Traditional antivirus (AV) products work on the premis of ‘signature based’ protection. Every malware has its own unique signature which is added to the list the AV searches through to decide if a file is malicious. There are a number of problems with this approach. Firstly, attackers are coming up with malware with unique signatures faster than AV companies can add them to their AV software. Secondly, attackers are becoming more sophisticated so that malware can evade AV altogether; for example with fileless attacks or polymorphic malware where the malware can add bytes to itself so it no longer fits the signature held on file of the AV.

EDR (Managed Endpoint Detection and Response) has a much more sophisticated method of protecting endpoints with the best EDR solutions incorporating an element of artificial intelligence and analysis of the behaviour of the malware rather than relying on slow scanning for a signature. This is an effective EDR approach because there are an insurmountable number of ways malware can look, but a much smaller number of ways malware behaves.

Your traditional AV is focussed on protecting endpoints, usually a PC, and that’s it. Managed Endpoint Detection and Response services (EDR) go much further than this and allows visibility on alerts and user inputs and a through investigation on the origin of an attack. It’s kind of like comparing the Nokia 3310 to an iphone.

Endpoint Security and Response (EDR) can be thought of as a data recorder for your endpoints which gives alerts when something bad has potentially happened. You then have the ability to do something about that alert, for example, by isolating that machine for remediation.  Some EDRs have been criticized for the tsunami of data they generate; requiring a skilled EDR analyst to monitor the alerts and take action. Our Endpoint Detection and Response (EDR) service allows data to be proactively put in context, so data is autonomously correlated allowing the full story of what happened in an attack to be stitched together.