EDR vs XDR: Attack Detection Simulator

Detection mode

Attack speed 1.0×

Detection status

Signals detected

Time to detection

–

Full attack chain

Not detected

EDR sees only what happens on this one laptop — the process tree it monitors locally.

How it works

The same intrusion — a phishing email → a malicious attachment spawning a shell → that shell encrypting files → lateral movement to a second machine — is replayed identically in both modes. What differs is visibility. EDR (Endpoint Detection & Response) instruments one machine: it sees the local process tree and can flag the malicious child process the moment it does something dangerous, but it has no idea an email started it or that another host is also compromised. XDR (Extended Detection & Response) ingests telemetry from the email gateway, every endpoint's EDR agent, network flow logs and cloud/SaaS audit logs into one correlation engine, which stitches separately-innocuous-looking signals into a single incident.

EDR:  see(endpoint_i) only
XDR:  see(email ∪ endpoint_1..n ∪ network ∪ cloud)
      correlate(signal_a, signal_b, …) → incident
      confidence(chain) ≫ confidence(any signal alone)

EDR — single endpoint — only the local process tree is drawn; the malicious process still turns red the instant it spawns a shell or starts encrypting, but nothing outside the laptop is ever shown.
XDR — whole environment — the email gateway, three endpoints, network traffic and a cloud/SaaS log all light up as the attack touches them, and a gold correlation line stitches every signal into one attack chain.
Attack speed — how fast the scripted intrusion timeline advances; slow it down to watch each hop, speed it up to compare detection latency.
Time to detection — EDR "detects" only the final local step (an isolated alert with no context); XDR's clock stops when the full chain is correlated, which is the moment an analyst gets one high-confidence incident instead of several disconnected low-confidence alerts.

Real-world relevance: this is the core sales pitch behind XDR platforms — the same raw signals already exist in an EDR-only environment, but without cross-source correlation an analyst has to manually connect an email alert, a process alert and a network alert themselves, which is slow and easy to miss under alert fatigue.

Idle node / process Signal in progress Malicious action Correlated attack chain

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.