Endpoint Detection and Response Explainer
Endpoint detection and response, often called EDR, is security software that watches activity on laptops, desktops, servers, and other devices. It collects signals such as program launches, file changes, network connections, and sign-in activity so unusual behavior can be investigated.
EDR looks for patterns that can suggest an attack, including suspicious processes, repeated failed sign-ins, unexpected changes to security settings, or a program trying to move between systems. It compares these signals with known threats and with normal activity for that device or organization.
When it detects a concern, the system can alert security staff and provide a timeline of what happened. Depending on its configuration, it may also isolate a device from the network, stop a harmful process, or collect files for review.
EDR is one layer of protection rather than a complete answer on its own. It works best alongside software updates, strong account controls, backups, and clear response procedures.
EDR is endpoint security software that records and analyzes device activity so suspicious behavior can be detected, investigated, and sometimes contained.
It can watch processes, files, logins, network connections, and security-setting changes. The goal is to recognize patterns that deserve attention rather than treat every event as an attack.
Configured systems can alert responders, isolate a device, stop a process, and preserve useful evidence. Those actions should be guided by an organization’s response plan.
Explore more "Explainers"
Discover additional explainers across politics, science, business, technology, and other fields. Each explainer breaks down a complex idea into clear, everyday language—helping you better understand how major concepts, systems, and debates shape the world around us.