Endpoint devices are one of the weakest links in every organization’s network today due to the shift towards hybrid work culture. You need to protect endpoints from becoming a hacker’s gateway into your corporate environments, but at the same time you don’t want to make it too complex. Fortunately, there are many solutions available for endpoint security. According to Gartner, the two leading categories of technology in the advanced endpoint security space are Endpoint Detection and Response (EDR) and Endpoint Protection Platform (EPP). Read this article to find out the purpose of the two and how can they be used to help secure your endpoints.

How does EDR (Endpoint Detection and Response) work?

EDR uses real-time analytics and AI-driven automation to protect organizations against cyber threats that get past antivirus software and other traditional endpoint security technologies. EDR collects data continuously from all endpoints on the network – desktop and laptop computers, servers, mobile devices, IoT (Internet of Things) devices and more. It analyzes this data in real-time for evidence of known or suspected cyberthreats and can respond automatically to prevent or minimize damage from threats it identifies.

EDR solutions typically combine five core capabilities:

• Continuous endpoint data collection
• Real-time analysis of this data to identify threat patterns
• Automated threat response to remove or contain them, and notify security personnel
• Threat isolation and remediation
• Support for threat hunting

Studies estimate that as many as 90% of successful cyberattacks and 70% of successful data breaches originate at endpoint devices. While antivirus, anti-malware, firewalls and other traditional endpoint security solutions have evolved over time, they’re still limited to detecting known, file-based or signature-based endpoint threats. EDR picks up where these traditional endpoint security solutions leave off. Its threat detection analytics and automated response capabilities can – often without human intervention – identify and contain potential threats that penetrate the network perimeter, before they can do serious damage. EDR also provides tools that security teams can use to discover, investigate, and prevent suspected and emerging threats on their own.

According to the Endpoint Detection and Response – Global Market Outlook (2017-2026) report, the adoption of cloud-based and on-premises EDR solutions are going to grow 26% annually, and will be valued at $7273.26 million by 2026.

How does EPP (Endpoint Protection Platform) work?

Endpoint protection platforms aim to prevent traditional threats such as known malware and advanced threats such as ransomware and zero-day vulnerabilities. An EPP is an integrated security solution designed to detect and block threats at device level. Typically, this includes antivirus, anti-malware, data encryption, personal firewalls, intrusion prevention (IPS) and data loss prevention (DLP).

An EPP detects malicious activity using several methods:

• Signature matching – Detecting threats using known malware signatures
• Sandboxing – Executing files in a virtual environment to inspect for malicious behavior before allowing them to run.
• Behavioral analysis – Determining the baseline of endpoint behavior and identify behavioral anomalies, although there is no known threat signature
• Static analysis – Analyzing binaries and searching for malicious characteristics before execution using machine learning algorithms
• Blacklisting and whitelisting – Blocking access or only permitting access to specific applications, IP addresses, URLs or ports.

Do you need both EDR and EPP?

EPP tools provide basic security capabilities such as anti-malware scanning, while EDR tools provide more advanced features such as security incident detection and investigation. It is obvious to security practitioners that both EPP and EDR capabilities are required for complete endpoint security. As a result, the market needs to move to a unified and a comprehensive solution i.e. a Next Generation Endpoint Security, which brings you the best of both worlds thereby reducing the complexity.