The original endpoint security software, antivirus software protects endpoints against known forms of malware - Trojans, worms, adware and more.

Traditional antivirus software scanned the files on an endpoint device for malware signatures - strings of bytes characteristic to known viruses or malware.  The software alerted the user or admin when a virus was found, and provided tools for isolating and removing the virus and repairing any infected files.

Today's antivirus software, often called next-generation antivirus (NGAV), can identify and fight newer types of malware, including malware that leaves no signature. For example, NGAV can detect fileless malware - malware that resides in memory and injects malicious scripts into the code of legitimate applications. NGAV can also identify suspicious activity using heuristics, which compare suspicious behavior patterns to those of known viruses, and integrity scanning, which scans files for signs of virus or malware infection.

Antivirus software alone may be adequate for securing a handful of endpoints. Anything beyond that typically requires an enterprise protection platform, or EPP. An EPP combines NGAV with other endpoint security solutions, including:

• Web control: Sometimes called a web filter, this software protects users and your organization from malicious code hidden in web sites, or within files users download. Web control software also includes whitelisting and blacklisting capabilities that let a security team control which sites users can visit.
• Data classification and data loss prevention: These technologies document where sensitive data is stored, whether in the cloud or on premises, and prevent unauthorized access to, or disclosure of, that data.
• Integrated firewalls: These firewalls are hardware or software that enforce network security by preventing unauthorized traffic into and out of the network.
• Email gateways: These gateways are software that screen incoming email to block phishing and social engineering attacks.
• Application control: This technology enables security teams to monitor and control the installation and use of applications on devices and can block the use and execution of unsafe or unauthorized apps.

An EPP integrates these endpoint solutions in a central management console, where security teams or system admins can monitor and manage security for all endpoints. For example, an EPP can assign the appropriate security tools to each endpoint, update or patch those tools as needed, and administer corporate security policies.

EPPs can be on-premises or cloud-based. But industry analyst Gartner (link resides outside ibm.com), which first defined the EPP category, notes that ‘Desirable EPP solutions are primarily cloud-managed, allowing the continuous monitoring and collection of activity data, along with the ability to take remote remediation actions, whether the endpoint is on the corporate network or outside of the office.’

EPPs focuse on preventing known threats, or threats that behave in known ways. Another class of endpoint security solution, called endpoint detection and response(EDR), enables security teams to respond to threats that sneak past preventative endpoint security tools. 

EDR solutions continuously monitor the files and applications that enter each device, hunting for suspicious or malicious activity that indicates malware, ransomware or advanced threats. EDR also continuously collects detailed security data and telemetry, storing it in a data lake where it can be used for real-time analysis, root cause investigation, threat hunting and more.

EDR typically includes advanced analytics, behavioral analysis, artificial intelligence (AI) and machine learning, automation capabilities, intelligent alerting, and investigation and remediation functionality that enable security teams to:

• Correlate indicators of compromise (IOCs) and other endpoint security data with threat intelligence feeds to detect advanced threats in real time.
• Receive notifications of suspicious activity or actual threats in real time, together with contextual data that can help isolate root causes and accelerate threat investigation. 
• Perform static analysis( analysis of suspected malicious or infected code) or dynamic analysis (execution of suspcious code in isolation).
• Set thresholds for endpoint behaviors and alerts for when those thresholds are exceeded.
• Automate responses, such as disconnecting and quarantining individual devices, or blocking processes, to mitigate damage until the threat can be resolved.
• Determine if other endpoint devices are being impacted by the same cyberattack.

Many newer or more advanced EPPs include some EDR capabilities, but for complete endpoint protection encompassing prevention and response, most enterprises should employ both technologies.

Extended detection and response, or XDR, extends the EDR threat detection and response model to all areas or layers of the infrastructure, protecting not only endpoint devices but applications, databases and storage, networks, and cloud workloads. A software-as-a-service (SaaS) offering, XDR protects on-premises and cloud resources. Some XDR platforms integrate security products from a single vendor or cloud service provider, but the best also allow organizations to add and integrate the security solutions they prefer.