# What happens if attackers disable our EDR?

The endpoint goes quiet, and the endpoint tool cannot report its own silence, so you need a second witness. Disabling or uninstalling endpoint protection is a common early step for intruders and ransomware operators, using stolen admin rights or a vulnerable driver. From then on, the console may show the machine as offline or simply stop receiving events from it. Two things help. First, treat a silent agent as an incident: set an alert in your EDR console for agents that stop reporting, and check who has the rights to uninstall it. Second, watch the network, which the attacker cannot switch off from that one machine. NetSenX keeps seeing the host's behaviour whatever happens to its EDR: beaconing, scanning, lateral movement and unusual uploads. It does not see the EDR's own state, so it will not tell you that the agent stopped; it tells you what the machine does next.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/what-happens-if-attackers-disable-our-edr

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [How do we notice when a server's endpoint protection goes silent?](https://netsenx.com/en/faq/how-to-notice-when-endpoint-protection-goes-silent)
- [What is XDR, and is it the same as NDR?](https://netsenx.com/en/faq/what-is-xdr-and-is-it-the-same-as-ndr)
- [What is MDR, and do we need it?](https://netsenx.com/en/faq/what-is-mdr-and-do-we-need-it)
- [What is the difference between MDR and EDR?](https://netsenx.com/en/faq/what-is-the-difference-between-mdr-and-edr)
- [How do I choose an MDR provider for a small company?](https://netsenx.com/en/faq/how-to-choose-an-mdr-provider-for-a-small-company)