Microsoft published a case in August where its endpoint tool cut a compromised machine off the network 128 seconds after the first alert. No analyst touched it.
That number is the entire argument for EDR, and it's worth understanding if you run a law firm and your security is still whatever antivirus came with the laptops.
Traditional antivirus is a bouncer with a photo list. It stops what it recognizes. Endpoint detection and response watches behavior instead. It doesn't need to have seen the file before. It notices that a document someone just opened launched a Windows utility that documents have no business launching, and it acts on that.
In the Microsoft case that's exactly what happened. A user opened a malicious file. Two detection engines flagged it within the same second. The machine was isolated from the network before the second stage could install anything.
Here's why the clock matters at a 15-attorney firm: the gap between something going wrong and someone noticing is usually hours. If it starts at 6pm, it's the whole night. Every one of those hours is an attacker moving toward your document management system and your billing.
It's also why I see EDR on more cyber renewal questionnaires every year.
Worth asking your IT provider which one you actually have running, and whether anyone is watching it.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email