The goal of endpoint detection and response (EDR) solutions is to deliver real-time, automated endpoint protection with an orchestrated incident response across any of your clients’ communication devices including workstations, servers, cloud workloads and more. While EDR is a critical component of your client's overall cybersecurity stack, it can be challenging to implement and run. Here are three mistakes to avoid.

Mistake #1 – Trying to analyze too much data

As your clients’ trusted security advisor, you need to have complete visibility over their environments and any avenues that attackers may enter. This visibility can result in your having a lot of data to sift through—potentially more than you need. Wading through false positives and alert noise will likely prevent you from focusing on the real threats.

Gaining visibility into your clients’ assets, understanding user behaviors and collecting system logs can help you build a clear picture of your clients’ environments. However, you need to focus on analyzing the right data, not all the data. Don’t let yourself drown in data. Understand which event sources connect to your SIEM or XDR platform and make sure you align these sources with actual use cases.

Mistake #2 – Not focusing on your client's specific risks 

EDR is not a one-size-fits-all solution. You need to consider your client's business, industry and the type of threats that are unique to them. For example, health care companies are prime targets for ransomware due to the high-value data that they store and access, such as protected health information (PHI). Phishing attacks like credential harvesting are also common in this industry. Don’t try to address every possible kind of threat while not prioritizing more targeted, industry-specific threats.

Mistake #3 – Selecting the wrong EDR vendor for the job

Setting up a security operations center (SOC) can be a complex, time-consuming process. An internal 24/7 SOC operation needs effective tools, a comprehensive security playbook and manpower with the necessary expertise in threat hunting, threat prevention and platform management. Look for an EDR vendor that has successfully addressed multiple evolutions of cyber threats, cybersecurity technology and industry shifts. Partnering with a proven vendor can reassure your clients’ security leaders that their security operations will be resilient and adaptable to change. 

Learn more about Fortinet’s EDR solutions.