[](https://www.paloaltonetworks.com/?ts=markdown) * Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Palo Alto Networks logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)](https://www.paloaltonetworks.com/?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Products [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [AI Security](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise Device Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical Device Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [OT Device Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Unit 42 Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Solutions ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Solutions Secure AI by Design * [Secure AI Ecosystem](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [Secure GenAI Usage](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) Network Security * [Cloud Network Security](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Data Center Security](https://www.paloaltonetworks.com/network-security/data-center?ts=markdown) * [DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Intrusion Detection and Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Device Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [OT Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Secure All Apps, Users and Locations](https://www.paloaltonetworks.com/sase/secure-users-data-apps-devices?ts=markdown) * [Secure Branch Transformation](https://www.paloaltonetworks.com/sase/secure-branch-transformation?ts=markdown) * [Secure Work on Any Device](https://www.paloaltonetworks.com/sase/secure-work-on-any-device?ts=markdown) * [VPN Replacement](https://www.paloaltonetworks.com/sase/vpn-replacement-for-secure-remote-access?ts=markdown) * [Web \& Phishing Security](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) Cloud Security * [Application Security Posture Management (ASPM)](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Code Security](https://www.paloaltonetworks.com/cortex/cloud/code-security?ts=markdown) * [Cloud Security Posture Management (CSPM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management (CIEM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management (DSPM)](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management (AI-SPM)](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Cloud Workload Protection (CWP)](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [Web Application \& API Security (WAAS)](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown) Security Operations * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown) * [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown) * [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown) * [SOC Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown) * [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown) * [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown) * [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown) * [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown) * [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown) Endpoint Security * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Industries](https://www.paloaltonetworks.com/industry?ts=markdown) * [Public Sector](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) * [Financial Services](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) * [Manufacturing](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) * [Healthcare](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) * [Small \& Medium Business Solutions](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Services ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Services [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Assess](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment?ts=markdown) * [Breach Readiness Review](https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review?ts=markdown) * [BEC Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment?ts=markdown) * [Cloud Security Assessment](https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/assess/compromise-assessment?ts=markdown) * [Cyber Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment?ts=markdown) * [M\&A Cyber Due Diligence](https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-diligence?ts=markdown) * [Penetration Testing](https://www.paloaltonetworks.com/unit42/assess/penetration-testing?ts=markdown) * [Purple Team Exercises](https://www.paloaltonetworks.com/unit42/assess/purple-teaming?ts=markdown) * [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/assess/soc-assessment?ts=markdown) * [Supply Chain Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Respond](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Cloud Incident Response](https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Managed Detection and Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Transform](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [IR Plan Development and Review](https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/transform/security-program-design?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/transform/vciso?ts=markdown) * [Zero Trust Advisory](https://www.paloaltonetworks.com/unit42/transform/zero-trust-advisory?