Endpoint detection and response (EDR) is security software that runs on every laptop, desktop and server in a company, records what every program on it does, and stops attacks by their behaviour. It can also cut a device off from the network. EDR grew out of antivirus, and it is now the main defence on company devices.
Old antivirus works from a list. It calculates a hash of each file, which is a short code calculated from the file's contents. Then it checks whether that hash is on a list of known harmful files. A new attack is on no list, so the antivirus misses it. Attackers also use tools that are already present on every Windows computer, such as PowerShell, a built-in tool for running commands. Then there is no harmful file to find at all.
EDR looks at behaviour instead. Its endpoint agent records every program that starts, which program started it, every file it writes and every network connection it opens. It sends these records to the EDR company's cloud service, where they are kept for weeks. Rules and AI models look for sequences of actions that attacks use. Examples are a spreadsheet that opens a command window, or one program that rewrites hundreds of files in a minute.
Take, for example, a chartered accountancy firm in Kanpur during the tax-filing season. An employee opens a spreadsheet attached to an email that claims to come from the income tax department. The spreadsheet runs a hidden script. The script starts PowerShell, deletes the computer's backup copies of its files, and begins to encrypt clients' files at about 300 files a minute. This is ransomware. Within ten seconds, EDR recognises the pattern. It stops the program after 46 files. It cuts the laptop off from every network, except its connection to the EDR service. It restores the 46 files from copies that it keeps. Then it sends an alert with the full sequence of events.
The alert goes to the company's SIEM. Firms with no security team of their own often send it to a managed detection and response (MDR) provider, whose analysts check alerts around the clock. The analyst can search every other laptop for the same script, and run commands on the cut-off laptop from a distance. After the incident, digital forensics uses EDR's records to see exactly how the attack started.
Many EDR products have grown into XDR, extended detection and response, which also reads alerts from email, cloud and network tools. The EDR agent is installed on each device through unified endpoint management (UEM). It receives lists of known attackers' addresses and files from the threat intelligence platform.