What is: EDR (Endpoint Detection & Response)

EDR is software that continuously monitors every computer and server, detects suspicious behaviour and automatically isolates the device before an attack spreads.

Unlike classic antivirus that looks for known virus "signatures", EDR watches behaviour: what runs, what connects, what changes. That way it catches new, unknown threats such as ransomware it has never seen before.

When it spots something suspicious, it can isolate the device from the network, stop the process and alert the security team, buying valuable time.