An endpoint detection and response (EDR) agent runs with the highest privileges on every machine you own, so the product you choose is both your main source of attack evidence and one of your largest single points of failure. Buyers face overlapping labels: endpoint protection platforms (EPP), EDR, extended detection and response (XDR) and managed detection and response (MDR) are often sold as one bundle, while test results, telemetry depth and response controls differ sharply between products. This vendor-neutral guide is for security operations, endpoint and architecture teams writing requirements, running an RFP or replacing an incumbent. It covers what to define first, how to read independent tests without being steered by marketing, the platform's own security, and a proof of concept you can run in four to six weeks.
Key takeaways
- Decide what you are buying first. EPP prevents, EDR records and responds, XDR correlates endpoint with identity, email and cloud signals, and MDR adds people. Most organisations need prevention plus detection, and the real choice is who runs it.
- Telemetry depth and retention decide investigations. Ask how many days of raw, searchable endpoint events you get, on which operating systems, and what longer retention costs.
- Use independent tests as evidence, not rankings. MITRE says its ATT&CK Evaluations "do not rank vendors"; read the per-step results for the techniques that matter to you and check false alarms.
- Kernel-level agents carry outage risk. Score update controls, staged rings and recovery as hard as detection, because a bad agent update can stop the fleet.
- The console and its API are tier-zero. Live response, isolation and script execution on every endpoint sit behind admin roles and API identities that need the same controls as domain administrators.
Define requirements
Start with the estate and the team. Count endpoints by operating system and role (Windows workstations, Windows servers, macOS, Linux servers, virtual desktops, cloud workloads, containers), note which are offline or air-gapped, and record who will watch alerts outside office hours.
| Category | What it does | Choose it when |
|---|---|---|
| EPP (next-generation antivirus) | Blocks known and suspicious files, scripts and exploits before execution; limited history | Small estates with no one to triage alerts; always as the prevention layer of EDR |
| EDR | Continuous recording of process, file, registry, network and user activity, detection analytics, hunting and response actions | You have analysts, or a provider, who can investigate and act on alerts |
| XDR | EDR plus correlation with identity, email, cloud app, cloud workload and network signals into single incidents with cross-domain response | Attacks you care about cross endpoint, identity and SaaS; you want fewer consoles |
| MDR | A provider operates EDR or XDR for you: monitoring, triage, hunting and agreed response, 24x7 | No in-house 24x7 SOC, or you need to extend one. See the MDR Guide |
- Operating system coverage: list supported versions per platform and what is missing. Feature parity is rare: one major platform documents full network isolation on Windows 10 version 1703 and later, Windows 11 and supported Linux, but selective isolation only on Windows.
- Prevention versus detection: decide which behaviours must be blocked automatically (ransomware encryption, credential dumping from LSASS, exploit chains) and which only alerted. See the Ransomware Prevention Guide.
- XDR signal sources: list the identity provider, email platform, SaaS apps, cloud accounts and firewalls you expect to correlate, and whether you need an open XDR (third-party sources) or accept one vendor's stack.
- Data handling: where telemetry is stored, for how long, and who at the vendor or MDR provider can see it.
- Control obligations: NIST SP 800-53 SI-3 (malicious code protection), SI-4 (system monitoring) and IR-4 (incident handling); CIS Controls v8.1 Safeguards 10.1 (anti-malware), 13.2 and 13.7 (host-based intrusion detection and prevention); ISO/IEC 27001:2022 Annex A 8.7 (protection against malware) and 8.16 (monitoring activities). US federal memo OMB M-22-01 describes EDR as combining "real-time continuous monitoring and collection of endpoint data" with automated analysis and response.
Size changes the answer. Below a few hundred endpoints with no security team, EPP plus MDR is usually safer than a self-run EDR nobody watches. Large estates with a SOC need deep telemetry, a hunting query language, full API and SIEM streaming, and often XDR correlation. See the SOC Guide.
Evaluation criteria
| Criterion | What good looks like | Weak signs |
|---|---|---|
| Prevention | Behavioural blocking of ransomware, credential theft and exploit chains, with configurable block or audit per rule | Signature-heavy blocking; no audit mode for new rules |
| Telemetry depth | Process tree, command lines, script content, file, registry, network, module loads and authentication events on every supported OS | Alerts only, or rich data on Windows and thin data elsewhere |
| Retention and hunting | Stated days of raw searchable data (30 days of raw signals is a documented baseline in one major XDR), affordable extension, query language and saved hunts | Retention unstated; hunting limited to alert data |
| Response actions | Isolate host, kill process, quarantine file, block indicator, collect forensics, live response, with approval levels per action and device group | All-or-nothing automation; no undo; live response open to every analyst |
| Tamper protection | Agent cannot be stopped, uninstalled or reconfigured locally, exclusions locked, uninstall needs a one-time code, tamper alerts | Local admins can disable the agent or add exclusions |
| Update safety | Staged rings for both agent and detection content, customer-controlled deferral, documented rollback and recovery | Content updates pushed to the whole fleet at once with no customer control |
| Performance | Published CPU, memory and disk budgets; tested on your oldest hardware and busiest servers | No figures; build servers slow down noticeably |
| XDR correlation | Identity, email, SaaS and cloud signals joined into one incident with cross-domain actions, such as disabling an account or purging an email | "XDR" that is a dashboard of separate alerts |
| Integrations and API | Full API, streaming to SIEM and data lake, SOAR actions, scoped API permissions | Read-only exports; API keys with full tenant rights |
| Pricing | Clear per-endpoint or per-user price including servers, retention, MDR and add-on modules | Core features priced as add-ons; ingestion charges for your own data |
Reading independent tests
MITRE ATT&CK Evaluations emulate a named adversary's behaviour step by step and publish what each participating product saw, alerted on or blocked. MITRE states the evaluations "do not rank vendors but provide objective, evidence-based results". The 2025 Enterprise round added more weight on protection, rebalanced detection "to prioritize high-fidelity alerts", tested reconnaissance detection for the first time and included cloud infrastructure (SecurityWeek report). A separate managed services track evaluates MSSP and MDR providers. Not every vendor takes part, so absence is not failure. Commercial labs add different evidence: the AV-Comparatives Endpoint Prevention and Response test scores active and passive response across three attack phases, counts false alarms on clean scenarios and models five-year cost per agent. Use results to build PoC test cases, not to shortlist by headline score.
