What is endpoint detection and response (EDR), and how is it different from antivirus software?

Endpoint detection and response is an advanced security capability that continuously monitors endpoint activity, detects suspicious behavior in real time and enables rapid investigation and containment when a threat is identified. Traditional antivirus software relies primarily on known threat signatures, so that it catches what it recognizes. EDR uses behavioral analysis and telemetry to detect previously unseen threats, including fileless attacks, living-off-the-land techniques and advanced persistent threats. For businesses facing modern threats, EDR is a significant upgrade over signature-based antivirus alone.