EDR Is Table Stakes. Operationalizing It Is the Hard Part.
Detection telemetry only matters if someone is reading it at 3 a.m. — and most teams still aren't.
Endpoint detection and response has won the procurement battle. Almost every mid-sized and enterprise security program now runs an EDR agent of some flavor, whether that's CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or one of the newer XDR-branded suites layered on top.
That's the easy part.
The harder question — and the one defenders keep losing on — is whether owning the tool translates into operational resilience. Buying telemetry is not the same as using it. Several intrusion sets tracked across vendor naming conventions, including clusters Mandiant labels UNC-prefixed financially motivated actors and the China-nexus activity Microsoft tracks under its Typhoon taxonomy, have repeatedly bypassed deployed EDR not by defeating the agent, but by exploiting the gap between alert generation and analyst response.
The pattern is familiar to anyone who has read post-incident reports for the last three years. Initial access lands. The EDR fires medium-severity telemetry. Nobody triages it for 14 hours. By then, the operator has dumped LSASS, moved laterally over SMB, and staged data in a directory the agent isn't watching closely. The product worked. The program didn't.
What separates organizations that actually convert EDR into resilience tends to come down to a handful of unglamorous practices.
First, continuous tuning. Out-of-the-box detection rulesets are calibrated for the median customer, not your environment. Suppression of benign developer behavior and elevation of identity-adjacent anomalies — credential access, token theft, OAuth grant abuse — has outsized impact.
Second, integration with identity telemetry. Most modern intrusions, including the activity overlapping with what CrowdStrike calls Scattered Spider and Mandiant tracks as UNC3944, are identity-first. EDR alone sees the endpoint half of the story. Pairing it with sign-in logs from Entra ID or Okta is where the picture closes.
Third, 24/7 coverage that is actually staffed, not just contracted. A managed detection and response retainer is not resilience if escalation paths break after hours.
Fourth, regular purple-team exercises against documented adversary TTPs — the MITRE ATT&CK techniques most relevant to your sector rather than a generic top-20 list.
None of this is novel. CTI analysts have been saying it in conference talks for years. But the gap between capability and intent applies to defenders too. Having the capability to detect Cobalt Strike beacons does not mean you intend to staff the SOC well enough to catch one on a Saturday.
The vendors know this, which is why nearly every EDR pitch now bundles a managed service. That's a reasonable answer for organizations without a mature SOC. It is not a substitute for owning the detection engineering function internally, at least at the architectural level.
EDR didn't fail at the organizations that got breached this year. The operational wrapper around it did.
