In plain English
EDR is next-generation endpoint protection. Unlike traditional antivirus that only scans for known malware signatures, EDR watches what programs actually do — and alerts when something behaves suspiciously, even if it's never been seen before. Microsoft Defender for Endpoint is a leading EDR platform built into Microsoft 365 Business Premium.
Full definition
Traditional antivirus compares files against a list of known bad signatures. EDR watches behaviour. It records what every process does on a device: what files it touches, what network connections it opens, what registry keys it modifies. When that behaviour matches a pattern associated with an attack, it alerts. When behaviour is anomalous enough, some EDR platforms will quarantine the device automatically before a human reviews the alert.
is the EDR platform built into Business Premium. For Australian SMEs already paying for that licence, it is often underused or not configured at all. Properly configured and connected to a , it becomes the primary source of telemetry for detecting intrusions in progress. An attacker who gets past the perimeter with will eventually do something on an endpoint that triggers a behavioural alert. Without EDR, that activity is invisible until the damage is done.
A common scenario: a bypasses spam filters, an employee opens the attachment, and a script runs that starts enumerating the network. Antivirus sees nothing because the script uses legitimate Windows tools. EDR sees the script launch, sees it call out to an unusual IP address, and raises an alert within minutes. That is the difference between catching an intrusion on day one and discovering it three months later during a forensic investigation.