EDR in plain English: what it actually does (and what antivirus doesn't).

An owner called us last month after a ransomware event. First question: “How did they get past our antivirus?” The honest answer is that the antivirus was doing exactly what antivirus does — and it was never going to stop what happened.

EDR is the tool that would have. It's also the tool almost every 2026 cyber-insurance questionnaire, MSSP proposal, and compliance framework now asks about by name. And it's the one most SMB owners are least clear on. This is a plain-English explanation of what EDR actually does, why antivirus can't do it anymore, and how to tell whether the tool sitting on your endpoints is really EDR or just an old scanner in new packaging.

What antivirus was designed to do

Traditional antivirus was built around one idea: known-bad files. A researcher finds a virus, extracts a signature (a pattern of bytes unique to that file), and pushes the signature out to every AV agent in the world. Next time that file shows up on a computer, the agent recognizes the signature and quarantines it.

That model worked when threats were mostly file-based viruses that stayed the same across millions of victims. It stopped working around a decade ago, and 2026 attackers have moved on completely.

What 2026 attackers actually do

The techniques we see in nearly every incident have almost nothing to do with dropping a “bad file” on disk. Modern attacks look more like this:

• Living off the land. The attacker uses tools already on your computer — PowerShell, WMI, PsExec, scheduled tasks, RDP — to do the damage. There is no malicious file to scan. Everything they touch is a signed Microsoft binary. MITRE tracks these techniques in its ATT&CK framework.
• Credential theft, not malware. They phish a login, sign in to Microsoft 365 from a residential IP, and read email from a browser like anyone else. AV never sees a file because nothing malicious is running on the endpoint.
• Fileless payloads. Loaders that run entirely in memory, never touching disk. Nothing for a signature scanner to find.
• Ransomware detonated by a human, not a file. Modern ransomware crews get in days or weeks before they encrypt. When they do detonate, they're using a fresh binary that no AV vendor has ever seen — and disabling AV first, from inside, with stolen admin credentials.

None of this is defeated by matching signatures. That's the gap EDR fills.

What EDR actually does

EDR stands for Endpoint Detection and Response. The mental model that works best: antivirus is a doorman checking IDs against a photo book; EDR is a security camera system that records everything, watches for patterns, and can lock the doors in real time.

More concretely, a real EDR agent does four things AV does not:

1. Records behavior, not just files

An EDR agent continuously logs process activity, command-line arguments, network connections, registry changes, file operations, and parent-child process relationships. When PowerShell launches from a Word document to download a payload, EDR sees the whole chain. AV sees a signed Microsoft binary running normal PowerShell.

2. Detects patterns, not signatures

Instead of asking “does this file match a known bad hash,” EDR asks “is this pattern of behavior consistent with an attack?” A legitimate user does not usually dump credentials from the Local Security Authority, disable Windows Defender, and enable RDP within 30 seconds. EDR catches that sequence. This is the same detection philosophy behind CISA's guidance on living-off-the-land techniques.

3. Responds automatically

Real EDR can kill processes, isolate the endpoint from the network, and roll back malicious changes — without waiting for a human. That's the “R” in EDR. When your file server starts encrypting files at 3 AM, EDR can quarantine it inside seconds, while an AV product would still be looking for a known-bad hash.

4. Sends the telemetry somewhere a human can hunt

The recorded behavior is streamed to a central console where analysts can search it, correlate it with events from other endpoints, and hunt for threats that haven't triggered an alert yet. This is the part most SMBs skip — they buy an EDR tool and never have anyone actually watching the console. When paired with a 24/7 SOC (Security Operations Center), the tool becomes MDR (Managed Detection and Response), and that's where the real value is.

How to tell if your “EDR” is really EDR

Here's where a lot of SMBs get caught. Every AV vendor now sells something labelled EDR. Some of it is genuine. Some of it is the same signature scanner from 2015 with a new console. If you're not sure what you have, check these:

• Does it record process trees? Ask your provider to show you a process tree for a real event on one of your endpoints. If they can only show “a bad file was blocked,” it's not EDR.
• Does it have behavior-based detection rules aligned to MITRE ATT&CK? A real EDR product ties detections to specific attacker techniques (T1059, T1003, T1078, and so on). Signature-only tools don't.
• Can it isolate a host from the network on command? This is table stakes for EDR. If your tool can't do it, it's AV.
• Is anyone actually watching? This is the biggest one. A tool with no human behind it will alert into an empty inbox. Ask specifically: who watches the console at 3 AM on a Saturday, and how fast do they respond?
• Independent testing. Look for coverage in MITRE ATT&CK Evaluations. Genuine EDR vendors participate; scanners rebranded as EDR generally don't.

Why this matters for cyber insurance

2026 cyber-insurance renewals ask about EDR by name, usually alongside MFA and immutable backups. If the questionnaire asks “do you have EDR deployed on 100% of endpoints,” and your answer is really “we have Microsoft Defender running with default settings and nobody watches the console,” you have a coverage problem. Carriers have started auditing this after claims — the FBI's IC3 report and industry breach data both show that carriers increasingly deny or reduce payouts when the applicant materially misrepresented controls.

“We have antivirus” is not the same as “we have EDR.” If the two are treated as equivalent on your application, you may be paying premium for coverage that won't be there when you need it.

What WHT recommends

If you're not sure whether what you have counts as real EDR, work through this list:

1. Ask for a process-tree demo. Have your current provider walk you through a recent detection on one of your endpoints, live in their console. If they can't, that's your answer.
2. Confirm 100% coverage. List every laptop, desktop, and server. Confirm the EDR agent is deployed and reporting on every one. One uncovered endpoint is where ransomware spreads from.
3. Verify who's watching. Ask who monitors alerts nights and weekends, what the median response time is, and what happens if the endpoint goes offline. Get it in writing.
4. Test isolation. Ask your provider to isolate one endpoint from the network as a test. If they can't do it in under a minute, you don't have real response capability.
5. Match your insurance application to reality. Read what you told the carrier last renewal. If it doesn't match what you actually have deployed, fix it before the next incident, not after.
6. Add a SOC if there isn't one. An EDR tool without a human watching it is a very expensive log file. MDR — EDR plus a 24/7 SOC — is what closes the loop.

The bottom line

Antivirus catches files that match known-bad signatures. That's a shrinking share of what actually hurts SMBs in 2026. EDR watches behavior, detects patterns, responds automatically, and hands telemetry to humans who can hunt. The two tools are not interchangeable, and calling AV “EDR” on an insurance form doesn't make it so.

If you're not sure which one you have, that's the first thing worth finding out.