Devices and protection
Why antivirus became EDR
Antivirus checks files against a list of known threats. Attackers learned to get in without bringing anything that is on the list.
1 min readExplainer
The short version
Antivirus looks for known bad files. Most attackers no longer bring one, so protection had to start watching behavior.
What actually happens
Attackers today usually sign in with a stolen password, or talk someone into installing ordinary remote-access software. Nothing they use is a virus, so a list of known threats has nothing to catch.
Endpoint detection and response (EDR) watches what happens on the device instead: a program encrypting hundreds of files, a new administrator account created at 2 a.m., a remote-access tool nobody approved. When it sees something like that, it can stop the program and cut the computer off from the network.
The response half matters as much as the detection. An alert that nobody reads until Monday only tells you what already happened. EDR works when people are watching the alerts and act on them.
What you can do today
- Ask whether your protection only scans files, or also watches behavior and can isolate a device.
- Find out who receives security alerts, and what happens to one that arrives at night or on a weekend.
- Tell staff to start remote support sessions only from a link they already know, such as the button on your IT provider’s own website.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.