Which Endpoint Detection & Response (EDR) product does the Applicant use?
Naming the product is easy. The reason carriers ask is that the name lets them infer the answers to several questions you have not been asked.
What the carrier is actually asking
The carrier wants the vendor and product, and increasingly the specific tier or plan. Some markets maintain internal lists of tooling they view favourably, and some offer premium credits tied to specific vendors through partnership arrangements.
Why it is underwritten
Underwriters cannot audit your deployment, so the product name serves as a proxy for detection quality, and the tier tells them whether you have the detection and response capability or only the prevention component. It is a shortcut, and it works well enough to have become standard.
Where the answer lives in Microsoft 365, Entra ID, and Azure
The product name comes from your endpoint console. What the tenant can confirm is whether the Microsoft components are integrated, which matters when the answer is Defender.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Endpoint console | Product name, plan or tier, and licensed seat count | The exact plan, since tiers of the same product differ enormously in capability. Attested |
| Azure | Defender for Endpoint integration and Defender for Servers plan | Where the answer is Microsoft, the plan level and integration state are visible |
| Microsoft 365 | Defender for Office plan and Defender portal onboarding | Whether the broader Defender suite is licensed and onboarded, which supports a stronger description than the endpoint agent alone |
| Managed service | The provider operating the console, if not you | Provider name and coverage hours, which carriers weigh alongside the product |
| Deployment record | Deployment date and current agent version spread | A recently deployed product carries less operational maturity than the name alone implies |
Answering with a vendor name alone invites the underwriter to assume the lowest tier. Naming the plan, and adding who monitors it and during which hours, converts a one-word answer into three data points that all favour you if they are true.
What a defensible yes requires
- The answer names the vendor, the product, and the tier or plan.
- It states who monitors the console and during which hours.
- It matches the coverage figure given elsewhere on the form.
- Where multiple products are in use across the estate, all are named rather than the best one standing for the rest.
- The licensed seat count is consistent with the device count you reported.
How this answer goes wrong
The mismatch is what causes trouble: a premium product named on the form and a licence count covering half the fleet, or a product named that was replaced last year on part of the estate. Underwriters compare this answer with the coverage percentage and the device count, and inconsistencies between the three generate exactly the follow-up questions you want to avoid.
Frequently asked
Does the vendor choice affect price?
Sometimes directly, through partnership credits, and always indirectly, because the name sets expectations about capability. It is not the largest factor, and it is one of the easiest to answer accurately.
What if we use different products in different places?
Say so and give the split. A mixed estate is normal after acquisitions, and describing it accurately avoids a discrepancy later.
Does a managed provider change the answer?
It strengthens it. Include the provider and the hours, since twenty-four hour monitoring is a separate question on most forms and this is where the evidence for it starts.
Is Microsoft Defender viewed less favourably?
No. It is mainstream and well regarded, provided you name the plan, because the difference between the antivirus component and the full detection and response plan is substantial.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture