Endpoint protection and patching

Which Endpoint Detection & Response (EDR) product does the Applicant use?

Naming the product is easy. The reason carriers ask is that the name lets them infer the answers to several questions you have not been asked.

Attested, not tenant-verifiable

What the carrier is actually asking

The carrier wants the vendor and product, and increasingly the specific tier or plan. Some markets maintain internal lists of tooling they view favourably, and some offer premium credits tied to specific vendors through partnership arrangements.

Why it is underwritten

Underwriters cannot audit your deployment, so the product name serves as a proxy for detection quality, and the tier tells them whether you have the detection and response capability or only the prevention component. It is a shortcut, and it works well enough to have become standard.

Where the answer lives in Microsoft 365, Entra ID, and Azure

The product name comes from your endpoint console. What the tenant can confirm is whether the Microsoft components are integrated, which matters when the answer is Defender.

PlatformWhere the setting livesWhat has to be true
Endpoint consoleProduct name, plan or tier, and licensed seat countThe exact plan, since tiers of the same product differ enormously in capability. Attested
AzureDefender for Endpoint integration and Defender for Servers planWhere the answer is Microsoft, the plan level and integration state are visible
Microsoft 365Defender for Office plan and Defender portal onboardingWhether the broader Defender suite is licensed and onboarded, which supports a stronger description than the endpoint agent alone
Managed serviceThe provider operating the console, if not youProvider name and coverage hours, which carriers weigh alongside the product
Deployment recordDeployment date and current agent version spreadA recently deployed product carries less operational maturity than the name alone implies
Name the tier, not just the vendor

Answering with a vendor name alone invites the underwriter to assume the lowest tier. Naming the plan, and adding who monitors it and during which hours, converts a one-word answer into three data points that all favour you if they are true.

What a defensible yes requires

  • The answer names the vendor, the product, and the tier or plan.
  • It states who monitors the console and during which hours.
  • It matches the coverage figure given elsewhere on the form.
  • Where multiple products are in use across the estate, all are named rather than the best one standing for the rest.
  • The licensed seat count is consistent with the device count you reported.

How this answer goes wrong

The mismatch is what causes trouble: a premium product named on the form and a licence count covering half the fleet, or a product named that was replaced last year on part of the estate. Underwriters compare this answer with the coverage percentage and the device count, and inconsistencies between the three generate exactly the follow-up questions you want to avoid.

Frequently asked

Does the vendor choice affect price?

Sometimes directly, through partnership credits, and always indirectly, because the name sets expectations about capability. It is not the largest factor, and it is one of the easiest to answer accurately.

What if we use different products in different places?

Say so and give the split. A mixed estate is normal after acquisitions, and describing it accurately avoids a discrepancy later.

Does a managed provider change the answer?

It strengthens it. Include the provider and the hours, since twenty-four hour monitoring is a separate question on most forms and this is where the evidence for it starts.

Is Microsoft Defender viewed less favourably?

No. It is mainstream and well regarded, provided you name the plan, because the difference between the antivirus component and the full detection and response plan is substantial.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture