EDR

What is EDR?

EDR (Endpoint Detection and Response) is security software that continuously records behaviour on endpoints such as workstations, servers and laptops, detects suspicious activity and enables security teams to investigate an incident and act immediately, for example by isolating a device. Whereas traditional antivirus mainly stops known malicious files, EDR looks at what processes, users and network connections actually do. This makes EDR a core building block of a SOC, a Zero Trust strategy and the duty of care under NIS2. In industrial control systems and other OT environments EDR needs extra care, because an agent on an HMI or engineering station must never disrupt the process.

🕰️ Where does the term EDR come from?

Gartner analyst Anton Chuvakin introduced the term Endpoint Threat Detection and Response (ETDR) in July 2013 for tools focused on detecting and investigating suspicious activities, and traces of such activities, on hosts and endpoints. Around 2015 the term was shortened to EDR, and that name has been the market standard ever since.

The category emerged because prevention alone was no longer enough. Targeted attacks, ransomware groups and living off the land techniques (abuse of legitimate admin tools such as PowerShell) slipped past signature-based scanners. EDR shifted the focus to visibility and rapid response: assume an attacker will get in, and keep the time to discovery (dwell time) as short as possible.

Two related terms followed: XDR (Extended Detection and Response), introduced in 2018 by Nir Zuk of Palo Alto Networks, and MDR (Managed Detection and Response), the service in which an external provider runs detection and response on your behalf.

🔧 What does EDR do?

An EDR solution consists of a lightweight agent on every endpoint and a central console (cloud or on-premises) for analysis. Its core functions are:

• Collecting telemetry - process starts, command lines, file changes, registry keys, network connections, logon attempts and USB use are continuously recorded as logging
• Behavioural detection - rules, machine learning and mapping to MITRE ATT&CK recognise suspicious chains, such as Office launching PowerShell that then opens an external connection
• Prevention - many EDR products also include antivirus and exploit protection and block malware before it runs
• Investigation and forensics - a timeline of the full attack chain, so analysts can see how an attacker got in and what was affected
• Response - isolating an endpoint from the network, killing a process, quarantining a file, running a script or rolling back changes as part of incident response
• Threat hunting - analysts proactively search stored telemetry for signs that did not raise an alert, enriched with threat intelligence

As an illustration of typical values: Microsoft Defender for Endpoint retains data for 180 days by default (configurable from 30 days) and keeps raw telemetry searchable for 30 days through advanced hunting. The product offers full isolation and selective isolation, in which you define exclusions for traffic that must keep working.

🔄 What is the difference between antivirus, EDR, XDR and MDR?

In practice the categories overlap. Modern EDR products include the antivirus function, XDR usually builds on an EDR agent, and many MDR services run on a single vendor’s EDR or XDR. On the network side, NDR is the counterpart of EDR; in OT, network monitoring is often the first step, because an agent cannot run on every device there. A SIEM additionally collects logs from all sources for correlation and compliance reporting.

🏭 When do you deploy EDR for IT or OT?

In IT, EDR is now standard on workstations and servers. The US government made it mandatory for federal agencies through Executive Order 14028 and OMB memo M-22-01 (October 2021). In OT the picture is more nuanced. EDR only works on hosts with a mainstream operating system, so on the Windows and Linux systems at Purdue levels 2 and 3: HMIs, SCADA servers, historians, engineering stations and jump servers for remote access. No agent runs on PLCs, O or other embedded devices; these are covered by network monitoring.

Siemens, for example, publishes for each version of PCS 7 and WinCC which virus scanners and allowlisting solutions have been tested, including recommended settings. Those settings balance detection against the deterministic behaviour of the control system. The OT zero trust guidance that CISA published with other US agencies in April 2026 likewise points out that systems below the HMI level often cannot carry an EDR agent and that cloud-dependent EDR clashes with isolated networks.

The risk of automatic updates became visible on 19 July 2024: a faulty content update for CrowdStrike Falcon crashed around 8.5 million Windows systems worldwide, including systems in aviation, healthcare and industry. For OT, that is the strongest argument for rolling out security software updates as carefully as patches.

🧭 How do you introduce EDR into an OT environment step by step?