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-unit-42.svg) UNIT 42 RETAINER Custom-built to fit your organization's needs, you can choose to allocate your retainer hours to any of our offerings, including proactive cyber risk management services. Learn how you can put the world-class Unit 42 Incident Response team on speed dial. Learn more](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * Partners ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Partners NextWave Partners * [NextWave Partner Community](https://www.paloaltonetworks.com/partners?ts=markdown) * [Cloud Service Providers](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) * [Global Systems Integrators](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) * [Technology Partners](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * [Service Providers](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) * [Solution Providers](https://www.paloaltonetworks.com/partners/nextwave-solution-providers?ts=markdown) * [Managed Security Service Providers](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) * [XMDR Partners](https://www.paloaltonetworks.com/partners/managed-security-service-providers/xmdr?ts=markdown) Take Action * [Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Managed Services Program](https://www.paloaltonetworks.com/partners/managed-security-services-provider-program?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) [CYBERFORCE CYBERFORCE represents the top 1% of partner engineers trusted for their security expertise. Learn more](https://www.paloaltonetworks.com/cyberforce?ts=markdown) * Company ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Company Palo Alto Networks * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com) * [Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Military \& Veterans](https://jobs.paloaltonetworks.com/military) [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Precision AI Security](https://www.paloaltonetworks.com/precision-ai-security?ts=markdown) * [Our Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Accelerate Your Cybersecurity Transformation](https://www.paloaltonetworks.com/why-paloaltonetworks/nam-cxo-portfolio?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) Careers * [Overview](https://jobs.paloaltonetworks.com/) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) [A Newsweek Most Loved Workplace "Businesses that do right by their employees" Read more](https://www.paloaltonetworks.com/company/press/2021/palo-alto-networks-secures-top-ranking-on-newsweek-s-most-loved-workplaces-list-for-2021?ts=markdown) * More ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) More Resources * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Tech Insider](https://techinsider.paloaltonetworks.com/) * [Knowledge Base](https://knowledgebase.paloaltonetworks.com/) * [Palo Alto Networks TV](https://tv.paloaltonetworks.com/) * [Perspectives of Leaders](https://www.paloaltonetworks.com/perspectives/?ts=markdown) * [Cyber Perspectives Magazine](https://www.paloaltonetworks.com/cybersecurity-perspectives/cyber-perspectives-magazine?ts=markdown) * [Regional Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Security Posture Assessment](https://www.paloaltonetworks.com/security-posture-assessment?ts=markdown) * [Threat Vector Podcast](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * [Packet Pushers Podcasts](https://www.paloaltonetworks.com/podcasts/packet-pusher?ts=markdown) Connect * [LIVE community](https://live.paloaltonetworks.com/) * [Events](https://events.paloaltonetworks.com/) * [Executive Briefing Center](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) [Blog Stay up-to-date on industry trends and the latest innovations from the world's largest cybersecurity Learn more](https://www.paloaltonetworks.com/blog/) * Sign In ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Language * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal [Deploy Bravely --- Secure your AI transformation with Prisma AIRS](https://www.deploybravely.com) [](https://www.paloaltonetworks.com/?ts=markdown) 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Security Operations](https://www.paloaltonetworks.com/cyberpedia/security-operations?ts=markdown) 3. [EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr?ts=markdown) 4. [What is EDR vs. Antivirus?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus?ts=markdown) Table of Contents * [What Is Endpoint Detection and Response (EDR)?](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr?ts=markdown) * [Understanding EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#understanding?ts=markdown) * [Key Benefits of EDR Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#key?ts=markdown) * [How EDR Works: A Detailed Breakdown](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#how?ts=markdown) * [Evolution of EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#evolution?ts=markdown) * [EDR Implementation Process](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#process?ts=markdown) * [Common Challenges and Solutions in EDR Adoption](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#common?ts=markdown) * [Advanced EDR Strategies and Optimization Techniques](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#advanced?ts=markdown) * [EDR and the Evolving Threat Landscape](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#landscape?ts=markdown) * [How to Evaluate an EDR Solution](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#solution?ts=markdown) * [EDR FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr#faqs?ts=markdown) * [What Is Endpoint Detection and Response (EDR) Deployment?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment?ts=markdown) * [Understanding EDR Deployment](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#understanding?ts=markdown) * [Key Benefits of Implementing EDR Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#benefits?ts=markdown) * [EDR Preparation and Deployment Steps](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#preparation?ts=markdown) * [Operational Considerations for EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#operational?ts=markdown) * [Addressing Challenges in EDR Deployment](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#challenges?ts=markdown) * [Maximizing the Value of Your EDR Deployment](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#maximizing?ts=markdown) * [EDR Deployment FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-deployment#faqs?ts=markdown) * [What is EDR-as-a-Service Managed Security?