What are EDR and MDR tools?

Imagine a phishing email slips past your email gateway. The filter didn't catch it, the user clicks the attachment, and now a piece of malware is running on their laptop. That's the moment EDR and MDR tools exist for.

EDR (Endpoint Detection and Response) is software that sits on individual devices (endpoints) and watches what's happening in real time. When something suspicious runs, EDR spots the behavior, raises an alert, and can isolate the device before the damage spreads. It's not looking at the email. It's looking at what happens after the email was opened.

MDR (Managed Detection and Response) wraps human expertise around EDR. Instead of your team monitoring the alerts, a team of security analysts does it for you. They investigate, decide what's a real threat versus a false positive, and coordinate the response. MDR is EDR with a 24/7 human watching the dashboard (which most smaller organizations don't have in-house).

Here's why both matter for email security specifically. Your email gateway tries to block threats before they reach the inbox. EDR catches what the gateway misses, after the file lands on a device and starts executing. These aren't competing tools. They cover different points in the attack chain.

A realistic scenario: a credential-harvesting email gets through, the user downloads what looks like an invoice, and malware runs. The email gateway saw a clean attachment (the payload was disguised). EDR sees the process behavior on the endpoint, flags it as malicious, and isolates the machine. MDR analysts then investigate whether anything else on the network was touched. Neither alone would have caught the full picture.

So yes, you typically want both layers. Email security stops threats early. EDR and MDR catch what slips through and limit how far an attacker can move once they're inside. (Defense-in-depth isn't paranoia, it's just the reality of how modern attacks work.)

If you're curious how email filters try to catch threats before they reach endpoints at all, sandbox detonation is worth understanding as the next layer in the detection chain.