My cyber insurance form asks about EDR. What is it, and do I have it?
Updated October 30, 2026
You have EDR only if security software that watches for suspicious behavior, not just known viruses, is running on each computer, and someone acts on its alerts. EDR stands for endpoint detection and response. Insurance forms usually ask three things: whether you have it, which product it is, and who watches the alerts. To answer honestly, you need the product name, which computers it’s on, and where the alerts go. “We have antivirus” usually isn’t the same answer.
Steps
- Find the product name from the security icon on a work computer, or ask whoever set it up. Many forms ask for the exact name.
- Check whether it’s EDR or only antivirus, by searching the product name with “EDR” or asking the vendor. Some products come in both versions.
- Check your Microsoft 365 plan before buying anything. Business Premium includes Microsoft Defender for Business, which includes EDR.
- Count the computers in the security console and compare them with the computers you really have, including servers. Missing ones are gaps.
- Find out where the alerts go and who reads them, because the form asks, and an unread alert protects nothing.
- Save a dated screenshot of the device list as your evidence.
Details
What EDR is, in plain English
EDR watches what programs do, where traditional antivirus only checks files against a list of known bad ones. If a program suddenly encrypts hundreds of files or tries to switch off security settings, EDR can catch and stop it. It also keeps a record, so someone can work out what happened afterward.
CISA, the U.S. government’s cybersecurity agency, recommends EDR or application allowlisting on all devices, and making sure security tools send their warnings to someone who will act on them (CISA #StopRansomware Guide). That second part matters as much as the software.
Owning the license isn’t having it running
Many businesses already pay for EDR without having it switched on everywhere. Microsoft 365 Business Premium includes Microsoft Defender for Business, which includes endpoint detection and response (Microsoft: What is Defender for Business?). An administrator can see which computers are connected in the Microsoft Defender portal under Assets, then Devices (Microsoft: Manage devices in Defender for Business). Servers are the usual gap: Microsoft notes that protecting them needs extra licenses.
What the questions usually look like
The form’s follow-up about how EDR is managed is the question to watch. Wording varies, but a typical form asks which EDR product you use, with “none” as a choice, then how it’s managed, with options along the lines of: monitored at all hours by an outside provider, managed by your own team during business hours, installed but not actively monitored, or unknown. Some forms also ask whether EDR covers all computers and servers. This isn’t insurance or legal advice, so ask your broker how your answers affect coverage.
Who’s watching it?
Someone has to read EDR’s alerts and act, so the honest answer depends on where they go. Ask whoever set it up:
- Where do the alerts go: an email inbox, a dashboard, an outside security team?
- Who looks at them, and what happens on nights and weekends?
- When was the last alert, and what was done about it?
If the honest answer is “they go to an inbox nobody reads,” the most accurate choice may be “installed but not actively monitored.” It’s uncomfortable to tick, but it’s true, and it tells you exactly what to fix: the old rule was “antivirus is installed, so we’re covered”; the new one is that someone owns the alerts.
For new IT PLZ HELP clients, the computers we manage get security software that looks for signs of an attack, and its alerts are reviewed by a security team (we use Huntress Managed EDR, and Huntress’s own team reviews them). We follow up with you during business hours. Servers are quoted separately, so ask about them if you have one.
Where doing it yourself gets risky
- Calling antivirus EDR. If you’re not sure which you have, find out before you answer.
- “All computers” when a laptop, a home computer used for work, or a server was never set up.
- Choosing a monitoring option you can’t back up. Ask your provider, in writing, who watches the alerts and when.
Signs it’s time for help
Get help if either of these is true. You can check the rest yourself.
- You can’t name your security software, how many computers it protects, or who gets its alerts, and your renewal is close.
- The honest answer to who watches the alerts is an inbox nobody reads.
Today, write down three things: the name of your security software, how many computers it shows as protected, and who gets its alerts. If any answer is “I’m not sure,” that’s the one to settle before your renewal.
Book a free 20-minute fit check