Antivirus asks one question: is this file on the list of known bad files? For years that was enough. It isn’t now, because most serious attacks don’t need a bad file at all. An attacker signs in with a stolen password, opens PowerShell, installs a normal remote-access tool and moves from machine to machine using software that is already on them. Antivirus has nothing to match.
Endpoint detection and response (EDR) was built for that gap. This guide explains what EDR is, how it works on a real attack, and what to check before you choose one.
What is EDR?
EDR is software that runs on each laptop, desktop and server (the “endpoints”). It does three jobs:
- Records what happens on the machine: which programs start, what started them, which files and settings they touch, and where they connect.
- Detects behaviour that looks like an attack, even when every file involved is legitimate.
- Responds on the machine itself: stops a process, quarantines a file, or cuts the machine off the network so an attack can’t spread.
The short version: antivirus checks what a file is. EDR watches what a program does.
Why antivirus alone misses hands-on attacks
A “hands-on-keyboard” attack is one where a person, not just malware, is driving. They tend to use tools that are already trusted:
- PowerShell and command-line scripts that every Windows machine has.
- Remote-access and admin tools that IT teams use every day.
- Stolen sign-ins, so every action looks like a real employee. (We cover how that happens in token theft in Microsoft 365.)
None of these is a “bad file”. What gives them away is the pattern: Word starting a command prompt, a remote-access tool installed at 2 am that nobody on the team uses, hundreds of files renamed in a minute. Only a tool that watches behaviour sees that pattern.
EDR still needs someone watching
EDR is not “set and forget”. It produces alerts, and alerts only help if someone acts on them.
CISA’s advisory AA25-266A (September 2025) describes a US federal agency where attackers stayed inside the network for three weeks before they were found. The agency’s EDR did raise alerts about the activity. They weren’t being reviewed continuously, so nobody acted on them in time. CISA’s #StopRansomware guidance recommends EDR on all assets, and this case shows the second half of the job: someone, or something, has to read the alerts.
That’s the difference between EDR and MDR (managed detection and response), where a team watches the alerts for you. We compare the two in EDR vs. MDR for small business.
A worked example: one phishing attachment
Here’s how a common attack looks from the endpoint, and what EDR does at each step.
Example: an accounts clerk at a 40-person firm (made up for illustration).
| What happens on the laptop | What antivirus sees | What EDR sees |
|---|---|---|
| The clerk opens an invoice document from an email | A normal Word file | Word starts |
| Word starts a command prompt, which starts PowerShell | Nothing (both are Windows tools) | A family tree no document should have |
| PowerShell downloads a file from a site registered last week | Maybe, if the file is already known | A script reaching out to a brand-new site |
| A remote-access tool is installed and connects out | A legitimate, signed program | A remote tool nobody on the team uses, installed by a script |
| Files on a shared drive start being renamed in bulk | Possibly, once it’s too late | Ransomware behaviour; stop the process |
Antivirus might catch one step, if the file is already on its list. EDR sees the whole chain, from the document to the download to the remote tool, and can stop it at the second step instead of the fifth.
What a good EDR records
The value of EDR comes from what it records. Look for:
- Every program with its family tree: what started it, and what it started.
- Scripts and PowerShell, not just program files.
- Sensitive files and settings: startup entries, scheduled tasks, security settings.
- Network connections from each program.
- Event logs, services and USB devices.
- What your existing antivirus found, so you have one view instead of two.
What EDR does when it finds something
Response actions usually fall into three groups:
- Stop the program. End the process before it does more damage.
- Quarantine the file, so it can’t run again.
- Isolate the machine: cut it off the network while keeping the EDR connected, so the attack can’t spread and you can still investigate.
Isolation is disruptive (the person can’t work), so good tools let you decide when it happens automatically and when a technician has to approve it.
What to check before you choose an EDR
- Does it work beside Microsoft Defender? Most Windows machines already run Defender. An EDR that fights it, or makes you remove it, adds work.
- Does it cover Windows and Mac? Many small firms have both.
- Who reads the alerts? If the answer is “us, when we have time”, plan for that now. See the three-week CISA case above.
- Can you set response rules per client or per time of day? After-hours isolation is often fine; during a payroll run it may not be.
- Does it link an endpoint alert to the account behind it? Many attacks start with a stolen sign-in, not a file. EDR sees the laptop; identity tools see the account. We explain the split in ITDR vs. EDR.
EDR and ransomware
Ransomware is the attack EDR is most often bought for, because the warning signs show up on endpoints before the encryption starts: new remote tools, disabled backups, security settings switched off. Our guide on how to protect your business from ransomware covers the other layers you need alongside it.
How Centeye Ironwatch does EDR
Centeye Ironwatch is EDR for Windows and Mac that works beside Microsoft Defender.
- What it records: every program with its family tree, scripts and PowerShell, sensitive files and settings, network connections, event logs, services and USB devices, plus Defender’s detections and settings, and a heartbeat so you know each machine is still reporting.
- How it detects: live threat intelligence, a learned picture of what’s normal for each client, how rare a program is across the machines you manage, and risk that adds up per machine, so a chain of small oddities still gets noticed.
- What it does: with evidence behind it, it stops the program, quarantines the file and cuts the machine off the network, either when a technician approves or as you’ve set it up for after hours.
New to the terms? See EDR in our glossary, or browse the full security glossary.