EDR selection: the criteria that matter under NIS2 and DORA

Why it matters

Vendor-reported detection rates are marketing. What counts is performance in independent evaluations like MITRE ATT&CK, where every vendor is tested against the same adversary techniques under the same conditions.

Why it matters

The time between an attacker's first action on an endpoint and the first alert decides how much of the network they reach. A tool that detects a ransomware chain at the encryption stage has technically detected it and practically lost. Under NIS2 Article 23 your own 24-hour clock starts at awareness, and awareness starts with this alert.

Why it matters

Detection buys you a window; response is what you do with it. Time to respond is the time until a host is isolated, a process killed or an account disabled, and it is limited by whether the tool can act, who is allowed to trigger it and how fast the console reacts during an incident. It is the number your incident timeline will be judged on.

Why it matters

Detection without action is a notification. When an attacker moves laterally at 2am, what limits the damage is whether the tool can isolate the host from the network, kill the process, quarantine the file and roll back the changes on its own, under rules you set in advance. Under NIS2 the incident handling measure is judged by what happened, not by what was seen.

Why it matters

A tool that flags everything is as useless as one that flags nothing. High false positive rates burn out your SOC team and lead to real alerts being ignored. This is an operational cost that never shows up in the sales deck.

Why it matters

An EDR only protects the endpoints it runs on. Server estates are mostly Linux, developers and executives often use macOS, and the odd end-of-life Windows server or embedded system still carries production. A vendor that treats one of those as a second-class platform leaves exactly the systems an attacker looks for outside your detection, and the audit will count them as unprotected assets.

Why it matters

An EDR that takes nine months to reach every endpoint protects nothing for nine months, and the endpoints that are hard to reach, such as unmanaged laptops, factory PCs and servers with change freezes, are the ones that stay unprotected longest. Rollout effort is a security number as much as a project number.

Why it matters

The EDR agent runs on every endpoint. If it slows machines down, users notice, complain, and in the worst case try to disable it. A heavy agent is a security risk because it creates pressure to remove it.

Why it matters

If your team cannot staff a 24/7 SOC, the tool alone is not enough. A mature MDR offering means the vendor watches your environment when your team sleeps. Under NIS2, response time is not optional.

Why it matters

Attacks rarely stay on one endpoint. XDR is the promise that the tool correlates endpoint telemetry with identity, email, network and cloud signals into one incident instead of four alerts in four consoles. Whether that correlation exists for your sources decides whether the analyst sees an attack or a list.

Why it matters

An EDR tool that does not integrate cleanly with your SIEM, your ticketing, and your identity provider becomes an island. Isolated security tools create blind spots exactly where attackers operate, in the gaps between systems. And under NIS2 and DORA the SIEM is where the evidence for the incident timeline is expected to be.

Why it matters

Threat intelligence is what lets the tool recognise a known campaign in the first minute instead of after the analysis. Its value depends on freshness, on relevance to your region and sector, and on whether indicators are enriched with context the analyst can act on. Stale or generic feeds produce alerts nobody can prioritise.

Why it matters

NIS2 Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, and a full notification within 72 hours. If your EDR tool cannot reconstruct what happened on the endpoint and export the forensic data fast enough and in a usable format, you cannot meet that deadline, no matter how good the detection is.

Why it matters

Everything you want to automate around the EDR, from ticket creation to enrichment to a SOAR playbook that isolates a host and disables the account, runs through its API. An API that is rate-limited, incomplete or undocumented turns each automation into a support ticket, and the response you planned to automate stays manual.

Why it matters

A growing share of your workloads runs as cloud instances, containers and serverless functions that a classic endpoint agent never sees. If the EDR stops at the virtual machine, the systems that hold your data in the cloud are outside detection, and the same is true of the Kubernetes cluster your developers stood up last year.

Why it matters

The per-endpoint price is only part of the cost. Full platform value often requires higher tiers, add-on modules, and the MDR service. The number in the first quote and the number you pay in year two are frequently very different.

Why it matters

EDR tools collect enormous amounts of telemetry from your endpoints, including usernames, file names and command lines. Where that data is processed and stored has direct GDPR implications, and for a regulated organisation the vendor's own attestations (SOC 2, ISO 27001) are what goes into the supplier file. A US-headquartered vendor may route telemetry through US infrastructure, which creates Schrems II exposure.

Why it matters

When the agent breaks a production system or the console is down during an incident, the vendor's support is part of your incident response. The support SLA decides whether you get an engineer within the hour or a ticket number within the day, and whether the vendor's own incident response team can be pulled in when your investigation exceeds your capacity.

Why it matters

Switching EDR means re-deploying an agent to every endpoint and losing the telemetry history, the tuned exclusions and the detection customisations you built. That switching cost is what lets a vendor raise prices at renewal. Under DORA an exit strategy for critical ICT services is expected; under NIS2 it is simply what keeps you negotiating from strength.

Why it matters

You buy an EDR for three years, and the threat landscape changes every quarter. Whether the vendor invests in the techniques that matter to you, from identity-based intrusions to living-off-the-land and cloud pivots, decides whether the tool still detects the attacks of year three. A roadmap is also a signal of whether the vendor will still exist independently by then.

Why it matters

EDR is licensed per endpoint, per user, per server, or in bundles that mix all three, and the same estate costs very different amounts under each model. Virtual desktops, shared shop-floor machines, servers that scale up and down and contractors with two devices each break the assumptions behind a per-endpoint or per-user price.

Why it matters

The quote covers year one at today's endpoint count. The costs that surprise come later: telemetry retention beyond the base window, data export fees, the module that turned out to be required for the integration, the price increase at renewal, and the professional services for the rollout that nobody itemised.

Why it matters

At the end, the decision needs one number per vendor that can be compared: the quoted licence price for the configuration you will actually run, over the term you will actually sign. Every other criterion in this catalog feeds into how much that number is worth; this one makes sure it exists and that it is comparable.