack even when no known malware file is involved.
How EDR works
Most EDR tools follow the same basic cycle:
- Collect: a small agent installed on each device records security-relevant events and sends them to a central console, usually in the cloud.
- Detect: the product compares that activity with known attack techniques and unusual behaviour, for example an office document launching a command-line tool, or a process encrypting many files in a short time.
- Alert: suspicious activity is raised as an alert with details of what happened, on which device and under which user account.
- Respond: an administrator, or an automatic rule, can isolate the device from the network, stop a process, quarantine a file or collect evidence for investigation.
The recorded history also helps after an incident: it can show how an attacker got in and which devices were touched, which supports your incident response plan.
EDR vs antivirus
The line between the two has blurred, because many modern antivirus products now include some behaviour-based detection. As a general comparison:
- Antivirus focuses on preventing known malicious files from running and cleaning them up.
- EDR focuses on visibility and response: it keeps a record of device activity, detects suspicious behaviour, and lets you act on a device remotely.
Many products sold as "endpoint protection" combine both. When comparing options, ask what each one actually records, how long it keeps that data, and which response actions it supports.
Related terms: MDR and XDR
- MDR (managed detection and response): a service where an external security team monitors your EDR alerts and responds on your behalf, often outside office hours. This suits businesses without in-house security staff.
- XDR (extended detection and response): extends the same idea beyond endpoints, combining signals from email, identity, cloud and network tools in one console.
Why it matters for SMEs
Attacks such as ransomware often start on a single staff laptop, for example after a phishing email or a stolen password. Attackers may also use legitimate built-in tools rather than obvious malware, which signature-based antivirus can miss. EDR gives you a better chance of spotting that activity early and isolating the device before the problem spreads to shared drives or servers.
EDR is one layer, not a complete defence. It works best alongside patch management, multi-factor authentication, tested backups and a zero trust approach to access.
What to check before choosing EDR
- Coverage: which operating systems are supported, including Windows, macOS, Linux servers and mobile devices if you need them.
- Who watches the alerts: EDR is only useful if someone reviews alerts and acts on them. Decide whether that is your IT staff, your IT provider or an MDR service, and what happens at night and at weekends.
- Response actions: device isolation, process blocking and remote investigation, and whether they can run automatically.
- Existing licences: some business editions of office and security suites already include EDR features. Check what you are paying for before buying another tool.
- Data and privacy: where activity data is stored and for how long. Tell staff that work devices are monitored, and take advice if you have specific privacy obligations.
- Performance and rollout: test the agent on a few devices first, and plan how new and departing staff devices are added or removed.
Frequently asked questions
Do small businesses need EDR?
It depends on your risk and setup. If staff handle customer data, payments or remote access to company systems, EDR is worth considering. For a very small team, a managed endpoint protection service may be more practical than running EDR yourself.
Does EDR replace antivirus?
Many EDR products include antivirus-style prevention, so a separate antivirus may not be needed. Check with the vendor rather than running two overlapping tools that can conflict.
Will EDR stop every attack?
No. It improves detection and response, but it can miss new techniques, and it does not fix weak passwords or unpatched systems. Treat it as one part of a layered approach.
Does EDR cover our website and cloud services?
Only the devices or servers where the agent is installed. Hosted websites and SaaS tools usually need other controls, such as account security, logging and website monitoring.
If you want help reviewing how your devices are protected, or setting up monitoring and response that fits your team, see our cybersecurity and compliance services. For ongoing maintenance with agreed response times, see managed support and SLA.