What Endpoint Detection and Response (EDR) means in practice
Traditional antivirus asks whether a file matches something known to be bad. EDR asks whether the behaviour on a device looks like an attack, regardless of whether any individual file is recognised. That distinction matters because modern intrusions frequently use legitimate tools — PowerShell, remote management software, built-in Windows utilities — in illegitimate sequences.
An EDR agent records telemetry: process creation and lineage, command lines, file writes, registry changes, network connections and credential access attempts. Behavioural analytics and threat intelligence run over that stream to raise detections. When something fires, the recorded timeline lets an analyst reconstruct the intrusion — which document was opened, what it spawned, where it connected, what it touched — rather than guessing from a single alert.
Response capability is the other half. A useful EDR platform can isolate a device from the network while leaving the management channel open, kill processes, quarantine files, collect a forensic package, and run automated remediation. Microsoft Defender for Endpoint provides all of this, along with attack surface reduction rules, device control, and vulnerability management that shows which unpatched software is actually exposed.
The Essential Eight does not name EDR explicitly, but the capability underpins several of its strategies in practice, and cyber insurers increasingly ask for it by name. Managed detection and response services are essentially EDR plus the analysts to operate it, which is how most mid-sized organisations consume it.
Two deployment realities are worth planning for. Coverage gaps — unmanaged contractor laptops, servers excluded from the rollout, devices that fell out of Intune enrolment — are where intrusions persist. And tuning is ongoing: line-of-business applications that behave unusually will generate detections, and suppressing them correctly, rather than broadly, is what keeps the platform trustworthy.
What is EDR?
EDR stands for Endpoint Detection and Response. It is a category of security software that monitors endpoint devices — laptops, desktops, servers — for signs of threat activity, alerts security teams when suspicious behaviour is detected, and provides tools to investigate and respond to incidents. Unlike traditional antivirus, which detects known malware signatures, EDR uses behavioural analysis to identify threats that have never been seen before — including fileless malware, living-off-the-land attacks, and ransomware in its early stages before encryption begins.
EDR vs antivirus — what's the difference?
Antivirus detects known threats by matching files against a database of malware signatures. EDR monitors all endpoint behaviour continuously — process execution, network connections, file modifications, registry changes — and flags anomalies. EDR catches threats antivirus misses because it does not rely on having seen the threat before. Microsoft Defender for Business is an EDR platform included in Microsoft 365 Business Premium. Huntress, the managed EDR platform Mycelium 365 uses, adds a human-reviewed SOC layer on top of Defender — every alert is reviewed by a security analyst before action is taken.
Do Australian businesses need EDR?
Essential Eight Maturity Level 2 requires application control and logging that EDR platforms support. Cyber insurance applications increasingly require documented EDR deployment. Any business handling sensitive client data, operating in regulated industries, or with government contracts should have EDR in place. For most Australian SMBs, Microsoft Defender for Business (included in M365 Business Premium) combined with a managed SOC layer like Huntress provides the right coverage without the cost of an enterprise EDR platform. Contact us to assess your endpoint security posture.
How we help with this
Related terms
- Security Operations Centre (SOC)A security operations centre is the team and tooling responsible for monitoring, detecting, investigating and responding to security events.
- SIEM (Security Information and Event Management)A SIEM collects log and event data from across an environment, normalises it, and applies correlation rules and analytics to surface security incidents.
- APRA CPS 230CPS 230 is the APRA prudential standard on operational risk management.
- APRA CPS 234CPS 234 is the APRA prudential standard on information security.
Ready to simplify and secure your technology?
Book a free, no-obligation Discovery Call to talk through your Microsoft 365, Azure, security, or support needs — no sales pitch, just a straight conversation.
We respond to every enquiry within 4 business hours. Monday to Friday, 7am–7pm AEST.