What is endpoint detection and response (EDR)?
Endpoint detection and response (EDR) is a security tool that continuously monitors laptops, servers, and other endpoints to detect, investigate, and respond to threats. In plain terms, it keeps a running record of what happens on each device so your team can spot an attack, understand how it unfolded, and shut it down.
Gartner analyst Anton Chuvakin coined the term in 2013. An endpoint is any device that connects to your network and can run code, from a workstation to a cloud server. The agent on that device streams telemetry, the raw activity data about processes, files, and connections, back to a central platform.
Here is where EDR parts ways with prevention-only tools. Antivirus tries to block known bad files at the door and then moves on. EDR assumes that some threats will get past the door, so it stays focused on what an attacker does once inside. That shift matters because it shortens dwell time, the stretch of hours or days an intruder can lurk undetected before anyone notices.
The 2026 Cloud Threat Report
See the attacker techniques shaping cloud detection and response this year, with data pulled straight from real incidents
How does EDR work?
EDR runs as a loop with four stages that feed into each other. Think of it as collect, detect, investigate, and respond, repeated continuously.
First comes continuous data collection. A lightweight endpoint agent records the things attackers touch: running processes, file changes, registry edits, and network connections. All of that telemetry flows to a central platform where it can be searched and compared.
Next is detection. Behavioral analytics and machine learning compare live activity against normal patterns and known attacker techniques. This is where indicators of attack (IOA) and indicators of compromise (IOC) come in. An IOC is forensic evidence that a breach already happened, such as a known malicious file hash. An IOA is a sign of intent in motion, like a document that suddenly spawns a scripting tool, which lets the system catch an attack as it plays out rather than after the damage.
Then the investigation stage kicks in. Because every action was recorded, analysts or automation can rewind and rebuild the attack timeline step by step. People sometimes call this a DVR for the endpoint, since you can replay exactly what happened and when.
Finally, the response stage contains the threat. A responder can isolate the affected host from the network, kill malicious processes, roll back changes, and quarantine files. Many platforms tie these actions into SOAR (security orchestration, automation, and response) so routine steps run automatically and cut response time.
Core capabilities of EDR
Most EDR platforms share a common set of capabilities, even if the names differ between vendors. The list below covers the features that actually do the work.
Endpoint visibility: continuous telemetry from every protected device, so nothing an attacker does goes unrecorded.
Behavioral detection: analytics that flag suspicious activity by how it behaves, not just by matching a known signature.
Threat intelligence: external feeds of the latest known attacker tools and infrastructure, used to enrich and confirm alerts.
MITRE ATT&CK mapping: alerts tied to a shared catalog of real attacker techniques, which helps analysts understand what stage an attack has reached.
Guided investigation: forensics tools that reconstruct the timeline and show the full chain of events behind an alert.
Automated response: one-click or rule-based actions that isolate hosts, kill processes, and quarantine files without waiting on manual steps.
Threat hunting: the ability to search historical telemetry proactively, so analysts can find quiet threats that never tripped an alert.
Top Endpoint Detection and Response (EDR) Tools
Endpoint detection and response tools compared: see the top EDR platforms, how to evaluate them, and where cloud detection and response fills the gaps.
もっと読む
Why EDR matters
Endpoints are where most attacks begin. A single employee laptop or exposed server is often the first foothold an attacker needs, which is why detection on those devices carries so much weight. Signature-based antivirus alone cannot keep up, because it only recognizes threats it has seen before.
Consider a common scenario. An employee opens what looks like a routine invoice attached to a phishing email. The file carries no obvious malware, so antivirus waves it through. Instead, it launches a hidden PowerShell command that runs entirely in memory and quietly reaches out to an attacker-controlled server.
This is a fileless attack, and it leans on living-off-the-land techniques, meaning the attacker abuses trusted tools already on the machine rather than dropping a suspicious file. Signature-based detection sees nothing wrong. EDR, watching behavior, notices that a document just spawned a scripting engine making outbound calls, flags it, and gives the team a chance to cut off the intruder before lateral movement spreads the compromise to other systems.
Speed is the other reason this matters. The longer an attacker stays hidden, the more damage they do, and according to the IBM Cost of a Data Breach Report, the average breach still took 241 days to identify and contain in 2025. Many teams also face alert fatigue from a flood of low-value warnings, which helps explain why 58% of organizations run more than 25 security tools according to the Wiz 2026 CISO Budget Benchmark Report, driving buyers toward consolidated, context-rich platforms instead of a sprawling stack.
Watch 5-min demo
See how cloud-native detection, investigation, and one-click response come together in a short guided walkthrough.
