What does EDR stand for?
EDR stands for Endpoint Detection and Response. Endpoint software that records activity on hosts, detects suspicious behaviour and lets responders investigate and isolate a machine remotely.
An EDR agent on each workstation and server records what happens there: processes started, files written, registry changes, network connections. It detects suspicious behaviour, not only known malware files, and gives responders actions such as isolating the machine from the network or killing a process. Because it keeps the history, an analyst can see how an attack unfolded.
EDR in practice: an example
A user opens an invoice attachment. Word starts PowerShell, which downloads a file and tries to read credentials from memory. No signature matches the new file, but the chain of behaviour does, so the EDR raises an alert and the analyst isolates the laptop with one click.
What EDR is confused with
EDR vs XDR: what is the difference?
EDR covers endpoints only. XDR joins endpoint data with email, identity, cloud and network signals in the same product. What XDR stands for
EDR vs SIEM: what is the difference?
EDR is a deep source for one kind of device. A SIEM is the collector for every source, usually with less detail per endpoint. What SIEM stands for
Which exams cover EDR?
EDR is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
- CySA+ CS0-004: 1.3 (Security Operations).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Antivirus found nothing, but a server is running an unknown process that connects to an external address every 60 seconds. Which control is designed to detect and contain this?
- EDR
- A cable lock
- DHCP snooping
- A screen filter
Show the answer
A. EDR. EDR detects behaviour such as beaconing and lets the responder isolate the host. Signature-based antivirus misses files it has never seen.
2. During an investigation, what does EDR provide that a classic antivirus product does not?
- Faster boot times
- A recorded timeline of process and network activity
- Automatic software licensing
- Wireless coverage maps
Show the answer
B. A recorded timeline of process and network activity. The recorded telemetry is what lets an analyst reconstruct the attack. Antivirus reports a verdict on a file, not the sequence of events.
Sources: NIST glossary: endpoint detection and response; Microsoft Learn: Endpoint detection and response overview. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.