No. Endpoint detection and response (EDR) tools are essential, but they look for suspicious behavior. Attackers who use stolen passwords, exposed credentials, or existing misconfigurations often look like normal users, so EDR may never raise an alert. Businesses also need people monitoring alerts around the clock, strong identity controls, employee training, and regular penetration testing to find the gaps before attackers do.
Yes. EDR is essential, but it isn’t enough on its own.
It watches for suspicious behavior. The most damaging attacks often don’t look suspicious at all, because the attacker is using a real employee’s login. A penetration test finds the gaps your tools can’t see, before someone else does.
“We have Microsoft Defender. We’re covered.”
We hear some version of this all the time. Sometimes it’s a specific product. Sometimes it’s “we have an IT guy who handles security.” Either way, the assumption is the same: we bought the tool, so we’re protected.
The tool matters. But it’s one layer, not the whole defense.
EDR monitors devices for suspicious behavior and alerts or responds when something looks wrong.
Endpoint detection and response (EDR) tools, such as Microsoft Defender for Endpoint or CrowdStrike, go beyond traditional antivirus. Instead of only matching known malware, they watch activity on laptops, desktops, and servers and flag behavior that doesn’t fit the normal pattern.
When something looks odd, the tool raises an alert. Then a person has to decide what it means.
“That’s the analyst’s job: to dig deeper into what that alert is and figure out, is this malicious? And if it is, take steps to contain the threat.” — Shawn Newman, Bridgehead IT
That’s the first gap. An alert nobody reviews, especially at 2 a.m. on a Saturday, doesn’t stop anything. Many businesses have the tool but no one watching it around the clock. Bridgehead Watchtower provides that 24/7 human monitoring.
Attacks that look like normal activity, and weaknesses that exist before any attack begins.
1. Logins with stolen passwords. If an attacker has a real employee’s password and logs in the way that person normally would, from the same city at a normal time, there may be nothing unusual to flag.
“If I log in normally as them, and I’m in the same location, like a lot of our clients are in San Antonio, that looks like normal activity. Now, if somebody logs in from China, that looks a little different.” — Shawn Newman, Bridgehead IT
Security tools are good at catching the obvious: five failed login attempts in a row, or a sign-in from another country. A correct password used from the expected location is much harder to spot.
2. Passwords left where anyone can find them. One of the first things a penetration tester looks for is credentials stored in plain text. Employees often save passwords in a file they believe is private on their desktop, when it actually sits in a shared folder anyone on the network can open. EDR isn’t designed to read those files. An attacker is.
3. Misconfigurations already in your environment. Some of the most serious risks are settings, not malware. Take SMB signing, the safeguard that prevents authentication relay attacks against file sharing. When signing isn’t enforced, an attacker who captures one user’s login request can forward it to an SMB server and have it accepted. This is known as an NTLM relay attack. Without signing, the server has no way to prove that the requests in the session actually came from the user who logged in, so the attacker operates on SMB as that user. If that user is an administrator, the attacker gains broad control, and the employee never notices. Good EDR can catch some of this activity, but only if it’s configured well and someone is watching.
4. Accounts with too much access. When ordinary users have administrator rights they don’t need, one stolen login becomes a much bigger problem.
5. People. All it takes is one employee clicking a phishing link or approving a fake request. See how business email compromise works.
General IT and offensive security are different skills, and most internal teams are already stretched.
A good IT person keeps systems running, users productive, and tools updated. Finding the way an attacker would get in takes specialized training in offensive security, time dedicated to testing, and an outside perspective. It’s hard to find the holes in a network you built and maintain yourself.
That’s not a criticism of internal IT. It’s why many organizations pair their IT team with security specialists. Learn the difference between a penetration test and a vulnerability scan, which your IT team may already run.
Tools, people, training, and testing working together.
“There are hoops to cybersecurity, but jumping through them is often what keeps you secure.” — Shawn Newman, Bridgehead IT
It shows you what an attacker could do in your environment despite your tools, and how to close those gaps.
A penetration tester works the way a real attacker would: looking for exposed credentials, misconfigurations, and paths to sensitive data. The result is a clear picture of what’s reachable and a prioritized plan to fix it. It also tests whether your EDR and monitoring actually catch what they should. For an overview, see our guide to penetration testing.
Many of these issues show up in the cybersecurity blind spots mid-sized businesses miss most often.
Is antivirus enough for a business?
No. Traditional antivirus mainly catches known malware. Businesses need EDR, 24/7 monitoring, identity controls, training, and regular testing.
Is Microsoft Defender enough?
Microsoft Defender for Endpoint is a strong EDR tool, but no single tool is enough. It needs to be configured well, monitored around the clock, and backed by identity controls and testing.
What’s the difference between EDR and a penetration test?
EDR is a tool that watches for suspicious activity in real time. A penetration test is a periodic, hands-on assessment that finds weaknesses an attacker could use, including ones EDR doesn’t detect.
How often should we do a penetration test?
At least once a year, and after major changes such as a migration, new application, network redesign, or acquisition.
Buying a security tool is a good start. It isn’t the finish line. The attacks that do the most damage are the ones that look normal, and the only way to find those gaps on your terms is to look for them the way an attacker would.