Your EDR Is Watching. But Is It Preventing? How File-Layer Security Changes the Equation

Most organizations have invested heavily in tools that tell them what already happened. What they need is something that stops more of it from happening in the first place.

Endpoint Detection and Response platforms, or EDR, have become the backbone of enterprise security over the past decade. The old model of matching files against a database of known malware signatures was too slow, too brittle, and too easy to evade. EDR replaced it with something more capable: continuous visibility into what is actually happening on the machine, behavioral analysis, and the ability to respond to threats in progress rather than after the fact.

It was a real improvement. But it came with a catch that the industry is still working through. Detection creates work. Every alert that fires needs someone to look at it, understand it, decide whether it is real, and then do something about it. In theory, that workload is manageable. In practice, for most organizations, it is not.

The Alert Workload Nobody Talks About

An average enterprise SOC receives around 3,000 security alerts per day. Forty-six percent of those alerts turn out to be false positives, according to the 2026 Microsoft and Omdia State of the SOC report. That means nearly half of an analyst’s daily workload produces no security value at all. It just consumes time and focus that could have gone toward something real.

The 2025 SANS Detection and Response Survey found that 73 percent of security teams name false positives as their single biggest detection challenge. Cybersecurity Insiders reports that 76 percent of organizations now cite alert fatigue as a primary concern for their SOC. More than 80 percent of analysts say their workload has increased over the past year.

This is not a staffing problem in the conventional sense. Even organizations that invest in additional headcount find that more analysts also means more tools, more consoles, and more coordination overhead. The Microsoft and Omdia research found that the average organization manages 10.9 separate security consoles, each generating its own alert stream with its own severity scale and format. Adding people to that environment sometimes makes the noise louder rather than quieter.

“If we use standard utilities, we won’t be detected. We never drop tools on machines.”

Internal communications from the BlackBasta ransomware group, cited in Bitdefender’s analysis of 700,000 security incidents

The problem underneath all of this is structural. EDR was built to detect threats. Detection is reactive by design. No matter how fast the detection is, it still comes after the malicious activity has begun. The alert fires because something already happened. The analyst’s job is to figure out what, how bad, and what to do about it. That is genuinely valuable work. But it is not the same as stopping threats before they start.

AI Is Accelerating the Problem on Both Sides

The operational pressure on security teams is growing for a reason that did not exist five years ago: attackers now have access to AI tools that compress what used to be weeks of development work into hours. Language models can generate malicious PowerShell scripts, JavaScript droppers, Visual Basic macros, and phishing content in seconds. Phishing campaigns that previously required a team to prepare can now be produced at scale with personalized content tailored to specific individuals, their roles, their organizations, and their recent public activity.

Sophos recently uncovered a fully operational AI-assisted malware development environment used by an active ransomware group. The framework used multiple AI agents coordinated through the Model Context Protocol to read security research, extract bypass techniques, map them to the MITRE ATT&CK framework, test them against Sophos, CrowdStrike, and Microsoft Defender in dedicated virtual machines, and document the results. Nearly 80 modules covered more than 70 distinct EDR evasion techniques. The same research pipeline that once required a specialized team now runs with a handful of people and an AI agent network.

The direct consequence for defenders is that the time between a malicious file entering an environment and a threat actor achieving their objective is shortening. EDR’s detect-and-respond model works best when there is time to investigate before damage compounds. As that window compresses, the value of stopping things at the entry point increases.

Living Off the Land: Why Most Alerts Are Hard to Act On

There is a second challenge that compounds the alert volume problem: most modern attacks use tools that are already on the machine. PowerShell, Windows Management Instrumentation, PsExec, Remote Desktop Protocol, scheduled tasks, registry modifications, and dozens of other native Windows utilities are being weaponized because they are trusted by the operating system and by most security products. Attackers call this living off the land, and as BlackBasta’s own communications confirmed, the whole point is not being detected.

