EDR (endpoint detection and response)
Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack. Cyber Essentials does not require EDR. An EDR product can meet the anti-malware option at A8.1 if it is kept updated and blocks malware, malicious code and malicious websites.
- Term
- Endpoint detection and response
- Also known as
- EDR, Endpoint protection
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term endpoint detection and response mean in Cyber Essentials?
Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
How does endpoint detection and response apply to Cyber Essentials?
In plain terms
Traditional antivirus is a doorman with a list of banned faces. EDR adds CCTV and a security team. It keeps a record of what programs do on each laptop and server, flags behaviour that looks like an attack even when the file is new, and lets someone isolate the device or stop the program remotely. Many EDR products are watched by a security operations centre.
What Cyber Essentials asks
Nothing about EDR by name. The requirements set a minimum: every device in scope has an active malware protection mechanism. Anti-malware software is one of the two options, and it must "be updated in line with vendor recommendations", "prevent malware from running", "prevent the execution of malicious code" and "prevent connections to malicious websites over the internet".
An EDR product that includes anti-malware protection can meet that option. List it at A6.2.2 with its version, select option A at A8.1, and answer A8.2 and A8.3 from how it is actually configured. The detection and response features go beyond the scheme and are not assessed.
Common mistakes
- Assuming EDR covers malicious websites. A8.3 accepts protection from either your anti-malware software or your browser, so check which one actually does it.
- Running an agent in a detect-only or audit mode. The requirement is to prevent malware running, not only to report it.
See the malware protection requirements. Related: anti-malware software, signature-based detection.
Related terms
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.
- ExploitAn exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.
- Full-disk encryptionFull-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
Frequently asked questions
Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
In the 2026 Danzell question set, endpoint detection and response comes up at A6.2.2, A8.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.