EDRs are great. They are fast, detect most attacks, and collect vast historical data. If you have a SOC in 2026, there’s no way you don’t have one.
But necessary does not mean sufficient.
After an alert is validated, the investigation process begins: A process that requires evidence and analytics EDRs were never built to provide. This article will outline 3 important gaps, and suggest how your team can close them.
Let’s get started.
#1 Attackers Know How to Evade EDRs
#2 EDR Telemetry =/= DFIR Collection
#3 EDRs Aren’t Tuned for DFIR
How to Close EDR Gaps with Cyber Triage
#1 Attackers Know How to Evade EDRs
In November of 2024, cybersecurity expert Mario Lobo analyzed research by CISA on 12 major ransomware gangs. As part of this analysis, Lobo found that every gang knew how to evade EDRs, and some knew as many as 9 techniques.
| Ransomware Group | LOtL – PowerShell | LOtL – BYOVD | Own Access Point | Power Tool | WMI | Process Hacker | GMER Anti-Rootkit | Backstab Tool | EDRKillShifter | Universal Virus Sniffer | IOBit Hacking | PCHunter | TDSS Killer |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RansomHub | ✓ | ✓ | ✓ | ✓ | |||||||||
| Blacksuit (Royal) | ✓ | ✓ | |||||||||||
| Black Basta | ✓ | ✓ | ✓ | ||||||||||
| Akira | ✓ | ||||||||||||
| Phobos | ✓ | ✓ | ✓ | ✓ | |||||||||
| ALPHV Black | ✓ | ✓ | |||||||||||
| Play | ✓ | ✓ | ✓ | ✓ | |||||||||
| Rhysida | ✓ | ✓ | |||||||||||
| AvosLocker | ✓ | ✓ | ✓ | ||||||||||
| Snatch | ✓ | ✓ | |||||||||||
| LockBit 3.0 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ||||
| BianLian | ✓ | ✓ | ✓ | ✓ |
Lobo’s take on this data was, essentially, that EDR evasion is inevitable: “While [EDRs] are important, we have to assume that ransomware gangs will be able to bypass defenses, no matter how they evolve, and plan for catching them on the other side.”
Is EDR evasion inevitable? Possibly. But if this sample is at all representative, it’s definitely widespread. And, since this analysis was done almost 2 years ago, it’s plausibly even more widespread now.
SOC and DFIR teams should assume EDRs routinely miss evidence from attacks. The alert may have fired, but what happened in the days (or weeks) before?
You can get that evidence. But you need a tool attackers aren’t trained to evade.
#2 EDR Telemetry =/= DFIR Collection
EDRs collect a huge amount of data, and that data is often very useful during investigations. But collecting a lot of data and collecting comprehensive data are not the same thing.
EDRs watch execution. Its sources are sensors that look at process events and logs and record some of the things that happened. You won’t get full file content or every file activity. You can’t see directory listings or view the registry. You just get a series of events.
DFIR collections are a snapshot of what was on the system. For a single execution, the EDR returns a single event. DFIR artifacts give:
- Prefetch: Last 8 run times, run count, files touched
- Amcache: First-execution time, SHA-1, path even for absent binaries
- SRUM: Bytes sent/received per process
- $MFT/USN journal: Creation and change timestamps
EDRs record that a process ran and may record what else it did. DFIR artifacts may give you more of a historical view of that process (past the EDR roll over) and will show you application-layer logs about what the process did.
Both are useful for DFIR. But only the latter can stand alone for DFIR.
#3 EDRs Aren’t Tuned for DFIR
Investigation and detection operate under different paradigms of suspiciousness.
To use a very simple analogy, if you walked through your house and you found your wallet on the floor (and you didn’t remember leaving it there), you’d likely pick it up and move on, assuming you just forgot. However, if your burglar alarm went off and then you made this discovery, you might come to a very different conclusion. When all is well, only obviously threats are threatening, but when you could be in danger, even the innocuous can become suspicious.
EDRs operate under the first paradigm of suspiciousness. They are tuned, by design, to alert security teams when there is “known bad” activity. This is *not* a design flaw. If they set the bar any lower, they’d generate so much noise they’d be useless. (If anything, the issue teams have with EDRs is that the bar is already too low).
But DFIR uses the second paradigm, because DFIR only occurs after the alarm has gone off: during an investigation.
EDRs are built for detection. But DFIR requires a tool built for investigation.
How to Close EDR Gaps with Cyber Triage
Cyber Triage is an AI-powered investigation platform that is designed for SOC and DFIR teams doing investigations.
Unlike EDRs:
- Cyber Triage collections can’t be evaded: Evasion tactics are designed to circumvent EDRs. Not DFIR platforms. Cyber Triage collects and detects attacker activity EDRs miss.
- Cyber Triage comes with a DFIR collector: EDRs don’t collect the comprehensive evidence DFIR needs. Cyber Triage has an Adaptive Collector that gives you the depth only artifacts provide.
- Cyber Triage is tuned for DFIR: EDRs don’t highlight the suspicious activity essential to investigations. Cyber Triage’s automated scoring is built to highlight what’s suspicious.
But, Cyber Triage is also designed to work with EDRs. EDRs are excellent detection platforms, and our investigation platform integrates with them to cover the entire investigation lifecycle: alert to report.
If you’d like to test Cyber Triage in your environment, try it today for free.