1. Inventory the endpoints - use your asset inventory to list every Windows and Linux host with its operating system, version, role and criticality.
2. Check vendor requirements - consult the compatibility lists of your DCS, SCADA and machine vendors and record which products and versions are permitted.
3. Choose per system type - full EDR for servers and engineering stations; detection-only for HMIs; whitelisting or lockdown for legacy and fixed-function systems.
4. Test on a reference system - measure CPU, memory and disk load during normal operation and during a full scan; configure exclusions for project folders and databases.
5. Design the architecture - place the console or relay in the DMZ or a management zone in line with network segmentation, so OT hosts never talk directly to the internet.
6. Roll out in phases - start in audit mode, one cell or line at a time, and only enable blocking after a period without false positives.
7. Define the response - set out in the incident response plan who may isolate a host, when operations is involved and how you fall back to manual control.
8. Connect to monitoring - send alerts to a SIEM or OT SOC and combine them with network monitoring from, for example, Nozomi, Claroty or Dragos.

Within IEC 62443-3-3, EDR supports the requirements for malicious code protection (SR 3.2) and continuous monitoring (SR 6.2). NIST SP 800-82 (revision 3, 2023) describes similar considerations for host security in OT.

🧩 What kinds of EDR solutions are there?

The last row is included deliberately, because Nozomi, Claroty and Dragos are often wrongly described as EDR. Their core products analyse network traffic and therefore complement EDR rather than replace it. Independent comparisons are available from, among others, MITRE’s ATT&CK Evaluations, which have tested EDR products against emulated adversaries since 2018 and held a first ICS round in 2021 based on TRITON.

🔐 Why does EDR matter for NIS2 and compliance?

NIS2 does not mention EDR by name, but EDR supports several measures in the Article 21 duty of care, such as incident handling, detection and cyber hygiene policies. In the Netherlands that duty of care has applied since 15 August 2026 through the Cybersecurity Act (Cyberbeveiligingswet). For ISO 27001 (in the 2022 edition, controls A.8.7 on protection against malware and A.8.16 on monitoring activities) and the Dutch government baseline BIO, EDR also provides demonstrable evidence of who did what and when. EDR is, however, only one layer within defence in depth; segmentation, backups and a rehearsed incident process remain necessary.

❓ Frequently asked questions

Is EDR the same as antivirus?

EDR is not the same as antivirus. Antivirus mainly blocks known malicious files, whereas EDR continuously records behaviour on the endpoint, detects suspicious chains of activity and enables responses such as isolation. Many modern EDR products do include an antivirus function.

Can EDR run on a PLC?

EDR cannot run on a PLC, because a PLC has no mainstream operating system on which an agent can be installed. PLCs and other embedded devices are protected with passive network monitoring instead. EDR protects the Windows and Linux systems around them, such as HMIs and engineering stations.

Does EDR work without an internet connection?

EDR also works without an internet connection, provided you choose a product with an on-premises console or local relay. The agent keeps detecting and blocking locally, but cloud analysis and automatic updates are lost. In air-gapped OT networks, updates are then brought in manually and in a controlled way.

Is automated isolation sensible in OT?

Automated isolation is only sensible in OT for systems whose loss does not affect the process. If an HMI or SCADA server is isolated automatically, the operator loses sight of the plant. That is why many organisations choose detection only or manual response, agreed with operations, on critical OT systems.

What is the difference between EDR and XDR?

EDR focuses on detection and response on endpoints, while XDR also combines data from the network, identity, email and cloud. XDR usually builds on an EDR agent and correlates alerts across the whole environment. For a smaller organisation, EDR, possibly delivered as an MDR service, is often the logical first step.

Do I need a SOC to use EDR?

To use EDR effectively you need someone who reviews and follows up alerts, preferably around the clock. Organisations without their own SOC therefore often buy an MDR service, in which a provider’s analysts monitor the EDR alerts and intervene. Without follow-up, EDR mainly produces unread alarms.

📌 In summary

EDR continuously records what happens on endpoints, detects suspicious behaviour and enables rapid response, making it the foundation of modern detection and incident handling. In OT, EDR is valuable on HMIs, servers and engineering stations, provided you pay attention to vendor approval, resource impact, controlled updates and cautious automated response, complemented by network monitoring for PLCs and embedded devices.