SECAI Core · phase 13 of 15 · noun
Endpoint detection and response
A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats.
The Explain card
- Plain English
- EDR is a software agent on laptops, servers and workstations that collects system data and logs, sends them to a monitoring platform, and enables early detection of threats and remote response actions.
- Example
- A data scientist loads a downloaded model file that executes hidden code on deserialization. The EDR agent sees Python spawn a reverse shell, isolates the host and alerts the SOC.
- Why it matters
- AI development happens on endpoints full of credentials, datasets and GPU access. EDR is often the only control that sees what a malicious model or package actually does once it runs.
- Hook
- A body camera on every machine.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The security team used endpoint detection and response to isolate a laptop after it launched an unauthorized PowerShell process.
Why these words
- endpoint English end plus point identifies the device at the edge of a network
- detection Latin detectio, an uncovering names the act of discovering suspicious activity
- and Old English and joins discovery with the action that follows
- response Latin responsum, an answer names the action taken after discovery
Where it came from
- Origin
- English cybersecurity coinage from endpoint, detection, and response, popularized by Gartner analyst Anton Chuvakin
- Entered the language
- 2013
- What changed
- Endpoint moved from a general final point to a network-connected device, while detection and response became a paired cybersecurity formula.
How it is spelled
- Pattern
- endpoint is written as a closed compound
- Pattern
- detection follows the verb-plus-tion pattern
- Pattern
- the phrase uses and to coordinate two action nouns
- Breaks the pattern
- response uses s where the related verb respond uses d
Spelled like
- viewpoint
- standpoint
- inspection
- collection
Broken into chunks
-
end + point
- endpoint
- viewpoint
- standpoint
-
detect + ion
- detection
- detector
- detectable
-
respons
- response
- responsive
- responsibility
What it sits beside
Same subject
- antivirus
- security information and event management
- intrusion detection system
- threat hunting
Same shape
- network detection and response
- managed detection and response
- extended detection and response
detection and response terms
- endpoint detection and response
- network detection and response
- managed detection and response
- extended detection and response
Where it sits in the deck
Phase 13: Detection, Monitoring, and Threat Intelligence
Defenses eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.
