Skip to content
←Back to glossaryCyber

EDR / XDR (Endpoint Detection and Response / Extended Detection and Response)

Behavioral detection and incident-response solutions for endpoints and, in the case of XDR, across all infrastructure layers.

Definition

On July 19, 2024, a content update to CrowdStrike's Falcon sensor crashed 8.5 million Windows machines, by Microsoft's count. The agent meant to protect the fleet took it down. An EDR (Endpoint Detection and Response) is that agent: installed on every workstation and server, it continuously collects system events, judges behavior rather than antivirus signatures, and can isolate a host or kill a process on its own. Its telemetry (launched processes, network connections, modified files, registry keys) is what incident responders use afterward to rebuild the attack. XDR (Extended Detection and Response) extends the same logic to network, email, cloud and identity, correlating those sources to follow an attack chain end to end. The cyber market has made it a first-tier underwriting criterion: applications ask for EDR deployment rates and who watches the alerts, and some carriers only put up larger limits with EDR in place. July 2024 showed the flip side: one agent, deployed everywhere with kernel privileges, is itself an accumulation point. MDR hands the running of the tool to a provider that watches the alerts around the clock. A non-malicious incident like the July 2024 one only reaches a cyber policy through a system failure extension, when the contract has one.

Its 7 cross-references, woven across the glossary's 18 categories
EDR / XDR (Endpoint Detection and Response / Extended Detection and Response): Cyber glossary illustration, AlgoPolis
Example

Hypothetical case: a cyber insurer analyzes its portfolio and finds that the average loss ratio for insureds with a certified EDR is 35 percent lower than for those without. It adds the criterion to its application form, with a schedule of premium credits of up to 12 percent.

Read next
CyberSOC / CIRT (Security Operations Center / Cyber Incident Response Team)Security monitoring and cyber incident response team, whose existence and maturity are a cyber underwriting criterion.Read the entry →CyberSIEM and SOARLog correlation and incident-response automation platforms that reduce threat detection and handling times.Read the entry →CyberLateral movementThe phase of a cyberattack in which the attacker moves from system to system after initial compromise, seeking higher-value targets.Read the entry →
Put it to work
QuizThe controls cyber underwriting looks at, and what they proveAcademy questions on this concept, each one marked and explained.Test yourself →SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Related articles
Also known as

EDR, XDR, Endpoint Detection and Response, Extended Detection and Response, Endpoint detection and response (EDR)

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.