EDR · Detection and Response
Service group: CybersecurityEndpoint detection and response, with its limits stated plainly
EDR records what happens on a device so suspicious behaviour can be spotted, investigated and contained. We configure it, review its detections during agreed hours and use its response actions, while being clear about what it cannot see.
At a glance
- Service
- Configuration and operation of endpoint detection and response capability on covered devices
- Best suited to
- Organizations of roughly 5 to 200 employees that hold sensitive data or face insurer requirements for EDR
- Core inclusions
- EDR onboarding, sensor health checks, detection triage in agreed hours, device isolation, investigation summaries and tuning
- Not included by default
- Continuous after-hours response, proactive threat hunting, forensic imaging and coverage of unmanaged devices or network appliances
- Licensing prerequisite
- An EDR-capable licence such as Microsoft Defender for Business, Defender for Endpoint Plan 2 or a comparable platform
- Pricing basis
- Per covered device per month, confirmed in a written quotation; licences quoted separately
- How to start
- Book a consultation to confirm licensing and device count, or begin with an Endpoint Security Assessment
What EDR does that antivirus does not
Traditional antivirus compares files against known threats and blocks matches. Endpoint detection and response adds a sensor that continuously records process launches, command lines, network connections, file changes and sign-in activity on each device. Cloud analytics then look for patterns that suggest an attack in progress, such as an Office document spawning PowerShell, credential dumping tools, or mass file encryption.
When EDR raises a detection, an analyst can view the timeline of what led up to it, see which other devices show the same indicators, and take response actions: isolate the device from the network, stop a process, quarantine a file, or collect an investigation package.
EDR is a capability, not a complete service. Its value depends on correct deployment, sensors staying healthy, detections being reviewed by someone who understands them, and response actions being taken quickly. That operational layer is what this service provides.
Why organizations look at EDR
Attacks that use legitimate tools
Many intrusions rely on built-in tools such as PowerShell, remote desktop and scheduled tasks, which signature-based antivirus is not designed to judge.
No visibility after an alert
When something is blocked, nobody can tell how it arrived, what else it touched, or whether other machines are affected.
Insurance and client questionnaires
Cyber insurers and larger clients increasingly ask whether EDR is deployed on all endpoints and who reviews its alerts.
EDR licensed but unused
Microsoft 365 Business Premium includes Defender for Business with EDR features, yet many tenants never onboard devices or review the incident queue.
What we operate
Sensor onboarding
Devices enrolled into the EDR platform through Intune or deployment packages, with onboarding status reconciled against your inventory.
Detection triage
Incidents and alerts reviewed during agreed hours, classified as true positive, benign or false positive, and recorded with the reasoning.
Containment actions
Device isolation, process termination, file quarantine and user account disablement in Microsoft Entra ID when evidence supports it.
Investigation summaries
Plain-language write-ups of significant detections: what happened, which devices and accounts were involved, what we did and what remains.
Tuning
Suppression of known benign activity from your line-of-business software, kept narrow so real threats are not hidden.
Automated investigation settings
Where the platform supports it, automated investigation and remediation levels set deliberately and documented.
What EDR cannot do
EDR only sees devices with a healthy sensor. It does not see personal phones, unmanaged laptops, printers, firewalls or most cloud application activity unless separate tools feed it. It cannot stop an attacker who signs in to Microsoft 365 with stolen credentials from a device you do not manage. Detections outside agreed review hours still trigger automatic protections, but human review waits for the next review window unless extended coverage is in your plan.
Scope of the EDR service
Typically included
- Onboarding of covered Windows, macOS and Windows Server devices to the EDR platform
- Weekly sensor health review and remediation of devices that stop reporting
- Triage of incidents and alerts during agreed business hours
- Containment actions taken under your approved response playbook
- Written summaries of significant detections
- Quarterly tuning review
Requires separate scope or quotation
- Continuous 24/7 monitoring or SOC services
- Proactive threat hunting across historical telemetry
- Forensic disk or memory imaging and evidence handling for litigation
- EDR licences, unless supplied through a quoted bundle
- Devices that cannot run the EDR sensor
EDR platforms
- Microsoft Defender for Business (included in Microsoft 365 Business Premium)
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender XDR incident queue and advanced hunting where licensed
- Comparable third-party EDR platforms already deployed in your environment
- Microsoft Intune for sensor deployment and device compliance signals
Who benefits most
Firms with sensitive client data
Accounting, legal, engineering and healthcare organizations where a quiet intrusion could expose confidential files.
Business Premium tenants
Organizations already paying for EDR features through Microsoft 365 Business Premium and not yet using them.
Teams facing insurance renewal
Businesses that need an accurate answer to whether EDR is deployed and who reviews it.
What you gain
- Visibility into how a threat reached a device and what it did
- The ability to isolate a compromised laptop remotely within agreed hours
- Detections reviewed and recorded rather than left in a queue
- Better use of security features you may already license
- Clear documentation of coverage and limits for insurers
How we introduce EDR
Licence and device review
We confirm which licences include EDR, which devices can run the sensor, and whether another product will conflict.
Response playbook
We agree in writing which actions we may take without asking, such as isolating a laptop, and which need your approval.
Pilot onboarding
A small group of devices is onboarded first to observe noise from your applications before full rollout.
Full rollout and tuning
Remaining devices are onboarded and benign detections are tuned out narrowly.
Operate
Triage, containment, summaries and quarterly reviews continue under your scope.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Add EDR operation to endpoint security
Extend a Managed Endpoint Security subscription with EDR triage and response on the same devices.
Endpoint Security Assessment first
Confirm coverage, licensing and current configuration before committing to recurring EDR operation.
Within a managed cybersecurity programme
Combine EDR with identity, email and backup controls under one accountable scope.
Frequently asked questions
Is EDR the same as a managed detection and response (MDR) service?
Not as we deliver it. MDR usually implies continuous monitoring by a dedicated analyst team. We operate EDR and review detections during agreed hours. If you need continuous coverage, we will discuss that requirement openly during discovery.
Do we already have EDR?
If you license Microsoft 365 Business Premium, you have Defender for Business, which includes EDR features. Whether it is actually working depends on device onboarding and configuration, which we can check.
Can EDR slow down our computers?
Modern EDR sensors are lightweight, but conflicts with older antivirus products or heavy line-of-business software can cause issues. That is why we pilot first and remove conflicting products cleanly.
Will you isolate a device without asking us?
Only under the response playbook you approve. A common choice is to allow immediate isolation for high-confidence threats such as active ransomware, with notification straight after.
Related services
Products and packages
Industries we support
Service areas
Find out whether your EDR is switched on and watched
We will review your licensing, device onboarding and response arrangements, then propose a written scope.