EDR: Comparing benefits and risks

Back when I started to work in IT 20 years ago, we used pattern detection to scan for malware both on end user devices and file servers.

Nowadays EDR software does a lot more by using heuristics like behavior detection, information correlation with other sources in the network and so on.

A lot of this, but especially memory behavior analysis (to detect unknown malware) requires deep integration into the OS and quite a lot of permissions often including kernel space …

back behavior detection benefits correlation cybersecurity detection devices edr end end user file information lot malware network risks scan servers software work