# What is Endpoint Detection and Response?

> Endpoint Detection and Response

It is a security system that protects computers and servers against cyberattacks and monitors suspicious activities.

## Overview
EDR continuously monitors network-connected devices (endpoints) to identify abnormal behaviors. When it detects a virus or an attack attempt, it reports it and can automatically block it. Its difference from traditional antivirus software is that it does not just scan files, but analyzes all activities within the system.

*Analogy: It is like a security guard at the building entrance who not only monitors those entering but also watches the movements of everyone inside the building via cameras and sounds an alarm in case of a suspicious situation.*

## How it works
A small piece of software is installed on devices; this software monitors all processes, network connections, and file changes in the system. The collected data is analyzed at a central location, and the system administrator is notified when a threat is detected.

## Where it is used
It is used as a security layer in corporate company networks, on servers, and on employees' laptops.

## Commonly confused with
It can be confused with traditional antivirus software; EDR has a much deeper monitoring and intervention capability.

## Frequently asked questions
**Does EDR block every attack?**
No system provides 100% protection, but EDR enables attacks to be detected and stopped much faster.

**Is it necessary for individual users?**
It is generally designed for corporate structures; simpler security solutions may be sufficient for individual users.


## Related terms
- [Vulnerability Scanning](/en/dictionary/vulnerability-scanning/)
- [Cybersecurity Skills](/en/dictionary/cybersecurity-skills/)
- [Server Hardening](/en/dictionary/server-hardening/)

---
Source: TreScout Dictionary · https://trescout.com/en/dictionary/edr/