Definition
Plain language
The security software on a work laptop that watches for suspicious activity and alerts the security team.
As stated in the literature
Endpoint Detection and Response — host-based security tooling that monitors process, file, and network behavior on user machines, blind to the semantic intent behind AI-agent actions.
Also called: endpoint detection
Why it matters: It highlights a real blind spot: existing endpoint security tools see process behavior, not the AI intent driving it, leaving organizations exposed to agent misuse.
For example, the EDR on an employee's laptop happily lets an AI assistant exfiltrate sensitive files because, from the OS's perspective, the user just opened them.
Heard on the show
“An EDR tool — endpoint detection — sees a file read.”Episode 057 — How Uber Caught 206 Leaked Credentials With an LLM-Powered Security Stack