Antivirus asks one question about every file: have I seen this before? For a long time that was enough. Modern attacks increasingly avoid files altogether, using the tools already on your computers, and that is the gap endpoint detection and response was built to close.
EDR watches what happens on each device, keeps a record of it, and gives a responder the controls to investigate and stop an attack in progress. This guide explains how it differs from antivirus, what it catches that antivirus misses, and the part that decides whether it works at all.
What EDR Does That Antivirus Does Not
| Traditional antivirus | EDR | |
|---|---|---|
| How it detects | Known malicious files and patterns | Suspicious behaviour, plus known threats |
| What it remembers | Little beyond the detection itself | A timeline of processes, connections and changes |
| What you can do | Quarantine or delete a file | Isolate a device, kill processes, investigate remotely |
| Attacks using built-in tools | Usually invisible | Detected by the pattern of activity |
| After an incident | Hard to tell what happened | Evidence of how they got in and what they touched |
The Attacks That Walk Past Antivirus
Scripts running in memory
Attackers run PowerShell or other scripting directly in memory, so there is no malicious file to scan. EDR spots the unusual behaviour, such as a document spawning a script that reaches out to the internet.
Legitimate tools used badly
Remote access software, admin utilities and system tools are all legitimate, so antivirus lets them run. EDR flags when they are used in ways that do not fit how your business normally works.
Passwords pulled from memory
Tools that harvest passwords and tokens from a running system are a standard step before an attacker spreads. EDR is designed to detect that access pattern and block it.
Security switched off first
Ransomware operators commonly try to disable security tools before encrypting anything. EDR protects itself against tampering and alerts when someone tries.
Somebody Has to Answer the Alert
This is the part of the EDR conversation that software vendors tend to skip. EDR produces alerts. Some are serious, most are not, and the serious ones rarely arrive during business hours. A tool that detects an attack at 2 a.m. on a Saturday and waits until Monday for someone to read the alert has not stopped anything.
So the real decision is not which EDR product to buy but who watches it. A business with its own security team can run it in-house. Most small and mid-sized businesses cannot staff that around the clock, which is why EDR is usually paired with a monitoring service.
Our 24/7 monitoring service puts analysts behind the EDR so alerts are triaged and contained at any hour, and it is part of the Advanced Shield platform we run for clients.
What Insurers and Auditors Now Ask
EDR has moved from nice-to-have to expected. Cyber insurance applications commonly ask whether it is deployed on all endpoints and servers, alongside MFA and tested backups, and the answer affects both eligibility and premium. Our guide to cyber insurance IT requirements covers the full list.
Security frameworks and customer questionnaires ask the same thing in different words: can you detect malicious activity on your endpoints, and can you respond to it? EDR with defined response procedures is the most direct way to answer yes. If you already pay for Microsoft 365 Business Premium, check your Microsoft 365 security setup first, because the EDR capability may already be licensed and simply not configured.
A quick check worth doing: count your endpoints, then count the devices actually reporting into your security console. The gap between those two numbers is usually where an attacker would start.
Rolling It Out Without Breaking Things
- Count every device. Laptops, desktops and servers, including the machines nobody remembers. EDR only protects what it is installed on.
- Start in audit mode. Deploy in a detect-only setting first so you can see what it would block before it blocks anything.
- Tune for your applications. Line-of-business software sometimes behaves in ways that look suspicious. Add specific, documented exclusions rather than broad ones.
- Remove the old antivirus. Running two products causes conflicts and slowdowns. Replace, do not stack.
- Write the isolation runbook. Decide in advance who can isolate a device, when, and how the user keeps working while it is investigated.
EDR Questions, Answered
Related reading: Dark Web Monitoring for Business · Penetration Testing Cost · Windows 10 After October 2026
Want to Know What Your Endpoints Can See?
We review what is protecting each device today, whether your existing licences already include EDR, and who would answer an alert at 2 a.m. Then we give you a plain recommendation.