EDR (Endpoint Detection and Response) provides behavioral monitoring, threat detection, forensic investigation, and response capabilities on endpoints — far beyond traditional AV.
EDR records all endpoint activity (process creation, network connections, file changes, registry modifications) for investigation. Behavioral analysis detects unknown threats. Remote isolation capability for IR. Leading EDR: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Essential for modern enterprise.