Quick Answer 

In most cases, yes. But the question on the form isn't whether you have EDR — it's what percentage of your devices it covers, and whether anyone is acting on its alerts.

Coverage Percentage Is What's Asked

Underwriters ask for deployment coverage by device type, and expectations run high — near-total coverage of endpoints is the common benchmark. Owning licences for 100 devices while 85 have the agent installed is not a yes.

Run the numbers before answering: agents deployed, devices in your inventory, and the gap between them.

Servers Are the Usual Gap

EDR gets rolled out to laptops because that's where users are. Servers are often left out — sometimes for performance concerns, sometimes because they were commissioned before the rollout.

That's backwards from a risk perspective. Ransomware does its real damage on file servers and domain controllers, and an insurer reviewing a claim will look at whether the affected systems were protected. Cloud virtual machines are the second common omission.

Monitoring Is Part of the Question

Some insurers ask whether alerts are monitored, and increasingly whether that's around the clock. EDR that nobody watches records an attack rather than stopping it, and its most valuable capability — isolating a device before ransomware spreads — depends on someone acting within minutes.

Antivirus Isn't an Acceptable Answer

Traditional antivirus and EDR are treated as different controls. Answering the EDR question based on having antivirus installed is the kind of inaccuracy that surfaces during a claim investigation.

Example Scenario 

A 120-person manufacturer preparing for renewal was found to be relying solely on traditional antivirus across workstations and servers. PureStack deployed EDR across all managed devices, configured detection policies, and confirmed alerts were being actively monitored before the application went in.

How PureStack Closes Your EDR Gaps

We audit what's actually protected against your device inventory, deploy to the systems that were missed, and monitor the alerts so the answer on your form holds up.