--- title: "Which Endpoint Detection & Response (EDR) product does the Applicant use?" url: https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-product-applicant category: "Endpoint protection and patching" canonical_key: q_edr_009 evidence_state: attested updated: 2026-08-24 --- # Which Endpoint Detection & Response (EDR) product does the Applicant use? URL: https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-product-applicant Section: Endpoint protection and patching Evidence state: Attested, not tenant-verifiable Naming the product is easy. The reason carriers ask is that the name lets them infer the answers to several questions you have not been asked. ## What the carrier is actually asking The carrier wants the vendor and product, and increasingly the specific tier or plan. Some markets maintain internal lists of tooling they view favourably, and some offer premium credits tied to specific vendors through partnership arrangements. ## Why it is underwritten Underwriters cannot audit your deployment, so the product name serves as a proxy for detection quality, and the tier tells them whether you have the detection and response capability or only the prevention component. It is a shortcut, and it works well enough to have become standard. ## Where the answer lives in Microsoft 365, Entra ID, and Azure The product name comes from your endpoint console. What the tenant can confirm is whether the Microsoft components are integrated, which matters when the answer is Defender. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Endpoint console | Product name, plan or tier, and licensed seat count | The exact plan, since tiers of the same product differ enormously in capability. Attested | | Azure | Defender for Endpoint integration and Defender for Servers plan | Where the answer is Microsoft, the plan level and integration state are visible | | Microsoft 365 | Defender for Office plan and Defender portal onboarding | Whether the broader Defender suite is licensed and onboarded, which supports a stronger description than the endpoint agent alone | | Managed service | The provider operating the console, if not you | Provider name and coverage hours, which carriers weigh alongside the product | | Deployment record | Deployment date and current agent version spread | A recently deployed product carries less operational maturity than the name alone implies | **Name the tier, not just the vendor** Answering with a vendor name alone invites the underwriter to assume the lowest tier. Naming the plan, and adding who monitors it and during which hours, converts a one-word answer into three data points that all favour you if they are true. ## What a defensible yes requires - The answer names the vendor, the product, and the tier or plan. - It states who monitors the console and during which hours. - It matches the coverage figure given elsewhere on the form. - Where multiple products are in use across the estate, all are named rather than the best one standing for the rest. - The licensed seat count is consistent with the device count you reported. ## How this answer goes wrong The mismatch is what causes trouble: a premium product named on the form and a licence count covering half the fleet, or a product named that was replaced last year on part of the estate. Underwriters compare this answer with the coverage percentage and the device count, and inconsistencies between the three generate exactly the follow-up questions you want to avoid. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does the vendor choice affect price? Sometimes directly, through partnership credits, and always indirectly, because the name sets expectations about capability. It is not the largest factor, and it is one of the easiest to answer accurately. ### What if we use different products in different places? Say so and give the split. A mixed estate is normal after acquisitions, and describing it accurately avoids a discrepancy later. ### Does a managed provider change the answer? It strengthens it. Include the provider and the hours, since twenty-four hour monitoring is a separate question on most forms and this is where the evidence for it starts. ### Is Microsoft Defender viewed less favourably? No. It is mainstream and well regarded, provided you name the plan, because the difference between the antivirus component and the full detection and response plan is substantial. ## Related questions - [Is endpoint detection & response (EDR) deployed with central monitoring?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-deployed-central-monitoring) - [What percentage of endpoints have EDR deployed?](https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed) - [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7) - [Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?](https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.