Endpoint protection and EDR

Endpoint protection is the software on each laptop, desktop and server that decides whether a file or process is allowed to run. Older antivirus compared files against a list of known malware. The products listed here add machine learning models that judge files and behavior they have never seen, which matters because most malware today is changed slightly for each victim so it won't match a list.

EDR, short for endpoint detection and response, goes a step further. The agent records what happens on the machine: which programs started, what they launched, which files they touched and where they connected. When something looks wrong, an admin can open that history, see how the attack started, isolate the machine from the network with one click and kill the process. For a ransomware attack, that record is often the only way to learn which account was stolen and which other machines were reached.

For a small business, the hard part of EDR is staffing it. An EDR tool produces alerts, and many of them need a person to decide whether they are real. If nobody reads them, the tool works like plain antivirus. That is why most vendors here sell a managed version, often called MDR, where their analysts watch your alerts and contain threats for you, and why many small companies buy endpoint security through an MSP that runs the console.

Before you choose, list every device the tool must cover. Windows laptops are supported everywhere, but Mac, Linux servers, phones and tablets vary by product and by tier. Check what the cheapest bundle includes. Many vendors keep EDR history, device isolation or threat hunting for higher tiers, and sell the entry tier as next-generation antivirus.

Ask how the product handles ransomware in particular. Some watch for mass file encryption and stop it partway, and a few can roll changed files back on Windows. Ask what happens when the device is offline, how tamper protection stops an attacker with admin rights from uninstalling the agent, and how updates are pushed.