EDR vs. antivirus, EPP, XDR, and MDR
EDR sits inside a crowded family of security acronyms, and the differences are easy to blur. The table below lays out how each one relates to EDR, including cloud detection and response (CDR), which extends the same idea into cloud infrastructure.
| Approach | Primary focus | Typical use case | Relationship to EDR |
|---|---|---|---|
| Antivirus / NGAV | Blocking known and, for next-generation antivirus (NGAV), suspected malicious files before they run | First-line prevention on individual devices | Stops threats at the door; EDR handles what gets past it |
| EPP | A broad endpoint protection platform (EPP) that bundles prevention features like antivirus, firewall, and device control | Baseline protection across a fleet of endpoints | Often packaged with EDR, with EPP preventing and EDR detecting and responding |
| EDR | Detecting, investigating, and responding to threats on endpoints | Catching and containing attacks that evade prevention | The baseline this table compares against |
| XDR | Extending detection and response across endpoints, network, email, and identity | Correlating signals from many layers in one place | Broadens EDR beyond the endpoint into other data sources |
| MDR | A managed detection and response (MDR) service where outside experts run detection and response for you | Teams that lack the staff to operate tools around the clock | Outsourced operation of EDR and related tools, sometimes called managed EDR (mEDR) |
| CDR | Detecting and responding to threats across cloud workloads, containers, serverless architectures, and the cloud control plane | Protecting cloud-native and multi-cloud environments | Complements EDR by covering the cloud control plane, serverless, and runtime layers, and adding cloud, identity, and data context to workload detections |
Common EDR use cases
EDR earns its keep in a handful of day-to-day situations. These examples show where teams reach for it most.
Ransomware containment: catching the encryption behavior early, isolating the host, and rolling back changed files before damage spreads.
Stopping lateral movement: spotting an attacker who jumps from one machine to the next and cutting that path off at the source.
Catching fileless attacks: flagging living-off-the-land techniques that abuse trusted tools and leave no file for antivirus to scan.
Investigating a compromised laptop: replaying the recorded timeline to see what an attacker opened, ran, and reached during an incident response effort.
Collecting forensic evidence: preserving process trees, file changes, and other forensic artifacts that explain root cause and support containment.
What is AI Detection and Response (AIDR)?
AI detection and response (AIDR) is a security capability that monitors your AI systems, prompts, agents, models, and the data pipelines feeding them, then acts when something goes wrong.
もっと読む
How cloud environments change detection and response
EDR was purpose-built for persistent, user-facing devices like laptops and physical servers that stay online for months, and it fits those devices well. Cloud environments are built on a different architecture. Four realities explain how detection and response work there, and why cloud workloads call for an approach that complements EDR.
The first reality is hostless services. Serverless platforms like AWS Lambda and Google Cloud Run, along with managed container services like AWS Fargate, run with no host operating system for you to manage, so detection works through cloud telemetry rather than an on-host agent.
The second reality is dynamic, ephemeral lifecycles. Containers start and stop in seconds and Kubernetes nodes scale up and down on demand, so coverage needs to apply the moment a workload appears rather than waiting for an agent to deploy.
The third reality is the cloud control plane. Many cloud threats target IAM permissions, cloud APIs, and resource configurations rather than host binaries, so detection reads cloud provider activity such as IAM privilege escalation, API calls, and security group changes.
The fourth reality is multi-layered risk context. Judging a workload threat accurately means weighing it alongside network exposure, identity permissions, and sensitive data access, so each alert can be ranked by real impact rather than viewed on its own.
This is where cloud detection and response (CDR) fits in. Regulatory guidance like CISA's #StopRansomware guide encourages extending detection and response to cloud-based resources, and CDR does that natively. It sits alongside endpoint EDR so each covers its own domain: EDR handles persistent user devices, and CDR brings the cloud context, control-plane visibility, and attack-path analysis suited to cloud workloads.
How Wiz Defend complements EDR across cloud, AI, and runtime
EDR stays essential. If someone phishes an employee or drops malware on a laptop, a good endpoint agent is still your fastest path to catching it and shutting it down. The goal is not to replace that, it is to cover the cloud layers an endpoint agent was never built to see.
Wiz Defend brings detection and response to the cloud, and it does not stop there. The same platform delivers runtime threat detection across containers, virtual machines, serverless, and Windows and Linux hosts, extends runtime protection to on-premises and hybrid workloads, and watches AI services and models as they run. Cloud detection and response (CDR) is one thing Wiz Defend does well, not the limit of what it covers.
Two engines work together. Agentless scanning gives instant, cloud-wide visibility and snapshot risk assessment, and a lightweight, eBPF-based runtime sensor adds real-time runtime threat detection for live workloads without disrupting the kernel.
Wiz is also built to sit alongside the endpoint EDR you already run. It runs agent gap analysis, automatically finding workloads that are missing your endpoint agent so your team can close coverage gaps, and it keeps cloud, AI, and runtime detections in one place rather than scattered across tools.
The Wiz Security Graph ties those runtime detections to cloud exposure, identity permissions, and sensitive data paths, so an isolated alert becomes a full attack-path story with a clear blast radius. Because Wiz traces a detection back to the original container image and source repository that created a resource, teams also get code-to-cloud context on how a threat started.
That lines up with the decision many teams face: keep EDR for user devices, and let one platform handle detection and response across cloud, AI, runtime, and on-premises workloads. Get a demo to see how agentless coverage, a runtime sensor, and graph context connect activity across your whole environment.
See Wiz Defend in action
Watch how agentless cloud coverage, Security Graph context, and attack-path prioritization work together to speed up investigation and response. Get a demo
