StarLabs Glossary / Cybersecurity & Network Terms
EDR (Endpoint Detection & Response)
Security software that watches what your computers do, not just what files they hold.
Endpoint detection and response (EDR) is security software installed on laptops, desktops and servers that continuously records activity, spots suspicious behaviour such as files being mass-encrypted or unusual programs launching, and lets an administrator isolate the device, stop the process and investigate what happened, often automatically.
How it works
Traditional antivirus compares files against a list of known bad software. That works for common malware but struggles with new threats and with attackers who use legitimate tools already on your computer, such as PowerShell or remote desktop software. EDR looks at behaviour instead. It asks, “Is this normal for this machine?”
A typical EDR product does four things:
- Records. A small agent on each device logs processes, file changes, network connections and logins, and sends them to a cloud console.
- Detects. Rules and machine learning flag patterns linked to attacks, such as a Word document launching a script, or hundreds of files being renamed in seconds.
- Responds. It can kill the process, quarantine files, or cut the device off the network while still letting administrators reach it.
- Investigates. The console shows a timeline of how the attack started and what it touched, which helps you decide whether data was exposed.
| Antivirus | EDR | |
|---|---|---|
| Main method | Matches known malware signatures | Watches behaviour across the device |
| New or “fileless” attacks | Often missed | More likely to be caught |
| Response options | Delete or quarantine a file | Isolate device, stop processes, roll back some changes |
| Who reviews alerts | Usually nobody | Needs a person or service to act on alerts |
That last row matters. EDR produces alerts, and alerts are only useful if someone reads them. Larger firms pair EDR with a security team or a managed detection and response (MDR) service that watches the console around the clock. XDR (extended detection and response) is a related term for products that also pull in email, identity and network data.
What it means for your business
If your business holds customer data, runs on a few shared servers or would grind to a halt after a ransomware attack, EDR is worth considering over basic antivirus. Some Microsoft 365 business plans include endpoint protection features, so check what you already pay for before buying more. The key question is who will respond to an alert at 2am. StarLabs can help you choose a sensible setup, deploy it to every device and keep it monitored as part of a managed IT plan.
Common questions
Do I still need antivirus if I have EDR?
Most EDR products include antivirus-style protection, so you normally run one product, not two. Running two security agents side by side can cause conflicts and slow devices down.
Is EDR too much for a small business?
Not necessarily. Many EDR products are priced per device and suit small fleets. The bigger cost is having someone review alerts, which is why many SMEs get it as part of a managed service.
What is the difference between EDR, MDR and XDR?
EDR is the software on your devices. MDR is a service where people monitor and respond for you. XDR extends detection beyond devices to email, identity and network sources.
Is basic antivirus still your only defence?
Talk to StarLabs about endpoint protection that someone actually watches.
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