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-as-a-service-managed-security?ts=markdown) * [EDR: Definition and Importance](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-as-a-service-managed-security#edr?ts=markdown) * [How Does EDR Work?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-as-a-service-managed-security#how?ts=markdown) * [EDR Solutions in the Market](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-as-a-service-managed-security#solutions?ts=markdown) * [EDR-as-a-Service Managed Security FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-as-a-service-managed-security#faqs?ts=markdown) * [What Are Endpoint Detection and Response Tools?](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools?ts=markdown) * [Endpoint Detection and Response Overview](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#endpoint?ts=markdown) * [Control Points of EDR Tools](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#control?ts=markdown) * [EDR Critical Capabilities](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#critical?ts=markdown) * [Visibility and Efficiency EDR Feature Evaluation Checklists](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#visibility?ts=markdown) * [Endpoints Supported by EDR Tools](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#endpoints?ts=markdown) * [Benefits of EDR Tools](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#benefits?ts=markdown) * [Deployment of EDR Tools](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#deployment?ts=markdown) * [EDR Tools vs. EDR Services](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#tools?ts=markdown) * [EDR Use Cases](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#usecases?ts=markdown) * [EDR Tools FAQs](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools#faqs?ts=markdown) * What is EDR vs. Antivirus? * [What is Antivirus?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#what?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#edr?ts=markdown) * [Use Cases for Antivirus](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#use?ts=markdown) * [Use Cases for EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#cases?ts=markdown) * [How EDR Differs From MDR and XDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#how?ts=markdown) * [EDR vs. Antivirus FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#faqs?ts=markdown) * [How Does EDR Enhance Small Business Cybersecurity?](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity#what?ts=markdown) * [EDR Benefits for Small Businesses](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity#edr?ts=markdown) * [Traditional Antivirus vs EDR vs XDR](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity#taditional?ts=markdown) * [EDR for Small Business FAQs](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity#faqs?ts=markdown) * [How Does EDR Leverage Machine Learning?](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning?ts=markdown) * [How EDR and ML Work Together](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning#how?ts=markdown) * [How EDR Leverages Machine Learning](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning#learning?ts=markdown) * [Workflow Example of EDR and Machine Learning Integration](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning#workflow?ts=markdown) * [The Future of EDR: Predictions and Emerging Trends](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning#the?ts=markdown) * [How EDR Leverages Machine Learning FAQs](https://www.paloaltonetworks.com/cyberpedia/how-edr-leverages-machine-learning#faqs?ts=markdown) * [What Is Endpoint Detection and Response (EDR) Management?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management?ts=markdown) * [EDR Management Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#edr?ts=markdown) * [Key Capabilities of EDR Management](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#capabilities?ts=markdown) * [The Crucial Role of EDR Management in Modern Cybersecurity](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#crucial?ts=markdown) * [EDR Management Challenges and Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#solutions?ts=markdown) * [Best Practices for Effective EDR Management](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#best?ts=markdown) * [EDR vs. EPP: A Complementary Relationship](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#vs?ts=markdown) * [Integrating EDR Management with a Broader Security Ecosystem](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#integrating?ts=markdown) * [Case Study of a Successful EDR Implementation](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#implementation?ts=markdown) * [EDR Management FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-management#faqs?ts=markdown) * [What Is Endpoint Detection and Response (EDR) Compliance?](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#what?ts=markdown) * [Why EDR Compliance Is Important](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#why?ts=markdown) * [Key Steps for EDR Compliance](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#key?ts=markdown) * [EDR Non-Compliance Consequences](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#consequences?ts=markdown) * [What to Look for in an EDR Compliance Solution](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#solution?ts=markdown) * [EDR Compliance FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr-compliance#faqs?ts=markdown) * [What is the Difference Between EDR vs. SIEM?