Glossary · Security

XDR

Extended Detection and Response

In plain language

EDR extended beyond computers to email, identity and cloud, so one system sees an attack moving between them.

The metaphor

Like a security desk that sees the front door, the lobby and the parking lot cameras together, so it can connect a stranger at the gate to the one in the elevator.

Going deeper

How it works

Pulls signals from computers, email, logins and cloud apps into one view.
Links related events into a single incident.
Shortens the time to understand an attack.
Depends on the tools it connects.

What can go wrong (example scenario)

A five-person consulting firm had separate tools for email and endpoints. The email tool flagged a message as suspicious after delivery. The endpoint tool saw an odd process. Nobody connected the two until a client reported receiving fake invoices from the firm two weeks later.

How WILDCARD handles it

Workstation Defender covers the endpoint piece. Cyber is the active breach isolation layer, which contains the threat as well as reporting it. Identity Monitor and Email Security supply the login and email signals.

In practice

A law firm wants a stolen password, the login it enabled and the files it touched shown as one incident.
A dental office needs a phishing email pulled from every inbox once one staff member reports it.
A retailer with a cloud point-of-sale wants identity and endpoint alerts in one view.

Example scenario: A small architecture firm had a staffer approve an MFA prompt she had not requested. The identity signal, the new-device login and a mass download from SharePoint were correlated within minutes. The session was revoked and the laptop isolated before the files left the building.

A question owners ask

Do I need XDR if I already have EDR?

EDR protects the computers. XDR adds email, identity and cloud into one picture. For a business living in Microsoft 365, the identity and email layers are where most attacks start.

Where WILDCARD handles this