What is EDR (endpoint detection and response)?

An agent on each endpoint streams telemetry — process launches, file activity, network connections, registry changes — to a platform where detection logic and analysts identify malicious patterns, then trigger response actions. The category’s strengths are fleet-wide visibility, historical threat hunting and a deep integration ecosystem; for a staffed SOC, EDR is the backbone of investigation work.

EDR tolerates a window between detection and response, and that window is where encryption finishes and data leaves. Its value also scales with analyst capacity: alert triage is a staffing commitment, not a feature. And because detection runs largely in the vendor cloud, disconnected and sovereignty-constrained environments keep the agent but lose much of the product. These limits are why prevention-first platforms enforced inside the operating system — 1stProtect in the Cyberdis portfolio — are deployed either alongside EDR or in its place for lean teams.