Hacker News Reader

EDR = Endpoint Detection and Response, EPP = Endpoint Protection Platform. The main difference, I gather from Wikipedia, is that EDR mainly alerts, and EPP actually stops the attack.

View on HN

More precisely, EDR (somtimes EDTR -- endpoint detection and threat response) is one component of a robust endpoint protection platform.

EPPs will consist of threat detection and response (EDR), as well as proactive prevention, vulnerability management, threat intelligence, data-loss prevention, encryption management, etc.

I have never heard of EPP but the premium version of Microsoft Defender and things like SentinelOne bill themselves as EDR and do in fact have response features to be able to delete the virus files or disable network access of the compromised device, kill running services, etc.

The R stands for Response.

Marketing for both of these companies now claims edr is obsolete and calls out the risk of using an edr product, with xdr being the cool acronym of the month to sell.

Reply on news.ycombinator.com