Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Moving to EDR
Transcript
- Lucas: So I was looking at the latest Gartner Magic Quadrant for endpoint protection platforms, and one number jumped out at me — they now estimate that sixty-five percent of new enterprise endpoint deployments are going to an EDR solution, not traditional antivirus. Luna: That's a huge swing. Five years ago, that number was maybe twenty percent, right? Lucas: Yeah, closer to eighteen percent in 2021. The shift has been rapid, and a lot of it is driven by how attacks have evolved. Traditional antivirus — signature-based detection — looks for known malware. But attackers now use fileless techniques, living-off-the-land binaries, things that never drop a malicious executable. Luna: So EDR is basically watching what processes do, not just what files are present. Lucas: Exactly. EDR tools install an agent on the endpoint that collects telemetry — process creation, network connections, registry changes — and then uses behavioral analytics to flag anomalies. CrowdStrike's Falcon is probably the poster child here. They process trillions of events per day and use machine learning models trained on that data to detect novel attacks in real time. Lucas: And it's not just about detection. EDR includes response capabilities — isolate a machine, kill a process, roll back changes. That's the 'R' in EDR. Traditional antivirus could maybe quarantine a file, but it couldn't stop a ransomware attack that's already encrypting files from a legitimate script. Luna: Like the NotPetya-style attacks where the malware spreads via legitimate admin tools. Lucas: Right. That's exactly the kind of threat that signature-based AV completely misses. And the market is reflecting that. The global EDR market was about two point one billion dollars in 2023. By 2028, it's projected to hit five point six billion. That's a compound annual growth rate of over twenty-one percent. Luna: But EDR isn't cheap. For a mid-sized company with a thousand endpoints, you're looking at fifty to a hundred thousand dollars a year. That's a big jump from a legacy AV license that cost maybe ten grand. Lucas: It is. And yet the cost of a breach is so much higher. IBM's 2025 Data Breach Report pegged the average cost at four point eight eight million dollars. So the ROI argument is pretty clear if you look at it from a risk perspective. Luna: Still, some IT teams resist the switch. I've talked to CISOs who say their security team loves the EDR tool, but the IT operations team hates it because it generates too many alerts. Lucas: That's a real friction point. EDR tools can be noisy, especially if they're not tuned properly. You can get thousands of alerts per day, and if you don't have a skilled team to triage them, you get alert fatigue. That's why managed detection and response services are also growing. Luna: And that's where CrowdStrike's Falcon OverWatch fits in — they do the hunting for you. Lucas: Yeah, exactly. A lot of companies are buying EDR and then outsourcing the monitoring. But let me give you a concrete example of EDR in action. There's a mid-sized retailer in the Midwest — about two thousand endpoints — they implemented Falcon last year. Within a month, it detected a PowerShell script that was beaconing to a known command and control server. Luna: That's exactly the kind of thing traditional AV would miss — a legitimate Microsoft tool being abused. Lucas: Right. The script was running in memory only, never touched disk. Falcon's behavioral model flagged it because the PowerShell process was making outbound connections to an IP in Russia that had no business relationship with the company. The security team isolated that machine in under two minutes. Luna: And if they had been on legacy AV, that script would have had hours or days to move laterally. Lucas: Exactly. And look — if this kind of analysis is useful for what you're building or running, honestly, if today was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. It's listener support that keeps this show ad-free and focused on the details that matter. Luna: Yeah, it really helps us keep digging into stories like this one. Lucas: So back to the EDR shift — one area where I think the industry still has a gap is in how EDR integrates with SIEM systems. A lot of companies are running both, but they're not always well connected. Luna: You mean the EDR tool generates an alert, but it doesn't automatically feed into the SIEM for correlation with other data? Lucas: Right. And that's where you miss the bigger picture. An EDR alert might show a single workstation making a suspicious connection, but if you can't correlate that with network flows or cloud logs, you might not realize it's part of a broader campaign. Luna: That's actually one of the criticisms I've heard about EDR — it's endpoint-centric, not holistic. Lucas: It's a valid point. But the trend is toward platforms that unify EDR with network detection and response, and cloud workload protection. CrowdStrike, Microsoft, SentinelOne — they're all building out these broader XDR platforms. Luna: XDR being extended detection and response. Lucas: Yes, exactly. The idea is to break down the silos between endpoint, network, and cloud. And the market is responding. Gartner predicts that by 2028, fifty percent of organizations will have adopted an XDR platform, up from less than ten percent today. Luna: But for now, EDR is the entry point for most companies making the switch from legacy AV. Lucas: It is. And I think the biggest driver is simply that the threat landscape has changed. Ransomware alone is a multi billion dollar criminal industry, and traditional AV just doesn't stop it. The data backs that up — a 2025 report from Sophos found that companies using only traditional AV were three times more likely to experience a ransomware attack than those using EDR. Luna: Three times? That's a huge difference. Lucas: It is. And yet, a lot of smaller companies still haven't made the switch. Cost is a factor, but so is complexity. EDR requires more expertise to manage. That's why we're also seeing a rise in edr as a service offerings where the vendor handles