What are the pros and cons of using an EDR versus a traditional Antivirus for endpoints?

All answers to this question.

Traditional Antivirus relies on signatures, meaning it only catches known threats. EDR, however, monitors behavior. It can detect a "living-off-the-land" attack where a hacker uses legitimate tools like PowerShell for malicious purposes. For a mid-sized business, the visibility EDR provides into the "attack timeline" is invaluable during an investigation. While it requires more expertise to manage, many vendors now offer Managed EDR (MDR) where their experts handle the monitoring for you. In today's threat landscape, relying solely on signatures is like bringing a knife to a gunfight.

   Answered 2024-01-12 by Cynthia Roberts

EDR is powerful, but how are you going to manage the "alert fatigue" that often comes with it? Does your current team have the bandwidth to investigate dozens of behavioral anomalies every day, or are you worried that important signals will get lost in all the noise generated by the system?

   Answered 2024-01-14 by Patrick Sullivan

• Patrick, that is exactly why we are looking at an MDR service. We want the high-fidelity data of an EDR without making our two-person IT team sit in front of a dashboard 24/7. It allows them to focus on remediation while the service provider handles the initial triage.

     Commented 2024-01-16 by Ryan Miller

We switched to EDR last year and it caught a credential harvesting attempt within hours that our old AV completely missed. The forensic data alone made the cost worth it for us.

   Answered 2024-01-18 by Jason Bennett

• That’s a great testimonial, Jason. We had a similar experience. The ability to "roll back" an endpoint to a previous healthy state after a detected infection saved us from a full re-image.

     Commented 2024-01-20 by Cynthia Roberts