What Is Endpoint Detection and Response (EDR)?

Definition

Endpoint detection and response (EDR) is security software installed on laptops, desktops, and servers that records what programs do, flags suspicious behavior, and lets a responder isolate the device or stop a process remotely. Unlike traditional antivirus, which mainly matches known malware, EDR watches behavior and keeps a history for investigation.

How It Works

An EDR agent runs on each endpoint and streams activity to a central console:

Telemetry: process launches, command lines, network connections, file changes, and sign-ins.
Detection: rules and behavioral models flag patterns such as a word processor launching PowerShell, credential dumping, or mass file encryption.
Response: an analyst, or an automatic rule, can kill a process, quarantine a file, or cut the device off the network while keeping the console connection.
Investigation: recorded history shows what happened before and after an alert.

The joint FBI and CISA advisory on Akira ransomware calls EDR tools "particularly useful for detecting lateral connections" between machines. It also warns that "Akira threat actors uninstall EDR systems to evade endpoint detection." That is why tamper protection, and an alert when an agent goes silent, matter as much as the agent itself.

EDR has three limits. It only sees devices where it is installed. It can be evaded by attackers who avoid known-bad behavior. And its alerts are useless unless someone reviews them. Managed detection and response (MDR) services exist to supply that someone.

Real-World Example

In a CISA red team assessment of a critical infrastructure organization, published in November 2024 as advisory AA24-326A, the organization's "EDR solutions largely failed to protect" it. EDR "detected only a few" of the red team's payloads, and when it did block the initial phishing payload, it "generated an alert that network defenders neither read nor responded to." A legacy environment had no EDR at all, so the team persisted there "for several months" undetected. CISA's finding: the organization "relied too heavily" on EDR without network-layer protections.

Why It Matters for a Small Business

The same advisory says Akira actors "primarily target small- and medium-sized businesses." Attackers like these often get in with stolen credentials or remote access, then move from machine to machine before launching ransomware. EDR is one of the few tools that can see that movement on the endpoint and stop it before it spreads. It also gives an investigator a record of what happened, which helps scope an incident. But buying EDR is not the same as being protected. An alert at 2 a.m. on a Saturday needs a person to act on it, and every device, including the old server in the closet, needs coverage. If your insurer's security questionnaire asks about EDR, the honest answer depends on all of that.

How to Spot It / How DTS Handles It

Gaps to check: laptops, servers, or old machines without an agent, agents that stopped reporting, tamper protection off, alerts landing in an inbox nobody watches, and no one able to isolate a machine after hours.

DTS can help with rolling out and monitoring EDR across your devices, alerting when an agent goes quiet, with detections running automatically and a person reviewing the alerts. See our managed IT service.

Related Terms

Malware scanning: signature-based detection that EDR builds on.
XDR: detection extended beyond endpoints.
MDR: a service that watches EDR alerts for you.
SIEM: central log analysis that EDR feeds.
Alert fatigue: why alerts go unread.
Ransomware: the attack EDR most often interrupts.
Containment: isolating a device is a containment step.

Sources

CISA, Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a US Critical Infrastructure Sector Organization, AA24-326A (November 21, 2024): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-326a
FBI, CISA, et al., #StopRansomware: Akira Ransomware, AA24-109A (updated November 13, 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a

Last updated October 14, 2026.