EDR is a modern security platform installed on every endpoint (laptop, server, workstation) that records detailed telemetry — every process started, every file accessed, every network connection made — and uses behavioural analytics to detect attacks that signature-based antivirus misses. When a threat is detected, EDR provides an investigation timeline showing the full attack chain, plus tools to respond (isolate the device, kill processes, quarantine files, roll back changes). EDR is the foundation of modern endpoint security; legacy antivirus is no longer sufficient against ransomware, fileless malware, and AI-assisted attacks.

**Antivirus (AV)** uses signatures and basic heuristics to detect known malicious files — effective against widely distributed malware but bypassed by polymorphism, fileless attacks, and zero-days. **EDR** monitors *behaviour* across the endpoint — what processes run, what they access, what they communicate with — and detects suspicious patterns regardless of the underlying file. EDR also provides forensic visibility (you can investigate 'what happened on this machine in the last 30 days') and response capabilities (isolate, kill, rollback). Modern endpoint protection products combine NGAV (next-gen antivirus) with EDR — sometimes called EPP+EDR or just EDR. Pure signature antivirus is no longer enough for any organisation in 2026.

EDR monitors *only endpoints*. XDR (Extended Detection and Response) extends EDR with telemetry from email, identity (Active Directory, Entra ID, Okta), cloud workloads (AWS, Azure, GCP), SaaS apps, and network traffic, then correlates events across all of them. Practical example: EDR sees a suspicious process on a laptop. XDR sees the same process *plus* the phishing email that delivered it, *plus* the user identity it abused, *plus* the cloud resources it tried to access — and produces one incident instead of four disconnected alerts. XDR is the natural evolution; most organisations starting fresh in 2026 deploy XDR rather than standalone EDR.

EDR follows four steps: (1) **Lightweight agent** installed on every endpoint records process creation, file operations, registry changes, network connections, command-line arguments, parent-child process relationships, (2) **Telemetry sent to cloud backend** for storage and analytics (typically 30-90 days retention), (3) **Detection engine** combines signatures, behaviour rules, machine learning and threat intelligence to spot suspicious patterns — e.g., 'PowerShell spawned by Outlook, downloading from a TLS-fingerprinted C2 domain, then accessing LSASS', (4) **Response actions** triggered manually or automatically: isolate endpoint from network, kill process, quarantine file, block hash globally, roll back changes (some vendors). Tier 1 SOC analysts handle alerts; Tier 2/3 do deeper investigation across the full timeline.

Five market leaders: (1) **CrowdStrike Falcon** — market leader, cloud-native, premium pricing ($60-150/endpoint/year), (2) **Microsoft Defender for Endpoint** — included with M365 E5, very strong on Windows, weaker on Mac/Linux, (3) **SentinelOne Singularity** — autonomous AI-driven response, strong on Linux, (4) **Palo Alto Cortex XDR** — integrates with Palo Alto firewalls, strong network correlation, (5) **Trellix EDR** — formed from McAfee + FireEye. Mid-market: Sophos Intercept X, Bitdefender GravityZone, Trend Micro Vision One, Cybereason. Open-source: Wazuh, OSQuery + Fleet (DIY but viable for technical teams). Selection depends on existing security stack, OS mix, M365 licensing and skill base.

EDR is typically priced per endpoint per year. Common ranges (2026): CrowdStrike Falcon — $60-150/endpoint/year depending on modules; Microsoft Defender for Endpoint — included with M365 E5 ($684/user/year) or $36/user/year standalone; SentinelOne — $40-100/endpoint/year; Sophos Intercept X — $30-60/endpoint/year. Total cost of ownership also includes onboarding (typically 2-4 weeks), tuning, and (for most organisations) a managed EDR/MDR service ($30-80/endpoint/year) for 24/7 triage. For a 500-employee company, expect $30K-150K/year for licences plus optional MDR.

Yes — EDR is no longer optional in 2026. Cyber insurance underwriters increasingly require it (along with MFA, immutable backups, and 24/7 monitoring) as a condition of coverage. Regulatory frameworks (NIS2, DORA, ISO 27001) effectively mandate it through endpoint security requirements. For small organisations (<50 endpoints), Microsoft Defender for Endpoint via Business Premium is the easiest path. For mid-size and larger, the choice depends on existing stack — most go with CrowdStrike, SentinelOne, or Defender. The biggest mistake is deploying EDR without 24/7 monitoring (alert fatigue means real attacks are missed); pair EDR with internal SOC or managed detection and response (MDR).