Answering the EDR Question on a Cyber Insurance Application

The EDR question on a cyber insurance application can ask for two facts: which endpoint detection and response product you run, and who watches its alerts. At-Bay's June 2026 application asks both, and one of its answer options is "Deployed but not actively monitored." Before you answer, confirm the product and licensed tier, count protected endpoints against your asset list, note exclusions and unhealthy sensors, and write down who triages alerts after hours. Answer the scope you can prove, not the one you hope for.

What is EDR, and how is it different from antivirus?

EDR continuously records activity on endpoints and lets a person or automated rule investigate and respond, for example by isolating a laptop. Traditional antivirus mainly blocks known malicious files and does not give the same investigation record.

The US Office of Management and Budget's memo M-22-01 (October 2021) describes EDR as combining "real-time continuous monitoring and collection of endpoint data" with "rules-based automated response and analysis capabilities." For the application, the distinction matters because the forms treat them separately. At-Bay's form lists "Antivirus" as one checkbox in a general security controls question and asks about EDR products in a different question. Ticking antivirus does not answer the EDR question.

What the At-Bay application actually asks about EDR

At-Bay's form AB-CYB-APP 06/2026 has two EDR questions, both marked optional on the form:

• Question 26: "Which of the following Endpoint Detection & Response (EDR) products does the Applicant use, if any?" It offers a list of named products (among them CrowdStrike Falcon Insight EDR, Microsoft Defender for Endpoint (E5), SentinelOne Singularity EDR and Huntress EDR), plus "No EDR in place" and "Other/Unknown" with a details box. If your product is not listed, choose Other and name it.
• Question 27: "If applicable, how are the EDR solutions managed?" The options are "Managed 24/7 by a third-party provider (e.g. MSSP or external IT vendor)," "Managed 24/7 by in-house security team," "Managed within business hours by in-house security team," "Deployed but not actively monitored," and "Unknown." If a third party manages it, the form asks for the vendor's name.

Other carriers ask differently. Beazley's ransomware supplemental application (edition F00765, May 2022) asks for the vendor of your EPP, EDR, MDR, NDR and SIEM tools, then asks whether you have a security operations center, whether it runs working hours only or 24/7, whether it is internal or third party, and whether it has "the authority and ability to remediate security events." Your form may ask none, some or all of this. Copy its exact wording into your worksheet.

Identify what you actually run

Answering with a brand name is not enough. Collect these facts from the EDR console and your contracts:

• Product and tier: the exact product name and license. Microsoft Defender for Endpoint Plan 1 and Plan 2 differ; At-Bay's list names "(E5)." A free or basic tier may be antivirus only.
• Deployed endpoints: the count of devices reporting to the console, compared with your asset inventory or device management tool. Name the gap.
• Operating system coverage: Windows workstations, Windows servers, macOS, Linux servers. Many small deployments cover laptops but not the file server or the hypervisor.
• Exclusions: devices or folders excluded from scanning or response, and why.
• Sensor health: devices that have not checked in for 7 days or more, sensors in passive or degraded mode, and outdated agent versions.
• Response settings: whether the tool only alerts or can isolate a device and kill a process automatically.

Self-managed EDR, MSP, MDR and SOC are different answers

Who watches the alerts is a separate fact from which product is installed, and small companies often get it wrong.

• Self-managed: your own staff receive console alerts. Usually business hours only, unless someone is on call and the alerts reach them.
• MSP: your IT provider installed the tool. Ask whether they actually triage alerts, during which hours, or only maintain the agent.
• Managed detection and response (MDR): a provider whose service is monitoring and responding to detections, often around the clock. Check what it can do without calling you.
• 24x7 security operations center (SOC): a staffed team monitoring at all hours. It can be in-house (rare at 10 to 150 people) or provided by an MDR or MSSP.

At-Bay's own MDR buyer's checklist warns that "some MDR providers limit their role to simply alerting you of issues, rather than actually handling them." Get the scope in writing.

Who receives EDR alerts after hours?

Find out by testing, not by assuming: check which email addresses, phone numbers or ticket queues the console sends to, and what happens at 2 a.m. on a Saturday. If nobody is paged outside working hours, the honest answer is business-hours monitoring.

Record the escalation path in the evidence file: who triages, the expected response time, who has authority to isolate a server or disable an account, and who calls leadership. The UK NCSC's guide to choosing a managed service provider (November 2025) advises small organizations to "clearly set out what the MSP will take responsibility for, and what remains with you as the customer." A contract schedule or statement of work that names the hours and actions is your proof.

What should you write if EDR coverage is partial?

Write the true scope. If 90 percent of endpoints run EDR and servers are excluded, or alerts are only watched during business hours, say exactly that in the comment field or a covering note, with the remediation date.

At-Bay's application states that it is "incorporated into and is part of the Policy" and that misrepresentation "shall be grounds for the rescission of any Policy issued." Choosing "Managed 24/7" because a vendor's sales page says so, when your contract buys business-hours support, is a misstatement. "Deployed but not actively monitored" is an available answer for a reason. If you are moving to MDR, give the signed start date rather than answering as if it is live.

EDR evidence checklist

Keep this pack with the signed application, dated at signing:

1. Console export of protected devices, with operating system and last check-in.
2. Asset inventory reconciliation showing devices without the agent and why.
3. License or subscription record showing product and tier.
4. Exclusion list with business reasons.
5. Screenshot of response policy settings (alert only, or isolate and block).
6. Alert routing settings: recipients, on-call schedule, ticket queue.
7. MSP, MDR or SOC contract section showing hours, actions allowed and response times.
8. One recent alert ticket showing who triaged it and when, with sensitive detail removed.

EDR answer worksheet

For each EDR-related question on your form, fill in:

• Exact question text and number: (copy from the form)
• Product and tier: for example, Microsoft Defender for Endpoint Plan 2.
• Coverage: 71 of 74 Windows and macOS devices; 3 Linux servers not covered, agent rollout due 2026-12-31.
• Monitoring: MSP triages alerts 07:00 to 19:00 weekdays; after hours, high-severity alerts page the IT lead's phone.
• Answer chosen: the option that matches the contract and test, here business-hours management, not 24/7.
• Note to underwriter: the coverage gap and its remediation date.
• Signer review: name and date.

The same evidence habit applies to the MFA section of a cyber insurance application. If a detection ever leads to a suspected ransomware incident, a short ransomware tabletop for a small IT team is a good way to test the escalation path you just documented.

What this does not promise

Naming a product or buying MDR does not guarantee eligibility, a premium, a limit or claim payment, and no source here shows that every insurer requires named EDR, 24x7 monitoring, MDR or a SOC. This is not legal advice. Confirm with your broker how your carrier reads each question.

Sources

• At-Bay Cyber Insurance Application, AB-CYB-APP 06/2026
• Beazley Ransomware Supplemental Application, F00765 (May 2022)
• OMB Memorandum M-22-01: Endpoint Detection and Response (October 2021)
• NCSC: Choosing a managed service provider (MSP)
• At-Bay: The MDR Buyer's Checklist for Small Businesses