EDR and XDR: Endpoint Detection, Explained
The move from antivirus to EDR is the move from nouns to verbs. Antivirus inspected files and asked whether each matched a known-bad signature — a model that fails the instant an attacker changes a byte or brings no file at all. Endpoint Detection and Response watches behaviour: the sequence of processes, network calls, and system changes on a host, and whether that sequence looks like an attack. That is why EDR catches the fileless intrusion that sailed past the scanner.
An EDR agent instruments the endpoint deeply — process creation, command lines, file and registry writes, network connections, module loads — and streams that telemetry to a platform that both applies detections and retains the raw events. Two capabilities matter equally: detection (spotting the malicious pattern in real time) and response (isolating the host, killing a process, rolling back a change). The second is why it is not just "antivirus that logs more."
Why behaviour beats signatures
Modern intrusions increasingly use no malicious file at all. They abuse tools already on the box — PowerShell, WMI, legitimate signed binaries — in a technique broadly called living off the land. There is no file to match because the attacker is driving your own administrative tooling against you. Signatures are blind to this by construction. Behavioural detection sees it: a script interpreter spawning from an office document, then reaching out to the internet, then touching credential stores is a story, and the story is what gives it away.
Where XDR fits
XDR extends the same idea beyond the endpoint, correlating endpoint telemetry with identity, email, network, and cloud signals so a single intrusion is seen as one story rather than five disconnected alerts. The promise is real — an attack that touches a phishing email, an identity, and three hosts should be one incident, not four tools each seeing a fragment. The caveat is equally real: XDR inherits the correlation and tuning problems of a SIEM, and a poorly-tuned XDR is just a bigger alert firehose.
- Deployment coverage is the whole game. An EDR on 80% of endpoints means the attacker lands on the other 20%. The unmanaged laptop, the forgotten server, the contractor’s machine — that’s where the foothold goes.
- Keep response actions ready and rehearsed. Host isolation and process termination are the difference between containing an intrusion in seconds and writing about it later. Know who can trigger them and how fast.
- Retain the raw telemetry. When you find an intrusion, the first question is ‘how long, and where else?’ Rich endpoint history is what lets you scope the breach instead of guessing.
- Tune to your environment. Every estate has benign software that looks alarming. Untuned EDR drowns analysts; tuned EDR surfaces the handful of behaviours that are genuinely anomalous for you.
- Ask what percentage of your endpoints — including servers, contractor machines, and that one legacy box — actually run the agent and report in. The gap between ‘licensed’ and ‘reporting’ is your real coverage, and it’s usually a surprise.
- Run a benign but unusual action on a test host — a script spawning from a document, say — and confirm the EDR both records it and surfaces it. If nothing appears, the sensor or the detection isn’t doing what you think.
Proving coverage is complete, response actions work under pressure, and behavioural detections fire on realistic technique — not just demo malware — is what our assessment validates against your live fleet.
EDR changed the economics of endpoint compromise by attacking the one thing an intruder cannot avoid — acting. But the platform only sees the hosts it is installed on, only catches the behaviours someone tuned it to catch, and only contains what your team is ready to contain. The technology is mature; the coverage and the operating discipline are where programs still fall short. You cannot detect an intrusion on an endpoint you did not know you had.