The company had EDR. Ransomware still encrypted the entire network

’What could happen at 2 a.m. when we have EDR?’ If several hours pass between a security alert and the first response, even excellent EDR cannot eliminate the threat. Technology can create a false sense of security. See how ransomware developed in a company that invested in reputable EDR, and why the tools did not help on this occasion.

In this article, you will learn:

• How EDR works during a ransomware attack.
• Why having EDR does not always solve the threat problem.
• Why security procedures, alert analysis and security-team exercises matter.
• Why 24/7 EDR monitoring is worthwhile

What happened after 2 a.m.?

’We have EDR — we can sleep soundly!’ Management announced this success to the team. Within days, those words proved untrue. The company did have EDR. At 02:19 it generated a critical alert. Yet an overnight ransomware attack damaged servers, production and workstations. The administrator noticed only in the morning. Suspicion immediately fell on EDR, but the system was not at fault.

Did EDR fail?

No. EDR — Endpoint Detection and Response — monitors endpoints such as laptops, desktops and servers in real time, and it worked correctly. Its role was not limited to detecting a threat and generating an alert. Let us look back at what happened earlier: EDR is most visible during incidents, but also works during quieter periods.

The EDR system followed these steps:

• All company endpoints were connected to the system. From then on, EDR monitored their operation around the clock, including outside working hours. It checked and analysed running programs, files written to devices and network connections. It also detected unusual events such as attempts to gain privileges or execute suspicious scripts.
• EDR examined suspicious events together rather than in isolation. For example: an employee opens an email → clicks an attachment → the downloaded document runs a macro → the macro starts PowerShell → PowerShell downloads a file → the file attempts to disable protection → the computer communicates with an unknown server. Some events appear harmless alone. Their combined context reveals an attack scenario.
• During monitoring, EDR detected the threat and generated an alert identifying the device and user, describing what happened and where it began.

Properly configured EDR can also stop an attack or isolate an infected computer, helping prevent further damage and disruption.

What does EDR do?

EDR goes beyond a typical antivirus on one device. It does not simply check whether files or programs appear on a threat list; it analyses suspicious behaviour. Examples include Excel trying to download a file, a standard user attempting to disable protection or mass file encryption. Detecting and connecting these behaviours can identify previously unseen attack patterns.

The main difference between EDR and antivirus is not detection alone, but behavioural analysis and the ability to respond immediately. EDR can reveal suspicious behaviour and the attack sequence, and enable containment.

If EDR is effective and fast, why did it fail to stop ransomware on company devices and servers? We need to examine where the failure occurred and why. People and the procedures available to them matter just as much as EDR itself.

Did EDR detect the ransomware?

Yes, and its 24/7 operation detected it immediately in this scenario. It analysed unusual behaviour: attempts to disable protection, mass file opening and writing, and attempts to gain administrator access. EDR connected these events and assessed the situation as critical. It generated an alert that…

…and this is where the problem appeared. The warning reached nobody. Without alert-response procedures, the security team did not act until morning.

EDR detected the ransomware in time, but that did not prevent escalation. The attacker operated relatively freely on company devices and servers for hours, gaining access to more data.

Learn why SOC 24/7 monitoring also matters for NIS2 compliance:

What is SOC 24/7? How a Security Operations Center works and why monitoring is not enough

Why did nobody respond to the EDR alert?

Why did EDR not stop the ransomware? Was technology or people at fault?

What was missing was a prompt human response and, above all, procedures. The company had no SOC 24/7 monitoring, so administrators did not learn immediately about the suspicious endpoint activity and EDR alert. While malicious activity continued on servers, employees were asleep. Overnight attacks can exploit the absence of continuous monitoring and reduced coverage.

EDR cannot perform the entire procedural response and step-by-step analysis on administrators’ behalf. It supplies structured, credible and valuable data, but people must act on it.

Want to improve IT security and reduce incident response time? Focus on more than deploying technology. Ensure alerts reach the right people promptly.

How did the ransomware attack develop?

Only minutes passed between the first attack attempt and the EDR security alert. More than five hours passed between the alert and the administrator actually learning of the threat.

The attack on company infrastructure developed as follows:

• 02:13 — the attacker scans the network for servers with vulnerable software and remote access.
• 02:15 — a company server responds. The attacker exploits a vulnerability and gains access. EDR records suspicious, unusual activity.
• 02:16 — the attacker checks available servers and disks, logged-in users and administrative privileges. EDR identifies a sequence of actions rarely seen on production servers.
• 02:18 — an attempt is made to disable safeguards, protective mechanisms and data-recovery services.
• 02:19 — ransomware is downloaded and executed. EDR observes rapid access to many files, mass writes and unusual encryption patterns, and generates a critical alert.
• 02:20 — EDR responds, but incomplete configuration limits the response. It blocks some actions, marks the ransomware as malicious and records the attack path. Without round-the-clock SOC monitoring, the alert enters a queue.
• 02:20–05:30 — ransomware continues encrypting files and restricting access to data. Lateral movement and privilege escalation give the attacker access to more servers. EDR records the events throughout. Only at…
• 07:30 does the administrator arrive, log in and notice the alert. After analysis, remediation begins several minutes later.