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem?ts=markdown) * [What is SIEM?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem#siem?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem#edr?ts=markdown) * [A Detailed Comparison of EDR and SIEM](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem#compare?ts=markdown) * [SIEM vs SOAR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem#siem-vs-soar?ts=markdown) * [SIEM vs EDR FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-siem#faq?ts=markdown) * [What is EDR vs. XDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr?ts=markdown) * [EDR and XDR Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr#what?ts=markdown) * [Importance of EDR and XDR in Cybersecurity](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr#importance?ts=markdown) * [EDR vs. XDR: Key Differences](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr#differences?ts=markdown) * [Which Is Better: EDR or XDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr#which?ts=markdown) * [EDR vs. XDR FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-xdr#faq?ts=markdown) # What is EDR vs. Antivirus? 3 min. read Table of Contents * * [What is Antivirus?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#what?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#edr?ts=markdown) * [Use Cases for Antivirus](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#use?ts=markdown) * [Use Cases for EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#cases?ts=markdown) * [How EDR Differs From MDR and XDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#how?ts=markdown) * [EDR vs. Antivirus FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#faqs?ts=markdown) 1. What is Antivirus? * * [What is Antivirus?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#what?ts=markdown) * [What is EDR?](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#edr?ts=markdown) * [Use Cases for Antivirus](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#use?ts=markdown) * [Use Cases for EDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#cases?ts=markdown) * [How EDR Differs From MDR and XDR](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#how?ts=markdown) * [EDR vs. Antivirus FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus#faqs?ts=markdown) EDR (Endpoint Detection and Response) and traditional Antivirus software protect computers and networks from malware and other threats, but they provide different levels of defense. Here are the main differences between EDR (Endpoint Detection and Response) and antivirus software: Purpose: * Antivirus: Targets known malware using signature-based detection. * EDR: Monitors, detects, and responds to a broader range of threats, including sophisticated attacks. Detection Methods: * Antivirus: Relies on signatures to identify threats. * EDR: Uses behavioral patterns and anomaly detection for identifying advanced threats. Response Capabilities: * Antivirus: Focuses on removing malware. * EDR: Includes real-time containment and detailed investigation tools. Scope of Protection: * Antivirus: Limited to file and program integrity. * EDR: Offers broader protection with forensic tools and network-wide analysis. User Interaction: * Antivirus: Minimal; operates automatically. * EDR: Requires skilled personnel for effective management and response. These distinctions highlight EDR's role in providing a deeper and more dynamic approach to cybersecurity than traditional antivirus solutions, which focus more on static, signature-based malware detection. ## What is Antivirus? While EDR offers real-time, around-the-clock monitoring and responds to known and emerging threats, traditional antivirus primarily focuses on known threats, preventing, detecting, and removing malicious software like viruses, worms, and trojans. Using various methods, they identify malicious software or code that has infected a computer. ### Detection Methods [Antivirus software](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-security-antivirus?ts=markdown) uses three methods to detect malware: signature-based, heuristic-based, and behavioral-based detection. Signature-based detection is the more traditional method, using a database of known malware signatures. **Signature-Based Detection** These signatures are unique data strings or code sequences characteristic of specific malware. When a file matches a signature in the database, it is flagged as malicious. However, this method requires regular database updates to remain effective against new threats. **Heuristic-Based Detection** This method is used to catch malware that has not yet been formally identified and added to the signature database. It involves looking for patterns or behaviors typical of malicious software. For example, a program trying to modify system files or hide its presence might be flagged. **Behavioral-Based Detection** This approach monitors the behavior of programs and files in real-time. Suppose a program starts acting suspiciously, such as trying to access sensitive data or modify system settings without permission. In that case, the antivirus can detect this as potential malware, even if the program isn't in its signature database. ### Prevention and Blocking Antivirus programs provide real-time scanning by running in the background and scanning files as they are opened, created, or downloaded. This helps prevent malware from executing and causing damage. Additionally, many antivirus solutions