Plain Jane Defender also has a kernel component. The point is to not have to trust any additional vendor. You can't avoid trusting your OS vendor with writing a

Plain Jane Defender also has a kernel component. The point is to not have to trust any additional vendor. You can't avoid trusting your OS vendor with writing and updating kernel code but you can avoid trusting CrowdStrike. > Sort of. There are a lot of controls (MDM and sandboxing and such) that go into that. I'd guess most orgs would just slap EDR on the phones if they could. Again, same result with fewer skillsets and products if so. You need a pretty severe risk to outweigh that and I'm not sure a one-time incident and the slight risk of an actual hostile compromise of an EDR vendor get there. Maybe if there are more like this. There's nothing wrong with MDM and group policy in and of itself. If orgs could slap EDRs into their mobile devices, the mobile devices would have to become less secure to begin with. The EDR seems to be a marginal risk, but the problem is in the architecture change that's needed to accomodate such an invasive product as an EDR that is a huge risk.