EDR (endpoint detection and response)

Security software that continuously monitors computers and servers for suspicious behaviour, alerts on likely attacks and lets responders isolate or fix affected devices.

Endpoint detection and response goes further than traditional antivirus. Instead of only checking files against a list of known threats, EDR records activity on each device, such as which programs start, which files change and which network connections are made, and looks for patterns that suggest an attack. When something suspicious happens, it can alert a security team, stop the process and isolate the device from the network.

Modern attacks often use legitimate tools or stolen credentials that basic antivirus will not catch. EDR gives a much better chance of spotting ransomware early, before it spreads. Many cyber insurers now ask whether EDR is deployed. However, EDR produces alerts that someone must review and act on, which is difficult for a small business without dedicated security staff.

Practical tip: pair EDR with a monitoring service, often called managed detection and response (MDR), so that alerts are reviewed around the clock, including evenings and weekends when many attacks are launched.