come with web shields that scan and block malicious websites or downloads before they can cause harm. ### Removal and Quarantine Antivirus software can detect potentially harmful software and move it to a quarantine area, which isolates the file from the rest of the system. This prevents the software from causing further damage while allowing the user to review and delete it if necessary. Additionally, antivirus software can often automatically clean infected files, removing malicious content while preserving the original data. ### System Scans and Updates Antivirus software can be configured to perform complete system scans at regular intervals, which can be scheduled according to the user's needs. Additionally, users can manually initiate scans when necessary. Since new malware is constantly being developed, antivirus software must regularly update its database of malware signatures and algorithms to detect newer threats. These updates are typically downloaded automatically from the vendor's servers. Antivirus software plays a crucial role in cybersecurity defense strategies, especially for blocking known threats and providing a first line of defense against potential infections. However, given the ever-evolving nature of cyber threats, antivirus is most effective with other security measures, such as firewalls, anti-spyware programs, and comprehensive security practices. ## What is EDR? EDR provides a more comprehensive and dynamic approach to protecting endpoints from various cyber threats, including sophisticated malware, ransomware, and targeted attacks. ![Endpoint Evolution of EDR](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-edr-vs-antivirus/endpoint-evolution-to-edr.png) ### Operational Aspects of EDR [EDR systems](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr?ts=markdown) operate through a combination of technology and strategies to provide real-time monitoring and response capabilities. Here's a detailed look at the operational aspects of EDR: Data Collection EDR tools continuously collect and record data from endpoints in real-time. This data includes process executions, network connections, registry changes, file modifications, and other relevant system activities. The depth of data collected is much greater than traditional antivirus software. **Threat Detection** * Behavioral Analysis: EDR systems analyze the behavior of processes and communications on endpoints to identify anomalies that could indicate a threat. This includes looking for unusual patterns such as sudden increases in data transmission, unexpected processes launching at startup, or unauthorized attempts to access sensitive data. * Anomaly Detection: Using machine learning and statistical modeling, EDR solutions can detect deviations from normal operations, identifying potentially malicious activities that don't match known malware signatures. * Threat Intelligence Integration: EDR platforms often integrate with external threat intelligence feeds to enhance detection capabilities. This helps identify known malicious entities (like IP addresses or domains) and correlate observed behaviors with known threat patterns. **Alerts and Notifications** When suspicious activity is detected, EDR systems generate alerts and provide detailed context about the incident. This can include information about the affected endpoint, the nature of the suspicious activity, and potential impact. These alerts enable security analysts to understand and prioritize threats quickly. **Response and Mitigation** * Automated Responses: EDR tools can execute predefined response actions automatically when a threat is detected. These actions might include killing malicious processes, quarantining infected files, isolating compromised endpoints from the network, or reversing unauthorized changes. * Manual Intervention: EDR provides tools for security analysts to remotely access affected endpoints, conduct detailed investigations, and manually remediate issues. Analysts can execute commands, gather additional forensic data, and apply patches or updates. **Forensics and Investigation** * Timeline Analysis: EDR systems provide a detailed timeline of events leading up to and following a security incident. This allows security teams to trace the root cause of an attack and understand the scope of a breach. * Search Capabilities: Analysts can search across collected data using various criteria to identify related events or patterns across the network. **Continuous Improvement** Insights gained from investigations and daily operations are used to refine detection algorithms, improve response strategies, and update security policies. EDR solutions are particularly effective when organizations face sophisticated and evolving threats. They are designed to detect and react to threats and provide the tools necessary for deep forensic analysis and ongoing improvement of security postures. ## Use Cases for Antivirus Despite its limitations compared to EDR solutions, antivirus software offers an excellent defense mechanism for several essential use cases. Organizations face two significant challenges at the endpoint - [malware protection](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection?ts=markdown) and email security. Antivirus software effectively detects and removes various known malware types, including ransomware, adware, viruses, and more. Additionally, antivirus software continuously scans emails for potential threats, making inspecting email attachments and links for potential problems more manageable. Other important use cases for antivirus include: * Safe web browsing * Scheduled scanning * Automatic endpoint security updates * Scanning of external storage devices such as USB drives * Real-time