Cybersecurity
Antivirus decides whether a file or a known behavior should be blocked. EDR records what the computer did so a person can investigate after that decision, including activity a signature did not name. Many current products include both. Novatelia treats the published endpoint page as a deployment scope, not as a claim that one brand blocks every threat.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- A verdict and an investigation record are different outputs.
- A product can include both and still need a deployment scope.
- No detection percentage is published.
Definition
Use antivirus language for prevention verdicts. Use EDR language for the activity record and the response actions the license actually allows, such as isolating a machine.
How it works
The agent inspects files and behavior, applies the policy, and keeps a timeline. Isolation, a script, or a rollback exists only if that product and license include it. The timeline is what an investigation reads.
Architecture
- Agent on the computers in scope.
- Policy: what is blocked, what is only recorded.
- Console: the timeline and the response actions the license includes.
Use cases
- A workstation policy must block known malware and still keep a timeline.
- An investigation needs more than a “blocked” event.
- A project is replacing a signature-only agent and must say what the new agent adds.
Comparison
- Antivirus
- A block or allow decision on a file or behavior.
- EDR
- A host timeline and the response actions in the license.
Selection guidance
- List the computers and the operating systems first.
- Ask which response actions the license includes.
- Do not publish a detection rate. This site does not.
Questions
Is EDR always better?
It answers a wider question. A small estate may only need a prevention agent. The endpoint page separates prevention, detection, and response so the license matches the question.
Does a brand page mean Novatelia is that vendor’s partner?
No. Kaspersky and other names identify products that can be specified. They are not a partnership or authorization claim.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.