What are endpoint protection and EDR?

Endpoint protection: definition and distinction

Endpoints are all devices on which employees work or data is stored: laptops, desktop PCs, servers, smartphones and tablets. They are frequent entry points for attacks because emails are opened, files are downloaded and programs are installed there. Endpoint protection brings together the protective functions that run on exactly these devices.

Classic antivirus compares files with known malware signatures. Modern solutions (next-generation antivirus) also detect suspicious behavior, block malicious scripts and vulnerability exploits and control device ports. EDR adds the recording and investigation of what happens on the device.

EDR, XDR and MDR at a glance

An EDR system continuously collects telemetry—processes started, network connections, file changes—and evaluates it for attack patterns. It does not just raise alarms but allows countermeasures: isolating a device from the network, terminating a process, rolling back changes. Afterward, you can trace how an attacker proceeded.

• Antivirus/NGAV: blocks known and suspicious malware on the device
• EDR: detects, investigates and responds to attacks on individual endpoints
• XDR: correlates data from endpoints, email, identities and network
• MDR: a service provider monitors the alerts around the clock and responds
• Device control: governs USB storage and other ports

Real-world example: a law firm with laptops on the go

A law firm with 15 employees uses laptops that also run in court, on the train and at home. An attachment from a deceptively real email starts a script in the background. A pure signature scanner does not yet know the new malware and stays silent.

The EDR solution detects the unusual behavior—an Office program launches a command line and contacts an unknown address—stops the process and isolates the laptop. IT receives an alert with a process log, resets passwords and checks whether other devices are affected. The incident stays limited to one device.

Selection, operation and common mistakes

The best tool only protects if it is installed on all devices, up to date and correctly configured—and someone handles the alerts. Small companies without their own security department therefore often choose a centrally managed solution or an MDR service. Windows devices already include a baseline protection with Microsoft Defender that can be managed centrally.

Nano Concepts selects a suitable solution with you, rolls it out on all devices, sets up alerts and response procedures and can take over ongoing operation as a service. That way, you always know which devices are protected and who responds when an alarm goes off.

• Protection installed on only some of the devices
• Alerts go nowhere because nobody is responsible
• Exclusions are set too generously out of convenience
• Unmanaged private devices access company data
• Protection planned without updates, encryption and backups