Skip to content
Knowledge Hub/Article
Article

What Is Endpoint Security? Antivirus, EDR and XDR

How antivirus, EPP, EDR, XDR and MDR differ, how behavior-based detection works, the role of MITRE ATT&CK and the link to device management.

Oğuzhan Gerçek··7 min read
What Is Endpoint Security? Antivirus, EDR and XDR

Short answer: Endpoint security is the set of measures that protects laptops, desktops, servers, phones and IoT devices against malware and attacks. Antivirus recognizes and stops known malware; an EPP brings preventive tools together in a single console. EDR continuously records activity on the endpoint, catches suspicious behavior and makes a response possible; XDR extends the same approach to email, network and cloud data. MDR, by contrast, is not a product but a service that watches these tools 24/7 and responds.

What is an endpoint?

NIST's glossary defines an endpoint as any device used to access a digital identity on a network: laptops, desktops, mobile phones, tablets, servers, IoT devices and virtual environments.

According to Verizon's 2026 Data Breach Investigations Report (DBIR), ransomware was present in 48% of breaches, up from 44% the year before. Endpoint security is one layer of cybersecurity; we cover the network side in our network security article.

What is antivirus, and why is it not enough on its own?

NIST defines antivirus software as a program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. According to NIST's SP 800-83 guide, antivirus detects malware primarily by looking for characteristics of known instances, and it is most effective when its signatures are fully up to date; Microsoft calls these signature packages definition updates. You will find short definitions of antivirus and managed antivirus in our glossary.

According to IBM, traditional tools are limited to known, file-based or signature-based threats and are powerless against fileless attacks that run only in memory. Next-generation antivirus (NGAV) narrows that gap: as IBM describes it, it can also catch malware that leaves no signature, and it uses heuristics to compare suspicious behavior patterns with those of known viruses.

What is an EPP?

An EPP (endpoint protection platform) combines next-generation antivirus with other endpoint security tools and manages them from a single central console. IBM's list of examples includes web control, data loss prevention (DLP), integrated firewalls, email gateways and application control. An EPP's focus is prevention: it stops known threats, or threats that behave in known ways. We cover DLP and endpoint protection together on our DLP & endpoint security page.

What is EDR and how does it work?

EDR (endpoint detection and response) is the layer that continuously records what happens on an endpoint in order to find threats that get past prevention. Memorandum M-22-01 from the US Office of Management and Budget (OMB) describes EDR as combining real-time, continuous monitoring and collection of data from endpoints such as workstations, mobile phones and servers with rules-based automated response and analysis. According to IBM, Gartner was the first to recognize it as a product category, in 2013.

The data IBM lists is broad: processes, configuration changes, network connections, file downloads and transfers, and user and device behavior. When EDR finds a threat, it can alert an analyst, disconnect the device from the network, halt a process or stop a suspicious file from running. In Microsoft's Defender for Endpoint documentation, alerts tied to the same attack technique or the same attacker are grouped into a single incident, and because the data is kept for six months, an analyst can go back to the start of an attack.

What is XDR? EDR vs XDR

XDR (extended detection and response) takes the logic of EDR beyond the endpoint. In IBM's definition, XDR is an open cybersecurity architecture that integrates security tools and unifies security operations across all security layers: users, endpoints, email, applications, networks, cloud workloads and data. The term was first defined in 2018.

The difference is scope: EDR sees a suspicious process on a laptop, while XDR can show the same event in one chain with the email attachment the user opened a moment earlier and an unusual sign-in. IBM distinguishes native XDR, which integrates only one vendor's tools, from open XDR, which integrates an organization's tools regardless of vendor. We explain where XDR sits in a SOC in our SIEM and SOC article.

What is MDR? A service, not a product

In IBM's definition, MDR (managed detection and response) is a 24/7 cybersecurity service that monitors, detects and responds to threats; EDR and XDR, on the other hand, are tools rather than services. An MDR provider reviews the alerts these tools raise, hunts for threats and responds to contain them. According to IBM, traditional MSSPs (managed security service providers) mostly leave response actions to the customer.

Even when EDR runs automated response rules, an alert that falls outside those rules will not turn into a timely response unless someone is there to review it at 3 a.m. and make a decision. We cover the service side on our security operations page.

Behavior-based detection and the role of MITRE ATT&CK

A signature asks "is this a known malicious file?"; behavior-based detection asks "what is this process doing?" According to Microsoft's behavior monitoring documentation, Defender Antivirus observes process, file and service activity in real time and catches threats from suspicious behavior, including threats that don't match known signatures. One example is an attempt to modify autostart extensibility point (ASEP) registry keys. CIS Controls v8.1 also lists behavior-based anti-malware software as a separate safeguard (10.7).

The common language for describing behavior is MITRE ATT&CK, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. A tactic describes the reason for an action, the adversary's tactical goal: in Initial Access the goal is to get into the network, in Persistence it is to maintain a foothold. A technique describes how that goal is achieved. Mapping an alert to an ATT&CK technique shows at which step of the attack chain the event was caught.

MITRE's ATT&CK Evaluations emulate real adversaries and measure how products see and stop those attacks; in MITRE's words, the evaluations do not rank vendors.

Device management, patching and operations

Detection alone is not enough; the device also has to be configured correctly and kept up to date. NIST's SP 800-124 Rev. 2 defines enterprise mobility management (EMM) as a solution used to deploy, configure and actively manage mobile devices in an enterprise. In Microsoft Intune, device compliance rules can cover a minimum OS version, whether a device is jailbroken or rooted, and the threat level reported by integrated threat management software; Conditional Access can then block noncompliant devices from corporate resources. Closing the vulnerability itself is the job of patch management: we explain the process in our patch management article and cover device management on our Workplace & Device Management page.

CIS Controls v8.1 calls for anti-malware software to be deployed and maintained on all enterprise assets, with automatic signature updates (10.1, 10.2). The OMB memorandum also expects EDR to be appropriately resourced and staffed, and endpoint data to be retained in a way that supports analysis. For banks in Türkiye, the rule is written into regulation: the information systems regulation of the BDDK, the banking regulator, requires a bank to continuously monitor its desktops, laptops and servers to detect malware on them (Article 16(4)).

Frequently asked questions

What is endpoint security? It is the protection of network-connected computers, servers, phones and IoT devices against malware and attacks. Antivirus, EPP, EDR and device management are all part of it.

What is antivirus and what does it do? Antivirus is software that detects malware, stops it from running and removes it. It works well against known threats but struggles with malware that has no signature or runs only in memory.

What is EDR? EDR is a security layer that continuously records activity on endpoints, detects suspicious behavior and enables responses such as isolating a device.

What is the difference between EDR and XDR? EDR looks at endpoint data. XDR combines it with email, network and cloud data and shows the event as a single chain.

Does EDR replace antivirus? No. Antivirus and EPP prevent known threats, while EDR detects threats that get past prevention and enables a response; the two are used together.

Sources