The scale of this is significant. Bitdefender analyzed 700,000 security incidents and found that 84 percent of high-severity attacks involved living-off-the-land binaries. CrowdStrike’s 2025 Global Threat Report found that 79 percent of all its detections were malware-free attacks using these methods, up from 40 percent in 2019. A fresh Windows installation contains 133 unique living-off-the-land binaries and 987 total instances when duplicates are counted. Every one of them is a potential attack surface.

This presents EDR platforms with a genuinely difficult problem. PowerShell run by an IT administrator doing legitimate maintenance looks, at the command level, almost identical to PowerShell run by a threat actor dumping credentials. The difference is context, behavior over time, and what came before. Figuring that out requires exactly the kind of investigation work that alert-fatigued analysts are struggling to keep up with.

The Delivery Mechanism That All of This Depends On

Before an attacker can abuse PowerShell, establish persistence, move laterally, or trigger any of the behaviors that EDR is designed to detect, something has to get them inside. In the overwhelming majority of cases that something is a file.

Malicious Office documents, weaponized PDFs, JavaScript files, archive containers, installer packages, script files, and shortcut files are the standard delivery mechanism for the initial access that enables everything else. They arrive through phishing emails, cloud file-sharing platforms, collaboration tools, web downloads, and supply-chain compromises. They carry the macros that launch PowerShell. They contain the droppers that download the second-stage payload. They embed the JavaScript that starts the whole chain.

If the file never delivers its payload, the living-off-the-land chain never starts. The credential theft never happens. The lateral movement never begins. The EDR alert that would have triggered an investigation at two in the morning never fires. The security team wakes up to a normal morning.

This is the logic behind proactive file-layer security, and it is straightforward: if you neutralize the threat at the entry point, before the file reaches the endpoint and before any code runs, the downstream consequences disappear along with it.

How FileDNA Works Inside an EDR Workflow

FileDNA from CyberQuay operates as a file-level security layer that integrates with existing EDR infrastructure rather than replacing it. The approach is structural analysis rather than signature matching. Every file that enters the environment is deconstructed to its component elements: embedded scripts, macros, executable objects, linked data connections, nested archives, annotation layers, metadata, and any other active content. Components that should not be present according to the file’s own format specification are removed. What remains is reassembled into a clean, functional document and delivered back to the workflow.

This works regardless of whether the threat is a known malware family with a recorded signature or a brand-new polymorphic payload that no database has ever seen. The question FileDNA asks is not “does this match something I’ve seen before?” It is “does this content belong in this file?” If it does not belong, it is removed. That logic applies equally to a document carrying a ten-year-old macro technique and one carrying an AI-generated evasion payload designed specifically to defeat behavioral detection.

The Right Model: Prevention and Detection Together

None of this is an argument against EDR. It is an argument for a more complete security model. EDR’s visibility into what is happening on the endpoint is genuinely valuable and difficult to replicate through any other means. Lateral movement, credential theft in memory, privilege escalation, and attacker hands-on-keyboard activity are all things that EDR is well-suited to detect and that file-layer security never sees.

The combination produces something better than either does alone. FileDNA reduces the number of threats that reach the endpoint and start generating behavioral signals. EDR catches the ones that do get through, plus the threats that arrive through vectors that file scanning cannot cover. The security team handles fewer total events, the ones they do handle are more likely to be real, and their attention is concentrated on the investigations that actually warrant it.

Sophos made the point explicitly in their analysis of the AI malware lab case: despite the sophistication of what was found, the defensive fundamentals have not changed. Patching, multi-factor authentication, and strong endpoint protection remain the controls that define resilience. What is changing is the pressure those controls are under, and what it takes to sustain them without burning out the people responsible for operating them.

References

Alert fatigue and SOC workload research

Living-off-the-land attack research

AI-assisted malware development

CyberQuay product information

This article is provided for informational and educational purposes. All statistics are sourced from the referenced published reports. The Bitdefender 700,000-incident analysis, CrowdStrike 2025 Global Threat Report, SANS 2025 survey, and Microsoft and Omdia State of the SOC 2026 are all publicly available research documents.