The cyber security landscape is constantly changing and therefore so are the protection methods. Recently we have been asked by customers if their products are Endpoint Detection & Response (EDR) and eXtended Detection & Response (XDR), what this actually means, and how they compare against each-other as well as against a traditional anti-virus.

How does a standard Anti-Virus package work?

A standard anti-virus solution would typically be a stand-alone installation on one computer and all settings are managed on that endpoint, the “threat signatures” are programmed into the software so it knows what its looking for specifically and the “signatures” are updated regularly by the developers as and when new threats are found and categorized by the vendor, therefore, as standard anti-virus software is “reactive”, it would only react to a threat if it is within its threat signature or pattern database, with the reaction being to quarantine the threat until a user action defines the next steps.

How does EDR change this?

EDR products are centrally managed so there is a single administration panel of which your security team can go to centrally and get alerted to any threats. EDR is also behaviour based and will monitor everything on the networked endpoint in order to detect both unknown and known threats by watching out for anything it determines as unusual behaviour from the network or locally and automatically take action as required, EDR can even isolate devices independently and take them off the network to ensure that the malware/virus cannot get further into your infrastructure until it has been investigated further by your security team. In this instance, EDR is know as a “proactive” solution compared to the standard anti-virus being “reactive”.

What is XDR?

XDR is an enhancement which works with EDR, XDR adds further “threat hunting” capabilities which allow you to pinpoint every stage of the attack should an endpoint be infected, this then compiles the data into such a way that your security team can interpret and confirm exactly what happened and how it happened. XDR also has a much wider range of cover, rather then just being an Endpoint Detection and Response software, XDR is an “Extended Detection and Response” product, therefore, it can be integrated with a much wider range of devices therefore providing a much more enhanced level of protection to not only your endpoints and servers, but also to cloud based applications such as Email.

XDR then uses this much wider range of protection in order to not only ingest more data for analysis and protect more products, it also allows for XDR to stop threats at a much earlier stage as it ingests all data from the various sources and therefore detects threats much earlier in the infiltration stages and therefore it can automatically perform actions required and respond accordingly.