Cybersecurity Back to glossary
Endpoint Detection and Response
Acronym : EDR
An EDR agent runs on endpoints and servers, continuously watching for suspicious behavior, raising alerts and automatically isolating a compromised machine.
Why it matters
A traditional antivirus detects known signatures; an EDR detects abnormal behavior, making it effective against novel attacks such as ransomware or lateral movement.
Concrete example
A company's EDR detects mass file encryption on a workstation and automatically disconnects it from the network before it can spread.
Related notions
Next-gen antivirusIntrusion detectionIncident response
Related terms
Go further
Related Kaliteq diagnostics
Assess your organization's maturity on this topic
Start the diagnostic