Defence

EDR

Endpoint detection and response

Security software on laptops and servers that watches behaviour to detect and stop attacks.

EDR records what processes do and flags or blocks suspicious behaviour, then lets responders investigate and isolate machines. Attackers increasingly try to disable it first, with "EDR killer" tools that abuse vulnerable drivers.