Ransomware preparation is the security investment that organizations discover the quality of during the worst possible moment. The backup strategy that was designed but not tested reveals its gaps when the organization needs to restore from it. The incident response plan that was written but not rehearsed reveals its gaps when the team is trying to execute it under pressure. The cyber insurance policy that was procured but not fully read reveals its requirements when the claim is filed.

Endpoint Detection and Response platforms replaced antivirus as the dominant endpoint security technology on the basis that signature-based detection could not keep pace with the volume and variety of modern malware. The replacement was justified. EDR’s behavioral detection, continuous telemetry, and forensic capability represent a genuine improvement over signature-based antivirus in detecting and investigating endpoint threats.

The marketing that followed — the promise of comprehensive endpoint security that would significantly reduce breach frequency and impact — overstated what the technology can deliver. EDR is better than what it replaced. It is not the endpoint security solution. Endpoints continue to be compromised at scale in organizations running mature EDR deployments because the threats that matter most have adapted to operate within the behavioral envelope that EDR considers legitimate.