Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) is a cybersecurity technology category that continuously monitors endpoint devices such as laptops, servers, and mobile devices for suspicious activities, using behavioral analytics, machine learning, and threat intelligence to detect advanced threats like…

Key facts

First appeared: 2013
Category: technology
Problem solved: EDR addresses the limitations of traditional antivirus solutions, which relied on static signatures and failed to detect unknown zero-day threats, advanced persistent threats (APTs), or stealthy behaviors; it provides continuous behavioral monitoring, real-time visibility, automated response, and forensic analysis to contain attacks before they spread across networks.[1][2][3]
Platforms: Linux, Windows, IoT devices, Servers, macOS, Virtual machines, Cloud workloads

Related technologies

XDR platforms
endpoint protection platforms (EPP)
threat intelligence feeds
SIEM systems

Notable users

Sophos
CrowdStrike
Cisco
IBM
Fortune 500 enterprises
Microsoft