Endpoint Protection, Detection, and Response

The KuppingerCole Market Compass analyzes the converging Endpoint Protection (EPP) and Endpoint Detection & Response (EDR) markets, now commonly delivered as unified Endpoint Protection, Detection & Response (EPDR) solutions. It outlines how modern malware—viruses, worms, rootkits, botnets, file-less attacks, ransomware, wipers, and crypto-miners—typically exploits OS or application vulnerabilities and increasingly evades classic signature-only defenses through polymorphism and memory-based techniques. Ransomware remains especially damaging because it “announces” itself after compromise; recovery choices are limited to paying (discouraged) or restoring from backups, which often proves slow or impossible without tested processes. Since prevention is never perfect, resilient backup/restore remains essential, while reducing common delivery vectors (notably weaponized Office documents) is a practical control.

EDR is positioned as the complement to prevention: it centrally logs endpoint activity, correlates events with threat intelligence, supports interactive querying and memory analysis, and helps security teams reconstruct attacks end-to-end. Response capabilities range from alerting and rule updates to process termination, quarantine, file actions, and rollback to known-good states. The report stresses operational reality: EPDR tools are complex, often requiring dedicated teams, and is driving demand for managed detection & response (MDR) services.

Market direction highlights three forces: ML has shifted from differentiator to requirement because signature-only detection is under 70% effective for new malware; consolidation is reducing agent sprawl by bundling EPP+EDR into suites; and cloud-hosted consoles are increasingly favored for manageability and updates. The report also tracks momentum toward XDR by combining endpoint (EDR) and network (NDR) telemetry, and uses independent test regimes and MITRE ATT&CK evaluations as comparative, point-in-time indicators of product performance.

• Signature-based anti-virus is less than 70% effective on new malware.
• Ransomware commonly arrives via weaponized Microsoft Office documents delivered through phishing campaigns.
• File-less malware propagates via process or memory injection rather than being written and transferred as files.
• Many ransomware campaigns now stage payloads across multiple enterprise machines and may exfiltrate data before detonation.
• Destructive “wiper” malware deletes or zeroes out data instead of demanding ransom.
• Crypto-jacking increases power costs and can deplete mobile device batteries.
• Endpoint security products have been established for more than 30 years.
• MITRE ATT&CK has run two full test scenarios simulating attacks by APT3 and APT29.
• Botnets can be composed of PCs, servers, smartphones, and IoT devices.
• Many vendors provide cloud-hosted management consoles for endpoint security.

• “Malware comes in many forms: viruses, worms, rootkits, botnets, file-less malware, ransomware, and crypto-miners are prevalent in the wild.”
• “Viruses are generally polymorphic, meaning they alter their structure to try to avoid detection upon every iteration.”
• “File-less malware attacks are on the rise.”
• “Paying the ransom only emboldens the perpetrators and perpetuates the ransomware problem.”
• “No anti-malware product is 100% effective at prevention.”
• “Most ransomware attacks arrive as weaponized Office docs via phishing campaigns.”
• “Windows platforms are still the most vulnerable, though there are increasing amounts of malware for Android.”
• “EDR helps to automatically uncover attacks and enables security teams to understand what is happening from start to finish by consolidating all relevant information into a single view.”
• “Such tests are point-in-time measurements, not absolute determinants of efficacy and value in customer environments.”
• “EPP and EDR are fusing into EPDR, and this trend will continue for reasons detailed above.”