← All glossary terms Glossary

What is Endpoint Detection and Response (EDR)?

Security software on laptops, servers, and workstations that detects and stops attacks attackers run on the device itself.

Endpoint Detection and Response (EDR) is a category of security software that goes well beyond traditional antivirus. EDR watches what processes are running, what files are being created, what network connections are made, and what behavioural patterns those add up to — flagging or stopping activity that looks like ransomware, credential theft, or living-off-the-land techniques. EDR is the foundation most MDR services are built on, and it has effectively replaced standalone antivirus for organizations that take security seriously.