10/26/2026
Antivirus asks whether a file is known to be bad. Many modern attacks never need one.
Attackers sign in with valid credentials, use legitimate administrative tools that are already on your systems, and move slowly enough to look like an ordinary employee. There is no malicious file to match against a signature.
Endpoint detection and response (EDR) watches behavior instead: a user suddenly running remote administration tools on a laptop at 2 a.m., credentials being pulled from memory, a backup service being switched off. That's the difference between an alert and an incident.
Detection raises a second question, though: who is looking at the alert at 2 a.m. on a Sunday? A tool that fires with nobody watching is a log entry. That's the job of managed detection and response: people who triage, investigate, and isolate a device before Monday morning.
Four questions to ask your current provider:
1. Is EDR on every device, including servers?
2. Who receives the alerts, and when?
3. How quickly can a compromised device be isolated?
4. Is that written into our agreement, or just implied?
A good answer is a name and a number. A weak one is "the system monitors it."
Who is watching your endpoints overnight? https://hubs.li/Q04B9tRT0
