Endpoint Detection and Response (EDR) Solution

How it differs from antivirus software

Traditional antivirus software matches files against a list of known malware signatures — effective against common threats but powerless against custom-written attack tools. EDR takes a different approach: it observes behaviour on the machine and detects anomalous sequences of actions, even when each individual operation is legitimate.

Data recorded by EDR

• Which process launched which other process, and with what parameters
• Files that are created, modified or encrypted
• Outbound network connections and their destinations
• Changes to the registry, scheduled tasks and persistence mechanisms

Deployment notes

The EDR agent runs resident on every machine, so its impact on performance and its compatibility with operational software must be assessed. NST runs a pilot on a small group before rolling out across the entire organisation.