Endpoint detection and response: EDR and managed detection for agencies

Reference article · 5 min read

Insurers, state grant programs, and auditors increasingly ask agencies whether endpoint detection and response is deployed across their environment. That sounds like a product question. It usually is not. Most agencies can acquire capable EDR software without much difficulty, often bundled with operating system or productivity licensing they already hold. The harder question is whether anyone is looking at what the software reports at two in the morning on a holiday weekend.

This article explains what separates EDR from traditional antivirus, why the staffing question dominates the technology question, and what to ask before committing to a subscription that recurs on the budget every year.

What EDR does that antivirus does not

Traditional antivirus works mostly by recognition. It compares files against signatures of known malicious code and blocks the matches. That model still stops a large volume of commodity malware and it is cheap to run. It struggles when an intruder uses no malicious file at all: stolen credentials, built-in administrative tools, a scheduled task, a legitimate remote access utility installed by someone who should not have it.

EDR takes a different approach. An agent on each device records behavior, including processes that start, what launched them, network connections, file and registry changes, and credential access attempts. That telemetry goes to a console where it is correlated and scored. When a pattern resembles an attack, an alert is raised, and the recorded history lets an analyst reconstruct what happened before and after.

Two consequences follow. EDR can detect activity no signature would ever match. And EDR produces alerts that require human judgment, because behavior that is malicious in one context is routine in another. A script pushing software to a hundred machines is either your systems administrator or a serious problem.

The decision most agencies actually face

An EDR console nobody reads is an expensive logging system. Ransomware operators do not keep business hours, and the window between initial access and encryption can be short. A small IT staff cannot reasonably provide continuous coverage alone. The honest options are few.

Business hours monitoring in house. Acceptable only if you also accept that a Friday evening intrusion runs until Monday.
Managed detection and response. A vendor's analysts watch the console continuously, triage alerts, escalate real incidents to named agency contacts, and in many arrangements take containment actions directly.
A shared or state provided security operations center. Some states offer monitoring to local agencies, sometimes subsidized. Some counties extend coverage to cities, districts, and special districts within their boundaries. Availability varies and changes; ask your state chief information security officer's office what exists today.
A hybrid. Agency staff handle daytime triage and a vendor covers nights, weekends, and holidays.

The recurring cost that insurers and grant reviewers are really pricing is the monitoring, not the license.

Coverage gaps that survive deployment

Agencies often report EDR as fully deployed when it is not. The gaps are predictable.

Servers. Domain controllers, file servers, and application servers matter most, yet they are often excluded over performance concerns or an application vendor's objection. Get that objection in writing rather than assuming it.
Contractor and vendor laptops. Anyone with remote access into your network is part of your attack surface. Either issue managed devices or require equivalent protection in the contract, with evidence.
Operational technology. SCADA and water controls, traffic signal systems, and building automation often run platforms the agent does not support, or carry warranties that forbid added software. Network monitoring and segmentation usually substitute. Do not report OT as covered because the engineering workstation beside it is.
Unmanaged equipment. Elected officials' personal laptops, legacy kiosks, and machines that never joined the domain stay outside quietly.
Cloud and identity. Endpoint telemetry alone will not show an attacker operating in your email tenant. Ask how identity and cloud signals are brought in.

Tuning and containment authority

Every deployment generates false positives at first, many from software peculiar to government: permitting and assessment applications, dispatch systems, legacy line of business tools. Plan for a tuning period with a named person on each side responsible for closing out exclusions, and keep a written record of every exclusion, because exclusions are where later attacks hide.

Isolation is what makes EDR operationally useful and politically sensitive. A tool that can cut a device off the network can also cut off the workstation running a pump station or a dispatch console. Decide in advance, in writing, which asset classes an analyst may isolate without calling first, which require a call, and who answers that call at three in the morning.

Questions to ask before signing

Who monitors the console, from what facility, and during what hours? Is coverage continuous or on call?
What is the committed time to acknowledge and to begin triage on a high severity alert, and how is it measured?
What actions may your analysts take without our approval, and what requires it?
How do we reach you outside business hours, and what happens if our primary contact does not answer?
Do we receive a written incident report, and who owns and can export the telemetry if we leave?
Is incident response labor included during an actual event, or billed separately?
What happens to pricing at renewal?

Put the response commitments in the contract with a remedy attached, not in a marketing document. Ask a reference agency of similar size how a real after hours alert actually went.

HQT works with state and local agencies on endpoint security planning, deployment coverage, and evaluating monitoring arrangements.

Frequently asked questions

What is the difference between EDR and antivirus?

Antivirus mostly compares files against signatures of known malicious code and blocks matches, which works well against commodity malware but not against attacks that use stolen credentials or built-in system tools. EDR places an agent on each device that records behavior such as process launches, network connections, and file changes, then correlates that telemetry to raise alerts and preserve a history an analyst can investigate. Many products now include both, so the practical difference is less about the software than about whether behavioral alerts are being reviewed and acted on.

Do we need 24/7 monitoring, or can our IT staff watch the EDR console?

EDR produces alerts that require human judgment, and intrusions frequently begin outside business hours, so an alert raised on a Friday evening may sit unread until Monday if only agency staff are watching. Small IT teams rarely can sustain continuous coverage without burning out staff or paying significant on-call costs. Most agencies close the gap with managed detection and response, a state or county provided security operations center where one is available, or a hybrid where staff cover daytime and a vendor covers nights and weekends.

What is managed detection and response, and how is it different from buying EDR software?

Managed detection and response is a service in which a vendor's analysts monitor your EDR console, triage the alerts, and escalate genuine incidents to your named contacts, often with authority to contain affected devices. Buying EDR software gets you the sensor and the console; MDR is what supplies the people who read it. Because the ongoing labor is the larger part of the value, the response commitments and escalation path deserve more scrutiny during procurement than the detection features do.

Can EDR agents be installed on SCADA and other operational technology?

Often not. Industrial control systems, traffic signal controllers, and building automation platforms may run operating systems the agent does not support, or carry vendor warranties and support terms that prohibit added software. Agencies usually protect these environments through network segmentation, passive network monitoring, and strict remote access controls instead, and should describe that approach accurately rather than reporting the assets as EDR covered.

Will cybersecurity grant funds cover the recurring cost of EDR or MDR?

Some federal and state cybersecurity grant programs have allowed endpoint detection and monitoring services as eligible costs, though program rules, match requirements, and limits on recurring or ongoing expenses differ and change between funding cycles. Grant funding is also typically time limited, so agencies should plan how the subscription will be sustained in the operating budget once the award period ends. Confirm current eligibility with your state administering agency and the published notice of funding opportunity before assuming coverage.