Traditional antivirus compares files with a list of known threats. EDR also watches behaviour: a program that suddenly starts encrypting hundreds of files, a remote-access tool installed at 2 am, a script launched from an email attachment.
When it sees something wrong, EDR can respond on the machine itself: stop the process, quarantine the file or cut the machine off the network so the attack cannot spread.
EDR produces alerts that someone has to look at. That is the gap MDR and AI-assisted operations try to close.
How Centeye handles it
Centeye Ironwatch is a lightweight agent for Windows and Mac that runs beside Microsoft Defender. It can stop a ransomware process, and with your approval it can also cut a machine off the network.
Ironwatch: endpoint protection →Go deeper: EDR vs. MDR