EDR (Endpoint Detection and Response)

Traditional antivirus mostly matches files against a list of known-bad signatures. EDR goes further: it watches what's actually happening on a device — unusual process behaviour, suspicious network connections, attempts to disable security tools — and can isolate a compromised device automatically before an incident spreads. It's the backbone of most modern SOC monitoring.