What is EDR?

Endpoint Detection and Response (EDR) is a category of cybersecurity software that continuously monitors endpoint devices – laptops, phones, servers, and IoT devices – for signs of compromise, correlates that telemetry into alerts, and gives security teams the tools to investigate and contain a threat before it spreads.

Key takeaways

• EDR watches endpoints continuously and flags suspicious behavior in real time.
• It aggregates telemetry so teams can investigate and contain threats fast.
• Leading vendors include CrowdStrike, Microsoft Defender, and SentinelOne.
• Versa feeds EDR risk scores into unified entity risk profiles for policy.
• High-risk endpoints can be isolated, blocked, or sent for deeper inspection.

On this page: Why it matters · How it works · Types · EDR & Versa · FAQ

Why is EDR important?

Perimeter defenses like firewalls and antivirus stop known threats at the network edge, but attackers who get past them – through phishing, a stolen credential, or a zero-day exploit – operate freely once they reach an endpoint, unless something is watching from inside. EDR closes that gap: it observes process behavior, file changes, and network connections on the device itself, catching techniques that never trigger a signature-based alert.

The importance shows up in response time. Without endpoint-level visibility, a compromise can dwell for days or weeks before anyone notices unusual data movement or lateral traffic. EDR shortens that window by correlating endpoint telemetry into a single risk picture and giving analysts the tools – isolate the device, kill the process, roll back the change – to act immediately. For organizations moving security into the cloud, EDR data also becomes an input other systems can act on, extending endpoint posture into network and access policy instead of leaving it siloed on the device.

What is EDR?

An EDR platform runs a lightweight agent on each protected endpoint that records process activity, file system changes, registry edits, and network connections, then streams that telemetry to a cloud or on-premises analytics engine. The engine applies behavioral analytics and threat intelligence to the stream, flags anomalies, and assigns the endpoint a risk or threat score.

When EDR detects malicious activity, it does not just alert – it responds. Depending on configuration, that can mean automatically killing a malicious process, quarantining a file, isolating the endpoint from the network, or rolling back changes an attacker made. Analysts also get a searchable history of endpoint events, which turns incident response from guesswork into a timeline: what ran, what it touched, and where it tried to go next.

Types of EDR

EDR is deployed in a few distinct models. Standalone EDR runs as its own agent focused purely on detection and response, typically layered on top of a separate antivirus product. EDR within an EPP suite bundles detection and response into a broader Endpoint Protection Platform that also handles antivirus, device control, and application allowlisting – the more common enterprise pattern today. Managed Detection and Response (MDR) outsources monitoring and triage to a third-party security operations team that watches the EDR telemetry and responds on the customer’s behalf. Extended Detection and Response (XDR) widens the lens further, correlating endpoint data with network, cloud, and identity telemetry into one detection engine rather than treating the endpoint in isolation.

EDR & Versa

Versa does not replace EDR – it consumes it. Through Configure Endpoint Detection and Response, Concerto integrates directly with CrowdStrike, Microsoft Defender, and SentinelOne, polling each vendor’s API at a configurable interval for the endpoint’s risk data.

That EDR signal feeds into a Unified Entity Risk Profile, where an administrator weights it alongside vulnerability-management and behavior-analytics inputs to produce one composite risk score per endpoint, ranging from Trustworthy to High Risk. Versa Advanced Security Cloud calculates that score and distributes it to SASE gateways.

Security and access policies then act on the score directly. As described in Configure Unified Risk Scores, a high-risk or suspicious score can deny a device’s connection to the SASE gateway, trigger additional inspection such as IPS scanning or DLP, or reject non-web private-application access like RDP and SSH – turning endpoint posture into real-time network policy instead of an isolated alert sitting in the EDR console.

Frequently asked questions

What is the difference between EDR and antivirus?

Traditional antivirus matches files against known-malware signatures and blocks what it recognizes. EDR instead watches endpoint behavior continuously, catching techniques – such as living-off-the-land attacks – that never match a signature, and gives analysts tools to investigate and respond after detection.

What is the difference between EDR and XDR?

EDR analyzes telemetry from endpoints alone. XDR (Extended Detection and Response) correlates that endpoint data with network, cloud, and identity telemetry into a single detection engine, trading EDR’s device-level depth for visibility across the whole environment.

Which EDR vendors does Versa integrate with?

Versa Concerto integrates with CrowdStrike, Microsoft Defender, and SentinelOne. Each vendor’s risk data or composite score can be weighted into a Versa Unified Entity Risk Profile and used as an input to secure access and internet protection policy.

What license does EDR integration require in Versa?

Risk scoring, including EDR integration, requires a Versa Secure Private and Internet Access (VSPIA) or Versa Secure Access Fabric (VSAF) Professional license. You also need your own separate license and account with each EDR vendor you connect, such as CrowdStrike or Microsoft Defender.

Can EDR data block network access, not just alert?

Yes. In Versa’s implementation, an endpoint’s EDR-derived risk score can be used as match criteria in secure client-based access and internet protection rules, denying or restricting network access automatically when the score crosses a configured threshold.

More on EDR

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about EDR, these are worth looking at next.