In short: Bitdefender GravityZone EDR is detection and response for GravityZone endpoints. It records endpoint activity, correlates related detections across devices into one incident, shows the attack chain visually, aligns detections to MITRE ATT&CK and offers response guidance. Through Forever Systems it is licensed per endpoint, billed monthly, and can be extended with XDR sensors or Bitdefender MDR.
What GravityZone EDR adds
Prevention stops most threats, but some attacks use legitimate tools, stolen credentials or slow, quiet steps that do not look like malware. Endpoint detection and response (EDR) records what happens on each device and looks for patterns that point to an attack in progress.
In GravityZone, EDR works alongside the prevention layers of GravityZone Cloud MSP Security, and incidents appear in the same console as prevention alerts. That matters for small teams: one place to look, one set of policies and one agent to keep up to date.
What is included
| Capability | What it gives you |
|---|---|
| Cross-endpoint correlation | Related detections on different devices are combined into one larger incident |
| Attack visualisation | A graphical view of the attack chain: where it started, how it spread and what it touched |
| MITRE ATT&CK alignment | Detections mapped to known attacker techniques |
| Historical and live search | Hunt for indicators of compromise and check endpoint configurations |
| Response guidance | Incident insights and recommended actions for teams of different experience levels |
| One-click response | Investigation and response workflows launched from the incident |
| SIEM forwarding | Incidents and events can be sent to tools such as Splunk, QRadar and Microsoft Sentinel |
Bitdefender's Advanced Threat Security complements EDR with HyperDetect, tunable machine learning that blocks attacks before they run, and Sandbox Analyzer, which detonates suspicious files in Bitdefender's cloud sandbox. Both are included in Bitdefender's Secure package for providers.
XDR and MDR options
EDR looks at endpoints. Bitdefender also sells XDR sensors that bring in other sources, and a managed service for organisations without their own security team:
| Option | What it covers |
|---|---|
| XDR Identity | Suspicious authentication, account misuse and privilege abuse |
| XDR Productivity | Suspicious activity, links and files in productivity and collaboration platforms |
| XDR Network | Network traffic patterns such as scanning, brute force and lateral movement |
| XDR Cloud | Activity and configuration changes in cloud environments |
| MDR | Bitdefender's security operations team monitors, investigates and responds 24/7, with threat hunting and a monthly report |
We will help you decide where the value is: for many small businesses, EDR plus MDR gives more protection than extra sensors watched by nobody.
How it is licensed
GravityZone EDR is licensed per protected endpoint on top of your GravityZone base licence, either as a module or within Bitdefender's Secure, Secure Plus and Secure Extra packages, and billed monthly on usage through your Forever Systems account. You can enable it on every device or only on the machines that matter most, such as servers and finance laptops. XDR sensors and MDR are priced separately, and EDR Data Retention can be added if you need a longer history for investigations.
Prices depend on the endpoints covered and the options chosen, so ask us for a quote. If you have committed to a long term elsewhere, see software renewals for timing a move.
Requirements and deployment
EDR uses the Bitdefender agent already on your Windows, macOS and Linux devices, and it needs more memory than prevention alone, so we check older machines against Bitdefender's current requirements first. We enable it by policy, review the first incidents with you, then agree which responses should be automatic once alerts are tuned to your environment.
Who it suits and how we help
GravityZone EDR suits organisations whose insurer, customers or auditors ask about detection and response, and those who want to see what happened after an incident rather than just a blocked file. If nobody in-house can watch the console out of hours, MDR is the sensible pairing. We set up response policies, review incidents with you and explain them in plain English. Compare other options in EDR, XDR and MDR, then contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is GravityZone EDR a separate agent?
No. It works through the same Bitdefender agent and console used for endpoint protection, enabled by policy.
What is the difference between Bitdefender EDR and XDR?
EDR collects and correlates data from endpoints. XDR adds sensors for identities, productivity platforms, networks and cloud environments, so incidents that cross those areas appear as one story.
Does Bitdefender offer a managed service?
Yes. Bitdefender MDR provides a 24/7 security operations team that monitors, investigates and responds on your behalf. For providers it is packaged as Secure Plus, built on EDR.
Can we put EDR on servers only?
Yes. EDR is licensed per endpoint, so you can start with servers and key users and extend later.