What is EDR? (endpoint detection and response)
EDR stands for endpoint detection and response. Where traditional antivirus matches files against known signatures, EDR continuously records what happens on the machine (processes, network connections, registry changes) and flags or blocks suspicious behaviour, such as an Office process spawning PowerShell. The recorded timeline is what lets a responder work out what happened after an incident.
EDR versus antivirus
Modern products blur the line: Microsoft Defender is an antivirus, and Defender for Endpoint adds the EDR layer on top. The practical difference is what you get after a detection. AV gives you "blocked and quarantined"; EDR gives you the chain of events before and after, and tools to isolate the machine from the network while you look.
Why MSPs are asked about it
Cyber insurance questionnaires and frameworks such as Cyber Essentials increasingly expect EDR on every endpoint, so "do we have EDR" has become a compliance question as much as a security one.