In order to continue protecting your company to the highest level, it is now crucial to build an EDR capability on top of your EPP protection. There are two simple reasons for this: detection and response. While EPP allows you to receive notifications that malicious files or suspicious activities have been blocked, EDR takes things one step further. Firstly, EDR lets you see exactly what happened before EPP blocked a malicious file, giving the admin an understanding of the broad context of events.

This is where EDR moves from detection to response. With more information about events, EDR can react before malicious or destructive activity can take place. “Once something happens, then the response aspect becomes more critical. I hope that people don’t end up there, but if you do then you really need the advanced response capabilities of EDR,” Ville Korhonen, Senior Sales Engineer at WithSecure, admits.

By combining the detection and response capabilities offered by EDR bolted on to EPP, you can identify and react to a breach as it happens, offering the complete solution in a single pane. 

So, does this mean EPP is now obsolete? “Definitely not,” says Suvi Silvanto, WithSecure’s Director of Product Marketing. “You need EPP to provide a base level of security. However, threats keep on emerging and we must react to them with more powerful solutions,” she continues.

Korhonen agrees. “The vast majority of cyber attacks use Windows admin tools at some stage and that is where EPP does not have enough visibility.”

Unfortunately, many companies tend to opt for EDR after they have been breached, as only then do they realize how important overall visibility is. “If you don’t have EDR in place, it becomes super costly; if you're a smaller company you might not even have the means to get back on track for a long time, which can impact business continuity,” Silvanto insists.

“I would say around half of IT professionals really know and understand that they need more visibility, while others still believe that by having EPP they are ‘covered enough’. However, we need to educate people and explain what they are missing from a visibility perspective,” Korhonen explains. 

If you already have WithSecure Elements EPP, adding EDR takes less than five minutes. Once installed, security events begin to flow and are automatically analyzed using continuous machine learning combined with the latest threat intelligence data. Suspicious events are combined into Broad Context Detections, which are given a severity rating so that admin members can focus on only the most severe detections.

“At the end of the day, EDR needs to provide advanced security but also help the user's everyday work,” Silvanto believes.

At this point, you need to consider your response to possible detections, and this is where WithSecure's EDR places you firmly in the driving seat. Our 24/7, built-in automation allows you to respond immediately to real advanced threats and attacks, offering the ability to slow down or even stop attackers from reaching their objectives. This is achieved by enriching forensic artefacts from endpoints to help kickstart the fightback. We’re also with you all the way, providing the guidance and experience necessary to improve your team’s focus.