Comparison: EDR without SOC and EDR with SOC

A company can deploy one of the market’s leading EDR platforms yet have no SOC 24/7, then wonder why a reputable, recommended solution is not delivering. What does a SOC change? Let us examine what happened after ransomware struck an EDR-protected company without a SOC, and
compare it with what might have happened with a SOC. Who responded, and who could have responded? How did response times differ? What were the consequences, and how might they have been avoided?

	EDR without SOC	EDR with SOC
What happens to the alert?	It waits for an administrator to read it	It is read immediately by the security team available 24/7
Who responds to the alert?	The system administrator, after starting work in the morning	The SOC team, immediately
How does the ransomware progress?	It escalates, gaining access to more files, devices and servers	The infected device is isolated immediately
How does the ransomware attack end?	Damage is extensive and restoring access takes many hours	Damage is limited to a single device

Read more about EDR and XDR in our article:

EDR, XDR and MDR — how they differ and when they protect your business

What common organisational mistakes does this example reveal?

The organisation focused on detecting incidents rather than responding. That was the central mistake, with consequences lasting hours. EDR identified suspicious activity, generated an alert and even partly blocked ransomware spread. Timely follow-up was missing.

Deploying EDR from a recommended provider created a false sense of security. Decision-makers assumed the tool would solve ransomware attacks and neglected other areas. No SOC team was available 24/7, real-time response procedures were missing, and alerts were not analysed promptly to assess infrastructure risk and necessary action.

These were management failures rather than poor technology selection. EDR worked correctly but could not do all the work for people.

How can ransomware despite EDR be prevented from becoming a recurring story?

After the attack, the company focused on the right issues. Rather than blaming administrators, it considered how to prevent recurrence. It now understands that effective response depends on EDR and on developing, using and exercising procedures. Incident management must involve both tools and people.

The changes were not intended to eliminate every ransomware attack. External threats remain outside the company’s control. The more effective approach is to focus on early detection and preventing serious damage.

Lessons learned

What did the organisation learn from discovering the ransomware attack hours late? Security staff proposed several measures, which management approved. The company is now better protected through:

• SOC 24/7 monitoring, enabling real-time alert analysis and response. This combines the speed of technology with human experience and decision-making.
• Designed and implemented Incident Response procedures, reducing confusion and delays. When ransomware spreads rapidly, these can save valuable minutes. They define actions, employee roles and responsibilities, and internal communication.
• Playbooks with specific response scenarios for different threats. They enable action after detection and reduce dependence on one experienced person, allowing team members to follow a consistent approach.
• Regular cybersecurity exercises to practise Incident Response procedures and playbooks. Exercises help teams act faster during real threats and verify whether proposed actions work or need adjustment.

All measures were implemented together. SOC 24/7 ensures alerts do not reach an empty queue, while Incident Response procedures, playbooks and exercises support prompt, effective action. This reduces MTTR (Mean Time To Respond) and supports a return to normal operation. Read more: MTTD and MTTR — why detection time determines incident scale.

A major incident creates strong emotions. Searching for someone to blame at any cost will not stop future attacks or reduce their impact. Focus on the future and on what the company can control.

How do we combine technology, procedures and teams into an effective system? VigilHorizon’s approach to business cybersecurity

Our support goes beyond deploying EDR. We know that is not enough, as this story illustrates. EDR is an important tool, but only part of the wider security system.

In our approach, security monitoring goes together with appropriate response. Prompt, effective response needs developed and rehearsed procedures and an accountable, committed team. This supports controlled incident handling from detection to closure.

You have EDR, but are you confident it will work?

Is your company in a similar position: EDR is running, yet ransomware and other threats still disrupt IT? Take a comprehensive approach with 24/7 monitoring and effective incident response procedures. Our specialists can help.

Contact us to assess your situation and propose suitable solutions within the SOC package.

Contact us

Frequently asked questions (FAQ)

Does EDR stop ransomware?​

It depends on the EDR configuration. In some cases it can isolate
an infected device or block encryption. Its primary
role, however, is threat detection rather than complete remediation.

Does EDR work without a SOC?​

Yes. EDR analyses suspicious behaviour, detects threats and
generates alerts without a SOC. However, those alerts are often read later, which
extends incident response time.

Is EDR sufficient for NIS2?​

No. EDR is one element that helps an organisation meet
cybersecurity requirements, but does not independently ensure full NIS2 compliance.

Does every alert need analysis?​

Not every EDR alert represents a real threat. Assessment belongs to the SOC team.
Specialists decide whether an alert resulted from normal user activity,
administrative work or an incorrect EDR assessment. Every alert should
still be appropriately classified and handled so real threats are not missed.

How quickly should you respond?​

Every minute matters during a cyberattack. Even a short response delay
can allow ransomware to escalate and cause damage that is harder to remediate.

Learn more

• What is SOC 24/7, and why is monitoring not enough?
• SIEM in your company — why deployment alone does not improve security
• What does real incident handling involve? Incident Response step by step
• MTTD and MTTR — why does detection time determine incident scale?