Stop Trusting Your EDR: Incident Response for the 29-Minute Breakout

Who This Is For

If you're the one who gets the 3 a.m. call when the EDR console lights up, this is for you. You're not the CISO writing policy; you're the person who has to decide whether to pull the network cable. The misconception I want to kill: that your EDR is your incident response plan. It's not. EDR is a detector, not a responder. It can isolate a host and kill a process, but it can't tell you what to do next, and it won't stop the second, third, or fourth move an attacker makes. The CrowdStrike 2026 Global Threat Report puts average breakout time at 29 minutes (CrowdStrike 2026 Global Threat Report). That's not a typo. In the time it takes to read this article, an attacker can be inside your domain controller. So let's walk through what you actually do when the alert fires.

1. Accept That Your EDR Is Blind

First, internalize this: 82% of detections in 2025 were malware-free (CrowdStrike 2026 Global Threat Report). That means most attacks don't drop a .exe on disk; they use PowerShell, they abuse valid credentials, they live off the land. Your EDR might catch some of that, but it's not infallible. So your first move is to stop assuming the alert you're seeing is the whole story. Treat every alert as one piece of a larger attack. The moment you see something, assume there's more. That's not paranoia; that's the reality of modern attacks.

2. Contain Fast, Contain Wide

Containment is not the time to be surgical. When you see a suspicious process on one endpoint, your instinct might be to isolate just that host. Resist. The attacker has already moved. In 2025, the average breakout time was 29 minutes (CrowdStrike 2026 Global Threat Report). That means by the time you notice, they've likely already touched other machines. So isolate the entire subnet, not just the host. If you're using an EDR like Microsoft Defender for Endpoint, you can do this with a few clicks, but don't wait for the UI to load. Have a runbook that says: "If we see X, we isolate the following VLANs." Do it. You can always undo it later. What you can't undo is a domain-wide ransomware encryption.

3. Hunt for the Pivot, Not the Payload

Once you've contained, the next step is to find where the attacker went. Don't just look at the original host; look at the logs. Check authentication logs for unusual logins, look for new accounts, look for scheduled tasks. The attacker didn't break in just to sit there; they're looking for credentials or a way to escalate. Use MITRE ATT&CK as your map (MITRE ATT&CK). It's a knowledge base of real-world tactics and techniques, and it's free. If you see a technique in one of the ATT&CK tactics, like Lateral Movement, hunt for that same technique elsewhere. For example, if you see pass-the-hash on one host, check all hosts for that same behavior.

4. Don't Pay the Ransom. Do Have Backups.

If this turns into ransomware, and it often does, here's the hard truth: paying doesn't guarantee you get your data back, and it funds the next attack. CISA's StopRansomware guidance is clear: backing up is your best bet for recovery (CISA StopRansomware guidance). So the real IR plan starts long before the incident. You need offline, encrypted backups, and you need to test them regularly. That's not just a checkbox; it's your lifeline. If you can restore from backup, you don't need to pay. If you can't, you're at the mercy of criminals. And if you do get hit, report it to the FBI's IC3 (CISA StopRansomware guidance). They track these things, and your report helps others.

5. Eradicate the Root Cause, Not Just the Symptom

Containment stops the bleeding. Eradication stops the disease. You can't just delete the malicious file and call it done. You have to find how they got in. Was it a phishing email? A vulnerability in an internet-facing app? The Verizon 2026 DBIR found that more breaches now start with exploitation of software vulnerabilities than stolen passwords (Verizon 2026 Data Breach Investigations Report). So patch those vulnerabilities. Use CISA's Known Exploited Vulnerabilities (KEV) catalog as your priority list (CISA Known Exploited Vulnerabilities Catalog). If a vulnerability is on that list, it's being exploited right now. Patch it within two weeks, as CISA requires for federal agencies (CISA BOD 22-01). And don't forget the account that was compromised. Reset passwords, enable MFA, and review all access rights.

6. Learn, Then Change the Playbook

After the dust settles, do a post-incident review. NIST SP 800-61 Rev. 2 defines the IR lifecycle: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (NIST SP 800-61 Rev. 2). The last phase feeds back into the first. So ask: What did we miss? What would have caught this earlier? Was our EDR tuned too loosely? Did we have too much trust in our network? This is where you start moving toward Zero Trust, but not in a big-bang way. Start with the principles from NIST SP 800-207: least privilege, per-request access, and assume breach (NIST SP 800-207). You don't need to rip out your whole network; just start restricting access to resources on a need-to-know basis. That's a practical step you can take tomorrow.

7. The Real Lesson: It's About the Response, Not the Tool

Here's the thing that separates the good IR teams from the bad: they don't rely on a single tool. They have a plan, they practice it, and they know that the EDR is just one sensor. The IBM Cost of a Data Breach Report 2026 found that organizations using extensive AI and automation in security saved an average of $1.93 million compared to those using none (IBM Cost of a Data Breach Report 2026). So use your EDR's automation, but also have manual runbooks. The best incident responder is a person who knows what to do when the tool goes silent. And that's not something you buy; it's something you build.

What Can Go Wrong

Here's the warning: if you don't have a tested IR plan, you will freeze. I've seen it. The alert goes off, and everyone stares at the screen, waiting for someone else to make the call. By the time they decide, the attacker has already exfiltrated data or deployed ransomware. So write the runbook now. Test it with a tabletop exercise. Know who makes the decision to isolate a subnet. And practice restoring from backup. The time to learn is not during an incident.

The Single Most Important Thing to Remember

Your EDR is not your incident response plan. It's a tool. The plan is what you do when the tool detects a threat, and that plan must be fast, broad, and tested. Because in 29 minutes, it's already too late.

Sources

• CrowdStrike 2026 Global Threat Report - https://www.crowdstrike.com/en-us/global-threat-report/
• CISA StopRansomware Guide - https://www.cisa.gov/stopransomware/ransomware-guide
• NIST SP 800-61 Rev. 2 - https://csrc.nist.gov/pubs/sp/800/61/r2/final
• NIST SP 800-207 - https://doi.org/10.6028/NIST.SP.800-207
• Verizon 2026 Data Breach Investigations Report - https://www.verizon.com/business/resources/reports/dbir/
• IBM Cost of a Data Breach Report 2026 - https://www.ibm.com/reports/data-breach