Architecture
Local EDR or cloud EDR: what really changes depending on where analysis runs
July 29, 2026· 7 min
In short
A cloud EDR has a global threat view but requires your data to leave and the link to stay up. A local EDR decides in milliseconds, works with the network down and transmits nothing, at the cost of less collective intelligence. For confidentiality-bound sectors — legal, healthcare, industry — only the second model is defensible.
The real test: what happens offline?
Ask your current vendor. If the agent loses decision capability without the cloud link, your protection depends on your telecom operator as much as on your vendor.
Confidentiality: what leaves, and for how long
Ask for the exact list of transmitted fields and their retention period. Filenames and paths alone are often enough to reconstruct a sensitive client matter.
The trade-off we accept
We give up global telemetry and replace it with behavioural rules written by engineers plus an AI that explains each decision. That is a choice, not an architectural accident.
On the same topic