The shortcomings of “legacy AV” have become all too apparent as the sophistication and prevalence of malware has grown in the last decade. The process of scanning files in and out of the system against a known list of virus signatures is old hat. The legacy vendors simply can’t keep up, so they have tried to bolster their products with tools like behaviour monitoring and predictive machine learning – renaming Antivirus to Endpoint Protection.

In contrast, EDR focuses on collecting endpoint data and examining it for malicious or anomalous patterns in real-time. As the name implies, EDR’s job is to detect an infection and initiate a response as quickly as possible. EDR will block malicious files, but more importantly EDR recognises that not all modern attacks are file-based. 

EDR gives deep visibility into what file modifications, process creations and network connections have occurred on the endpoint: vital for threat hunting, incident response and digital forensics. This is essential for the SOC team.