Endpoint Detection and Response (EDR) Forum

Frank Yang
Sales Director at a tech services company with 5,001-10,000 employees
Mar 22 2020
I work at a tech services company with 5,000 - 10,000+ employees.  We are currently researching EPP and EDR solutions. What are the main differences between EPP and EDR?  Thanks! I appreciate the help. 
Om SalamkayalaI think most of the comments cover all the key points. EDR-End point Detection and Response. Its main functions are: To monitor, record activity on endpoints, detect suspicious behaviour, security risks and respond to internal external threats. Which further includes- Providing Authenticating log-ins, Monitoring network activities, and deploying updates. Its Capabilities: 1. Continuous endpoint data collection. 2. Detection engine 3. Data recording. It is considered as next layer of security Its limitation: No in depth visibility IR team needs to deal with false alarm and have to handle restoring process. Struggle to find the attackers who infiltrated for the damanage caused. Not an holistic approach EPP-End point protection platform. Its functionality covers: Antivirus Anti-malware Data encryption Personal firewalls IPS DLP It works mainly on signature based approach and more broader detection techniques. It is considered as first line defence. Keeping in view of the above points currently Holistic Endpoints Security solutions approach is emerging ie EDR providers are incorporating aspects of EPP and vice versa resulting in considering EDR as a subset of EPP. Examples of such products or tools Symantec and Cynet. I hope the above points cover the difference between EDR & EPP.
Neil RerupThe biggest difference is time frames. EPP is meant to PREVENT infection. EDR is meant to deal with endpoints once they ARE infected.
Jehyun ShimEPP is focused on detecting malware, but EDR is focused on logging endpoint an event and this event is used for threat hunting or incident response. So you need advanced security analysts to get the desired effect. EPP and EDR are not a completely separate solution. EDR is a core component of an EPP product. And many EPP vendors add EDR features to their EPP solution.