Adoption of EDR solutions
Adoption of EDR is projected to increase significantly over the next few years. According to Stratistics MRC’s Endpoint Detection and Response – Global Market Outlook (2017-2026), sales of EDR solutions—both on-premises and cloud-based—are expected to reach $7.27 billion by 2026, with an annual growth rate of nearly 26%.
One of the factors driving the rise in EDR adoption is the rise in the number of endpoints attached to networks. Another major driver is the increased sophistication of cyberattacks, which often focus on endpoints as easier targets for infiltrating a network.
New types of endpoints and endpoint attacks
An average IT department manages thousands of endpoints across its network. These endpoints include not only desktops and servers, but laptops, tablets, smartphones, internet of things (IoT) devices, and even smart watches and digital assistants. The SANS Endpoint Protection and Response Survey reports that 44% of IT teams manage between 5,000 and 500,000 endpoints. Each of these endpoints can become an open door for cyberattacks; therefore, endpoint visibility is critical.
While today’s antivirus solutions can identify and block many new types of malware, hackers are constantly creating more. Many types of malware are difficult to detect using standard methods. For example, fileless malware—a recent development—operates in the computer’s memory, thus avoiding malware signature scanners.
To bolster security, an IT department may implement a variety of endpoint security solutions, as well as other security applications, over time. However, multiple standalone security tools can complicate the threat detection and prevention process, especially if they overlap and produce similar security alerts. A better approach is an integrated endpoint security solution.
Key components of EDR security
EDR security provides an integrated hub for the collection, correlation, and analysis of endpoint data, as well as for coordinating alerts and responses to immediate threats. EDR tools have three basic components:
Endpoint data collection agents. Software agents conduct endpoint monitoring and collect data—such as processes, connections, volume of activity, and data transfers—into a central database.
Automated response. Pre-configured rules in an EDR solution can recognize when incoming data indicates a known type of security breach and triggers an automatic response, such as to log off the end user or send an alert to a staff member.
Analysis and forensics. An endpoint detection and response system may incorporate both real-time analytics, for rapid diagnosis of threats that do not quite fit the pre-configured rules, and forensics tools for threat hunting or conducting a post-mortem analysis of an attack.
- A real-time analytics engine uses algorithms to evaluate and correlate large volumes of data, searching for patterns.
- Forensics tools enable IT security professionals to investigate past breaches to better understand how an exploit works and how it penetrated security. IT security professionals also use forensics tools to hunt for threats in the system, such as malware or other exploits that might lurk undetected on an endpoint.
