Endpoint detection and response was the right answer for a decade in which adversaries were noisy, signatures were durable, and detection latency was measured in hours. None of those assumptions hold in the current decade. EDR has become a tax on operational tempo with diminishing — and in many sectors, structurally negative — returns.
WHY EDR IS OBSOLETE — STRUCTURAL ARGUMENT
Detection assumes the adversary is detectable. The most consequential intrusions of the past five years — SolarWinds, MOVEit, Snowflake, Salt Typhoon, Volt Typhoon — were not detected by EDR. They were detected, in most cases, by third parties with visibility EDR does not have.
EDR detects what an EDR vendor has previously catalogued. Living-off-the-land techniques, signed-binary abuse, and identity-based pivots produce telemetry that is indistinguishable from legitimate operation at the endpoint level. The vendor cannot label what the vendor cannot distinguish.
The result is an industry consensus that detection is necessary but not sufficient — followed by the deployment of more detection.
An adversary that has compromised one endpoint is positioned to access the resources that endpoint can reach. The defender's task — given the breach has occurred — is to minimise the consequence. Detection minimises consequence only if it is faster than the adversary's lateral movement. In modern campaigns, it is not.
PULSE engineers environments in which the resources reachable from a compromised endpoint are not, in any reconstructable form, the data the adversary came for. Detection becomes a forensic instrument rather than a containment instrument.
— PULSE POSITION
EDR was the right answer when the question was 'how do we know we have been breached.' It is the wrong answer to the question 'what does the adversary obtain when the breach occurs.'
CLASSIFIED — NDA REQUIRED
— deployment topology, cryptographic primitives, sector-specific implementation, and the quantified outcome model on which we engage —
Request Briefing →STRATEGIC BRIEFING — AVAILABLE UNDER NDA