What is EDR/EPP?

Endpoint Detection and Response (EDR) and Endpoint Protection Platforms (EPP) are security technologies focused on protecting endpoints, such as desktops, laptops, and servers. EPP solutions primarily prevent threats using methods like antivirus, firewalls, and intrusion prevention. EDR solutions focus on detecting and responding to threats that bypass EPP controls. They continuously monitor endpoint activity, analyze data for suspicious behavior, and provide tools for investigation and remediation. Often, EDR and EPP functionalities are combined into a single, comprehensive endpoint security solution. EDR is often used by security operations teams to identify active security incidents, understand their scope, and remediate them efficiently. EPP is typically used to stop known threats from executing on endpoints.