Agent stability and the kernel
Most EDR agents use kernel drivers to see and block activity, so a faulty update can crash the operating system. In July 2024 a defective content update to one widely deployed agent left Windows machines worldwide unable to boot, and many needed hands-on recovery. Microsoft has since said security products "can run in user mode just as apps do" on a new Windows platform, and its partner programme requires that security product updates "be gradual, leverage deployment rings and leverage monitoring" (Windows Resiliency Initiative). Ask each vendor for its roadmap out of the kernel, whether you can stage detection content as well as agent versions, and how a boot-looping fleet is recovered. Attackers also target the agent: ATT&CK T1685 Disable or Modify Tools notes the use of "legitimate drivers or debugging mechanisms to render tools non-functional". See the EDR Evasion and Defence Guide.
Where identity fits: console and API security
Whoever controls the EDR console can isolate, run scripts on or open a remote shell to every endpoint. The Stryker Intune wiper attack showed what one hijacked admin account on a fleet-wide management platform can do. Integrations are non-human identities: in one major EDR, an app registered with application permissions can "Access the API as a service" using a client secret or certificate, and the Machine.Isolate permission lets it take endpoints off the network with no user involved. Require scoped admin roles by action and device group, phishing-resistant MFA, approval for live response and bulk actions, read-only API scopes by default, certificate or federated credentials instead of static secrets, and admin and API audit logs in the SIEM. See the Service Account Security Guide and API Key Management Guide.
Questions to ask vendors
- For each OS we run, which telemetry types, prevention features and response actions are missing compared with Windows?
- How many days of raw, searchable telemetry are included, and what does 90 or 365 days cost?
- Which ATT&CK Evaluations rounds did you enter, and can you walk us through your results for the steps that match our threat model?
- Can we stage both agent and detection content updates through our own rings, defer them, and roll back? What happened to customers during your last faulty update?
- How is tamper protection enforced, what can a local administrator still change, and how is troubleshooting mode controlled and logged?
- Which response actions can require approval, at what scope, and can automated remediation be undone?
- Which API permissions allow isolation, live response or script execution, and can integrations be limited to read-only with certificate credentials?
- If we use your MDR service, which actions can your analysts take without asking, and how fast must they notify us?
Red flags
- Marketing that presents ATT&CK Evaluation results as a ranking or claims "100%" without showing per-step detail and false alarm data.
- No customer control over the timing of detection content updates.
- Agent can be disabled by a local administrator, or exclusions can be added from the endpoint.
- Linux or macOS "support" that lacks response actions or deep telemetry.
- Retention so short that a breach found after a month cannot be investigated.
- Integrations that need a global admin account or a tenant-wide API key.
Proof of concept
- Scope it: 100 to 300 endpoints across every OS in scope, including a domain controller, a build server, a virtual desktop and an old laptop. Agree pass criteria and a rollback plan (uninstall procedure and re-enable of the incumbent) first.
- Deploy in audit mode: run alongside the incumbent where supported, with prevention rules set to audit for two weeks, and measure CPU, memory, boot time and application compatibility.
- Emulate attacks: run the published ATT&CK Evaluation emulation plans or your red team's playbooks, covering credential dumping, lateral movement, persistence and ransomware behaviour. Record detected, blocked and missed per step.
- Measure noise: count alerts on normal admin activity (remote management tools, scripts, software deployment) and tune exclusions only through the console.
- Test response: isolate a host, kill a process, collect forensics and release isolation. Time each action and confirm approvals and audit records.
- Attack the agent and console: try to stop the service and add exclusions as local admin, then try destructive actions from a read-only API identity. Confirm alerts reach the SIEM.
- Test updates and recovery: push an agent update through two rings, pause the second, and document recovery steps for a host that fails to boot.
- Measure and decide: track detection coverage of emulated steps, false positives per 1,000 endpoints per day, mean time to detect and to contain, agent health (percentage reporting within 24 hours), and the number of admin and API identities with response rights.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Endpoint Security Guide · EDR Evasion and Defence Guide · MDR Guide · SOC Guide · ITDR Guide