Glossary term
EDR (Endpoint Detection and Response)
Also: Endpoint Detection and Response, Next-gen endpoint security
A class of endpoint security tools that continuously records endpoint activity and enables detection, investigation and response to threats that evade traditional antivirus. Most enterprise security incidents today are detected or contained at the EDR layer.
EDR replaced signature-based antivirus as the primary endpoint defence over the last decade. An EDR agent streams telemetry (process creation, file system activity, network connections, registry changes) to a backend that correlates and alerts on suspicious behaviour rather than known bad hashes.
Selecting an EDR is a consequential decision. The choice drives the operational posture of the security team, defines which MDR partners are viable, and locks in a data residency and telemetry model for years. EU customers under NIS2 or DORA need to verify data residency of the telemetry, not just the dashboard.
In practice
Typical dealbreakers in an EDR decision: EU telemetry storage, integration with existing SIEM and SOC tooling, support for the deployed OS mix (especially Linux and macOS), MITRE ATT&CK coverage depth, and contract-level exit and data-portability rights.
Related terms
XDR (Extended Detection and Response)
A security platform that unifies telemetry across endpoint, network, identity, email and cloud, correlating signals that would otherwise be siloed across point tools. XDR is EDR plus the context to detect multi-stage attacks that a single sensor would miss.
MDR (Managed Detection and Response)
A service that provides outsourced 24/7 monitoring, detection and response on top of an EDR or XDR platform. MDR replaces the need to staff a full in-house security operations centre while keeping incident ownership internal.
SIEM (Security Information and Event Management)
A platform that centralises security logs, enables long-term retention, runs correlation rules and supports investigation. SIEM is the evidence layer under EDR, XDR and SOC operations and the single largest line item in most security budgets.
EU AI Act
World's first comprehensive AI law. Four risk classes: prohibited, high-risk, limited (transparency), minimal. Phased application from February 2025 to August 2028.
Evidence grade
A grade attached to each claim in a decision memo, showing whether the claim is backed by primary source, vendor-confirmed evidence, independent research, or an assumption. Assumption-heavy memos carry visible warnings rather than quiet confidence.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.