scanning * Firewall integration * Parental controls * Multi-platform protection ## Use Cases for EDR EDR's versatility makes it suitable for a large number of use cases. One such use case is cloud endpoint security, as more organizations now have endpoints in the cloud and need a cloud-friendly platform for detection and response. This extension of an organization's infrastructure to the cloud makes other use cases a good match for EDR. These include threat hunting, ransomware protection, phishing/credentials theft, and multi-platform protection. Another excellent use case for EDR is insider threat detection, as malicious insiders can use their endpoint privileges to move laterally throughout an organization's network, applications, and web services. EDR also effectively detects Zero Day threats, using sophisticated techniques such as machine learning algorithms and heuristic analysis to spot and track threats that lack known signatures. Additional use cases where EDR makes sense include: * Incident response automation * Forensic analysis * Real-time threat detection * Incident investigation * Security posture assessment * Compliance and reporting * Automated patch management ## How EDR Differs From MDR and XDR The subsequent logical extensions of traditional EDR are [Managed Detection and Response (MDR)](https://www.paloaltonetworks.com/cyberpedia/what-is-managed-detection-and-response?ts=markdown) and [Extended Detection and Response (XDR)](https://www.paloaltonetworks.com/cyberpedia/what-is-extended-detection-and-response-XDR-security?ts=markdown). All three are essential elements to an organization's enterprise-wide cybersecurity framework, and many organizations use all three solutions together for a multilayered defense. MDR is a managed service provided by third-party organizations and often operated in tight collaboration with in-house cybersecurity teams. It detects and responds to cybersecurity threats across the organization's digital infrastructure---endpoints, networks, cloud gateways, and more. EDR solutions are often a key part of this managed service. XDR is an even more comprehensive approach to cybersecurity because it addresses threats across an organization's entire IT landscape and includes data from multiple security tools throughout the enterprise. Their main differences are: * EDR is endpoint-focused, XDR addresses threats on all parts of the organization's technology platforms, and MDR is a third-party-managed service for monitoring and incident response, often including EDR tools. * EDR is often deployed on in-house infrastructure using internal security team members; MDR is an outsourced service, and XDR can be deployed and managed internally or through a third party. Many organizations employ an EDR solution with MDR and XDR for a more holistic, end-to-end cybersecurity strategy. ## EDR vs. Antivirus FAQs ### Can antivirus software and EDR be used together? Using antivirus software in combination with EDR can be an effective way to deliver a layered approach to endpoint security. Antivirus software's strength in detecting known threats, combined with EDR's ability to spot new threats and respond to them, provides a more comprehensive approach than using only antivirus or EDR. ### What is MITRE ATT\&CK, and how does it affect endpoints? MITRE ATT\&CK is a knowledge base for the behavior and tactics used by cyber adversaries during various stages of the cyberattack lifecycle. Most EDR solutions have adopted MITRE ATT\&CK techniques to improve detection and response while enhancing threat hunting to support endpoint security. ### How does centralized management differ between EDR and antivirus? EDR's centralized management capabilities are considered more extensive than antivirus software offers. Antivirus software management generally focuses on scanning for and blocking known malware, while EDR's management extends visibility into endpoint threats, with administrative monitoring of endpoint behavior. Related Content [What is Extended Detection and Response? Endpoint detection and response platforms help security teams find suspicious endpoint activity to eliminate threats quickly and minimize the impact of an attack.](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr?ts=markdown) [Cortex XDR for Endpoint Protection Cortex XDR brings powerful endpoint protection technology together with critical endpoint detection and response (EDR) capabilities in a single agent.](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) [AV Comparatives Report for EPR In the latest Endpoint Prevention and Response (EPR) Test by AV-Comparatives, Cortex® XDR™ was once again named a Strategic Leader.](https://start.paloaltonetworks.com/cortex-epr-av-comparatives-report-2022.html) [What's Next for Nex Gen Antivirus? Understand your NGAV options with the latest innovations in this helpful paper.](https://start.paloaltonetworks.com/whats-next-for-next-gen-antivirus) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20is%20EDR%20vs.%20Antivirus%3F&body=Discover%20the%20key%20differences%20between%20EDR%20and%20Antivirus%2C%20including%20their%20functionalities%20and%20strengths%2C%20and%20which%20is%20best%20for%20your%20organizational%20security%20needs.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/what-is-edr-vs-antivirus) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/what-are-endpoint-detection-and-response-tools?ts=markdown) What Are Endpoint Detection and Response Tools? [Next](https://www.paloaltonetworks.com/cyberpedia/edr-for-small-business-cybersecurity?ts=markdown) How Does EDR Enhance Small Business Cybersecurity? {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2025 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language