the monitoring. Luna: So it's almost like the old managed security service provider model, but with better tech. Lucas: Exactly. And that model is growing fast. The global managed detection and response market was about one point eight billion in 2024, and it's projected to hit four point three billion by 2029. So there's clearly a demand for organizations that want the protection of EDR without having to staff a 24/7 security operations center. Luna: Let me play devil's advocate for a second. I've read some security researchers argue that EDR tools themselves create a new attack surface. If an attacker compromises the EDR agent, they can blind the security team. Lucas: That's a real concern. There have been cases where attackers have tampered with EDR agents to prevent them from sending telemetry. CrowdStrike and others have implemented protections — like kernel-level hooks and tamper-proofing — but it's an ongoing cat and mouse game. Lucas: I think the bigger risk, though, is misconfiguration. A poorly deployed EDR tool can be worse than no EDR at all because it gives a false sense of security. If alerts are not being reviewed, if the tool isn't tuned to the environment, you're essentially flying blind. Luna: So the tool is only as good as the processes around it. Lucas: Exactly. And that's where I think the industry needs to do a better job — not just selling the technology, but helping organizations build the operational maturity to use it effectively. Luna: What about the AI piece? A lot of EDR vendors are now touting ai powered detection. Is that real or just marketing? Lucas: It's real, but it's not magic. The machine learning models in EDR are trained on massive datasets of benign and malicious activity. They can detect novel attacks without needing a signature. But they also generate false positives. A good EDR team will tune the models to the specific environment — whitelisting known-good behavior, adjusting thresholds. Luna: So the AI handles the broad filtering, and humans handle the edge cases. Lucas: Exactly. And that's the model that works best. Pure human analysis is too slow. Pure AI is too noisy. The combination is where the value is. Luna: One thing I find interesting is that some industries are slower to adopt EDR. Manufacturing, for example, has a lot of legacy systems that can't run modern agents. Lucas: That's a huge challenge. Industrial control systems often run on older versions of Windows or even proprietary operating systems. You can't just install a CrowdStrike agent on a PLC. So those environments rely more on network segmentation and monitoring at the network level. Luna: But that's changing as OT security vendors start to offer lightweight agents. Lucas: Yeah, it's a growing segment. The operational technology security market is projected to grow from eighteen billion now to over thirty-five billion by 2030. So there's definitely a push to extend endpoint protection into those environments. Luna: I want to circle back to something you mentioned earlier about the cost of EDR. For a small business with fifty endpoints, is it worth it? Lucas: That's a tough question. The average ransomware demand for a small business is around one hundred and fifty thousand dollars. A good EDR solution for fifty endpoints might cost five to ten thousand a year. So the math works if you have a realistic view of your risk. But I'd say for very small businesses, a managed EDR service might be a better bet because they don't have the in-house expertise. Luna: So it's not a one-size-fits-all answer. Lucas: No, it's not. And I think the industry sometimes oversells EDR as a silver bullet. It's a critical tool, but it's part of a broader defense-in-depth strategy. You still need good patch management, strong access controls, user training, and incident response planning. Luna: But for most organizations, moving from legacy AV to EDR is a significant step forward. Lucas: Absolutely. The data is clear that organizations using EDR detect breaches faster, contain them faster, and ultimately pay less in breach costs. The IBM report showed that companies with extensive use of AI and automation in their security operations — which EDR enables — saved an average of one point seven six million dollars compared to those without. Luna: That's a compelling number. Lucas: It is. And as ai generated malware becomes more sophisticated — polymorphic code that changes its signature every time it runs — the need for behavioral detection will only grow. EDR is really the baseline now for any serious security program. Luna: So where do you see EDR in five years? Lucas: I think the lines between EDR, XDR, and SIEM will blur. Vendors are already building platforms that ingest data from endpoints, networks, cloud, and identity systems into a single data lake with unified analytics. The endpoint will remain a critical sensor, but it won't be the only one. And I think we'll see more automation in response — perhaps even autonomous response where the system can shut down a threat without human intervention in certain cases. Luna: That sounds promising, but also raises questions about trust and false positives. Lucas: It does. And that's why I think we'll see a gradual adoption rather than a sudden shift. Organizations will start with automated response for low-risk alerts and slowly expand as they build confidence. But the direction is clear — EDR is the foundation, and the future is about building on that foundation with more integration and automation. Luna: Alright, Lucas. So for someone listening who's still on legacy antivirus, what's the first step? Lucas: I'd say start with a pilot on a subset of endpoints — maybe fifty to a hundred — and run it alongside your existing AV. Evaluate the detection capabilities, the alert volume, and the operational overhead. Most vendors offer free trials. Then make a plan to migrate over six to twelve months. The key is to not rush it, but also not to wait until a breach forces your hand. Luna: Good advice. And on that note, we'll leave it there for today. Lucas: Thanks for listening. We'll be back next time with another deep dive into the business of cybersecurity.