The Situation
The EDR rollout finished last year. The dashboard is green. The insurance form says "yes." Then an incident response firm gets called in after a ransomware attack and finds the same things they find almost every time: the server that got hit first never had the agent, the policy was set to alert instead of block, and the alert that fired at 1:14 a.m. sat unread until Monday.
Buying EDR (endpoint detection and response) is the easy part. Running it well is where most companies fall short. Here are seven checks worth doing this quarter.
1. Coverage: Is the Agent on Everything?
Attackers look for the device you forgot. That's usually an old server, a jump box, a VM someone built for a project, or a contractor laptop.
How to check: Export the device list from your EDR console and compare it with another source of truth, such as Active Directory or Entra ID, your device management tool (Intune, Jamf), your vulnerability scanner or your cloud account inventory. Every device that appears in one list but not the EDR list is a gap.
Target: 98% or more of supported devices, with a named owner for every exception.
2. Mode: Is It Blocking, or Just Watching?
Many deployments start in "detect only" or "audit" mode to avoid breaking things, and then never move on. In that mode, the EDR will document the ransomware attack in detail. It won't stop it.
How to check: Review each policy group. Prevention features such as malicious behavior blocking, exploit protection and ransomware protection should be turned on for workstations and servers. Where a feature is off, write down why.
3. Tamper Protection: Can an Attacker Turn It Off?
One of the first things modern attackers do with admin rights is try to disable or uninstall security tools. Most EDR products have a tamper protection setting that requires a separate password or a console action to remove the agent.
How to check: Confirm tamper protection is on in every policy, and that the uninstall token or password isn't shared widely or stored in a script.
4. Exclusions: How Big Are the Holes You Made?
Exclusions tell the EDR to ignore certain files, folders or processes, usually because a business app was slow or got blocked. They pile up over time. Broad exclusions such as an entire drive, a whole temp folder or a common scripting tool become a hiding place.
How to check: Export the exclusion list. For each entry, ask who requested it, when, and whether it's still needed. Replace folder-wide exclusions with specific file paths or signed applications where you can. Review them every quarter.
5. Ownership: Who Sees the Alert at 1 a.m.?
EDR creates alerts all day. The question is what happens to a high-severity alert outside business hours.
How to check: Fire a harmless test detection (most vendors provide a safe test file or command) on a Friday evening. Time how long it takes for a person to look at it and act. If the answer is "Monday," you need either an on-call rotation or a managed detection and response (MDR) service.
6. Response: Who Is Allowed to Act?
Fast response depends on permission. Can your MDR provider or on-call analyst isolate a device without waking up three managers? Can they disable a user account?
How to check: Write down the response actions your EDR supports: isolate host, kill process, quarantine file, run a script, roll back changes. Next to each one, name who is allowed to do it and under what conditions. Pre-approve isolation of standard workstations so nobody waits for sign-off during an attack.
7. Updates: Can You Control the Rollout?
The July 2024 CrowdStrike incident, when a faulty content update crashed millions of Windows machines, taught everyone the same lesson: updates to security software can cause outages too.
How to check: Find out which updates your vendor lets you stage (agent versions, and in some products content updates too). Set up rings: a small test group first, then a broader group, then critical servers last. Document how you'd roll back.
The Numbers to Track
You don't need a big dashboard. Four numbers tell you most of what you need:
| Metric | What it tells you | A reasonable goal |
|---|---|---|
| Agent coverage | How much of your estate is protected | 98% or more |
| Devices in prevention mode | Whether the tool can actually stop attacks | 100% of workstations |
| Time to acknowledge a critical alert | Whether anyone is watching | Under 15 minutes, any hour |
| Open exclusions older than 90 days | How much risk you've quietly accepted | Trending down |
What to Do Next
Pick two of these checks and do them this month. Coverage and after-hours ownership are the best places to start, because they're the most common gaps behind real incidents.
Want a second set of eyes on your endpoint setup? Stackcurve advisors help IT leaders review their EDR and MDR coverage and compare options at no cost to you. Talk to an advisor → or get your free Cyber-Ready Score →
Stackcurve is independent. No vendor pays for placement or editorial influence on this blog.