EDR
Endpoint Detection and Response
A system that keeps watch over computers and smartphones, catching and responding to suspicious activity like viruses.
In Simple Terms
EDR is a system that continuously monitors what's happening inside devices like computers and smartphones, aiming to stop damage from spreading if a virus or other threat gets in. While traditional security tools focus on keeping viruses out in the first place, EDR is built to quickly catch what happens after something has already slipped through. When it spots suspicious activity, it alerts an administrator and can automatically isolate the infected device from the network, among other responses.
Behind the Name
EDR stands for "Endpoint Detection and Response." An "endpoint" refers to devices like computers and smartphones, combined with "detection" and "response." Put the pieces together, and the name spells out exactly what the system does: it detects suspicious activity happening on a device and responds to it.
Take a Closer Look!
EDR is a security system that monitors what happens inside devices like computers and smartphones after a virus or other threat has gotten in, with the goal of keeping the damage to a minimum.
As more and more devices connect to the internet, blocking 100% of viruses has become difficult, so EDR is used as a safety net that assumes some threats will get through.
Broadly speaking, EDR keeps a record of everything happening inside a device.
For example, it quickly flags suspicious behavior such as files being altered without permission or data being sent to an unfamiliar destination.
If something abnormal is detected, it can isolate that device from the network, preventing the threat from spreading to other devices.
Put simply, if a traditional security product plays the role of "locking the front door to keep burglars out," EDR plays the role of "installing security cameras inside the house so that if a burglar does get in, someone is watching and can respond right away."
Combining products that prevent intrusions with EDR, which limits the damage after an intrusion, creates a stronger, layered security environment.