Traditional antivirus asks one question: does this file match something we know is bad? Modern attackers make sure the answer is no. Endpoint detection and response asks a better question: is this behaviour normal?
How traditional antivirus works
Antivirus compares files against a database of signatures from known malware, with some heuristics for suspicious code. It is effective against commodity threats and is still worth having. But it is fundamentally reactive: a threat has to be seen and catalogued before it can be blocked.
How attackers bypass it
- Fileless attacks run in memory using legitimate tools such as PowerShell and WMI, leaving no malicious file to scan.
- Living off the land uses built-in administration tools for reconnaissance, credential theft and lateral movement.
- New variants are generated automatically so each sample has a unique signature.
- Stolen credentials let attackers log in as legitimate users, with no malware at all.
What EDR adds
EDR continuously records endpoint activity, including processes, network connections, file changes and registry edits, and analyses it for suspicious patterns. When something looks wrong, it can alert, kill the process, isolate the machine from the network or roll back changes.
| Capability | Antivirus | EDR |
|---|---|---|
| Known malware | Yes | Yes |
| Fileless and in-memory attacks | Limited | Yes |
| Behavioural detection | Basic | Advanced |
| Attack timeline and investigation | No | Yes |
| Host isolation | No | Yes |
| Ransomware rollback | Rarely | Often |
| Threat hunting | No | Yes |
EDR needs people
EDR generates alerts that need investigation. Without someone reviewing them, an EDR console becomes an expensive log. That is why many organisations pair EDR with a managed security service, or with a SOC of their own, that triages alerts and responds.
How to decide
- If you hold sensitive data, face regulators or could not survive a week of downtime, you need EDR.
- Check whether your existing licence already includes EDR features that are switched off.
- Decide who will respond to alerts, in hours and after hours, before you buy.
- Pilot on a representative group to measure performance and false positives.
Our endpoint security engagements start with exactly this assessment.