Realizing the difference between EDR and a regular antivirus is crucial to properly protect your business from cyberthreats. These two security methods are radically different, and only one is appropriate for fighting today's threats.

Back when the number of new viruses per day could be counted in a spreadsheet, antiviruses blocked known malware by scanning files as they were written to a computer's disk. If a file were “known” to the antivirus database, the program would not allow it to be executed.

An antivirus database is made up of multiple signatures. They can consist of hashes of the virus file or specifications that the file should match. Such specifications contain human-readable lines or sequences of bytes contained in the executable virus file, as well as the file type, size, and other types of metadata.

Some antiviruses can also run primitive heuristic analysis of executing processes and verify the integrity of critical system files. These post-infection checks were included after the flow of new virus samples began to outpace the ability of antivirus vendors to update their databases daily.

Due to the declining effectiveness of antiviruses, some vendors are supplementing antiviruses with other services, such as firewall management, data encryption, lists of allowed and blocked processes, etc. Such solutions, known as endpoint protection platforms (EPPs), are also based on a signature-based approach.

Antiviruses focus on files that are entered into the system. Instead, EDR collects data from the endpoint and examines it for malicious or abnormal patterns in real-time. The very idea of EDR is to detect an infection and respond. The faster an EDR can do this without human intervention, the more effective it will be.

A good EDR also blocks malicious files, but recognizes that not all modern attacks are file-based. Proactive EDRs also automatically respond and provide visibility into file changes, process creation, and network connections on the endpoint.

First, any team of signature writers won’t be able to keep up with the number of new viruses and attack methods that appear every day.

Antiviruses can't detect most threats, so companies will face the ones they miss.

Second, attackers can easily bypass detection by using signatures. Signatures focus on several file characteristics, so virus authors create them with variable (polymorphic) characteristics. For example, file hashes are the easiest to change, but additionally, internal strings can also be randomized, obfuscated, and encrypted differently with each new version.

Third, ransomware operators have moved beyond file-based attacks. In-memory attacks, fileless attacks, human-driven attacks (Hive), and double ransomware attacks (Maze, Ryuk) have become common. They can start with credentials hacking or exploiting RCE (remote code execution) vulnerabilities. The data is leaked, but due to the signature-based principle, the antivirus doesn’t work.

EDR focuses on providing visibility for security teams and automatic threat response, so it works much better with modern threats.

EDR isn’t limited to detecting known file-based threats. On the opposite, the core value is that the threat doesn’t have to be accurately detected: the solution looks for unexpected, unusual, and unwanted patterns of activity and produces alerts that a security analyst should investigate.

Since EDRs collect a wide range of data from all protected endpoints, security teams can visualize it in a single interface. The data can also be integrated with other tools for more in-depth analysis, further information about the overall security posture, and retrospective threat detection and analysis.

Advanced EDRs can receive this data, contextualize it on the device, and mitigate the threat without human intervention. But not all of them can do this: if the data is transferred through the cloud for remote analysis, it becomes delayed.

Antivirus engines can be useful complements to EDR, and most include signature-based blocking and hashing as part of a “defense-in-depth” strategy. This way, enterprise security teams can also take advantage of blocking known malware.

EDRs provide profound visibility into all endpoints in the network, but many solutions don't deliver the effect that security teams were hoping for. They require significant human resources to manage, which are often unavailable due to staffing or budgetary constraints or unattainable due to a lack of skills.
Many organizations that have invested in EDR simply reallocate resources from one security task to another: instead of triaging infected devices, they have to review piles of alerts.

Let's look at a standard situation: a user opens a tab in Google Chrome, downloads what he thinks is a safe file, and runs it. The program uses PowerShell to delete local backups and then starts encrypting all the data on the disk.

An analyst overwhelmed by notifications must collect data into a meaningful story. With Active EDR, this work is done by an agent on the endpoint. Active EDR is aware of the full history, so it reduces this threat at runtime, before encryption even starts.

Once the attack story is reduced, all elements of that story are protected, down to the Chrome tab the user opened in the browser. This works because each element of the story is assigned the same Storyline ID. These stories are then sent to the management console, allowing analysts and administrators to easily track threats.

Choosing the right EDR requires an understanding of your organization's requirements and the product's functionality.

It's important to run tests and make sure these tests have real-world relevance. How will your team use the product in their daily work? How simple is it to train? Will it protect your company if cloud services are disabled or unavailable?

It's also significant to consider deployment and implementation. Can you automate deployment across your network? What about platform compatibility? Does the vendor you select pay equal attention to Windows, Linux, and macOS? Every endpoint needs to be protected: those left unattended create a backdoor into your network.

Next, you need to think about integration: most organizations have a complex application stack. Does your vendor offer powerful yet simple integration for your other services?

Active EDR is the next step up from antivirus. And for enterprises that need maximum visibility and integration everywhere, Extended Detection and Response (XDR) is the way to go.

XDR takes EDR to the next tier by integrating all visibility and security controls into a complete, comprehensive view of what's happening in your environment. With a unified feed of raw data that includes information from across the whole ecosystem, XDR enables faster, more insightful, and smarter threat detection and response by capturing and aggregating data from a wider range of sources.

Attackers have long since moved past antivirus software and EPPs, and such products cannot counter today's active threats. Even a quick glance at the news shows how large, but unprepared businesses are becoming victims of sophisticated attacks regardless of their investment in security. It's our responsibility to ensure that our security programs are fit for purpose for today's and tomorrow's threats.