Bitdefender GravityZone Endpoint Detection and Response Add-On

What is included in Bitdefender GravityZone Endpoint Detection and Response Add-On?

EDR sensor – Records process, file and network activity on each endpoint.
Incident Advisor – Plain-language summary of what happened and why.
Root Cause Analysis – Traces the incident back to its entry point.
Response actions – Endpoint isolation, process termination and remote shell sessions.
Search and blocklist – Hunt for indicators and block them across endpoints.
Important – It has no own antivirus and requires a base licence.

What are the main benefits of Bitdefender GravityZone Endpoint Detection and Response Add-On?

The add-on extends an existing GravityZone licence with detection, investigation and response, managed from the same cloud Control Center as the prevention modules. Bitdefender previously sold this component as the GravityZone Ultra Add-on (EDR).

No second console – Detections appear beside the antivirus alerts you already read.
Cross-endpoint correlation – Links events on several machines into one incident.
Faster triage – Written incident summaries replace manual log reconstruction.
Guided response – Suggested containment steps for staff without SOC experience.
Incident history – GravityZone keeps incident records for ninety days.
MITRE mapping – Tactics and techniques labelled for later audit reports.

Best antivirus? Why Windows Defender alone is not enough
Explains where signature and behaviour based prevention stops, which is exactly the gap an EDR layer is bought to close.

Which company size is Bitdefender GravityZone Endpoint Detection and Response Add-On suitable for?

Company size matters less here than two other things: whether you already run a GravityZone base licence, and whether someone in the organisation will actually look at an incident when it appears. The add-on produces findings that need a human decision, so it pays off where an internal administrator or a service provider is responsible for security by name.

Does Bitdefender GravityZone Endpoint Detection and Response Add-On meet the requirements of Swiss cybersecurity legislation?

In Switzerland the reporting obligation applies to operators of critical infrastructure, not to every company, so the first question is whether your organisation is in scope at all. Under the revised Information Security Act, those operators must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. A 24-hour report needs facts rather than impressions, and that is the concrete contribution of this add-on: the incident record shows which endpoint was affected, which process started the chain, and at what time, so the questions can be answered without reconstructing raw logs first. What it does not do is decide whether an event is reportable, write the report, or see systems where no agent is installed, such as network appliances, most OT equipment and mobile devices. It also cannot tell you whether personal data left the company, which is a separate assessment with its own obligations. This text is not legal advice, and whether your company falls under the reporting obligation should be clarified with a qualified advisor.

Does Bitdefender GravityZone Endpoint Detection and Response Add-On meet the requirements of European cybersecurity legislation?

No product makes a company NIS 2 compliant, because the directive addresses organisational measures, governance and reporting rather than software features. NIS 2 asks for risk analysis, incident handling, business continuity, supply chain security, and procedures for checking whether the chosen measures actually work. This add-on supports the incident handling category in a way you can point to: it detects activity after prevention has failed, retains incident records for ninety days, and offers containment actions that can be taken before an external specialist is on site. It does not support business continuity, because it neither backs up nor restores data, and it contributes nothing to supply chain security or to governance. Reporting duties, deadlines and supervision are defined by each member state when the directive is transposed, so what the product delivers is evidence for a process your organisation still has to write down itself.

Does Bitdefender GravityZone Endpoint Detection and Response Add-On help with security questionnaires from large customers?

Partly, and the split is predictable enough to plan around. Questions it answers with an export from the console: whether endpoint activity is monitored beyond signature-based antivirus, whether detections are investigated centrally, how long incident data is retained, whether a compromised endpoint can be isolated from the network, and which named people are allowed to trigger that action. Questions it does not answer: patch level of third-party applications, disk encryption status, mobile device coverage, mailbox protection, and log retention for anything the endpoint agent does not see. If a questionnaire fails on those points, the cheaper route is usually another add-on from the same family, such as Patch Management or Full Disk Encryption, or a move up to Business Security Enterprise. Mixing in a second vendor means a second console, a second set of exclusions and a second support contact, which costs more administrative time than the licence difference usually saves.

What is the difference between GravityZone Business Security Premium and GravityZone Business Security Enterprise?

The decisive difference is that Business Security Enterprise already contains the EDR component, while Business Security and Business Security Premium do not. Buying this add-on therefore only makes sense on top of a base licence that lacks EDR; adding it to Business Security Enterprise would duplicate a function you already own. Bitdefender previously sold the same component as the GravityZone Ultra Add-on (EDR), and Business Security Enterprise itself was formerly called GravityZone Ultra, which is why both old names still turn up in older quotes and comparison charts. Prevention behaves the same way in all three routes, so the decision is about detection depth and about which licence you already hold, not about how well malware is blocked.

Which limitations should you know before buying?

In GravityZone Cloud this add-on cannot be operated on its own; it needs a base licence that supplies the prevention layer, and Bitdefender sells a separate standalone EDR product type for organisations that want to keep another vendor's antivirus. Incidents are retained for ninety days, but access to the underlying raw events depends on a separate EDR Data Retention add-on, sold in 90, 180 and 365-day variants, which is the single most common source of a surprise follow-up purchase. On Linux the EDR sensor only works on supported kernel versions and distributions, using auditd on older systems and kprobes on modern ones, so a Linux fleet should be checked against the current support list before rollout rather than after. The add-on also covers nothing outside the endpoint agent: it does not patch third-party software, does not manage disk encryption, does not protect mailboxes, does not include mobile devices, and does not back up or restore anything. Finally, the console is a cloud service running on several separate GravityZone instances, so if data location matters to your customers or auditors, confirm with your reseller which instance your tenant is created on.

Data loss is expensive: How backups help you avoid outages
Covers the recovery side that no EDR product handles, and why detection and backup are two separate line items in a security budget.

Frequently asked questions about Bitdefender GravityZone Endpoint Detection and Response Add-On

Can we keep our current antivirus and only add this component?

Not with this add-on in GravityZone Cloud, because it is licensed to work alongside a Bitdefender base product that provides prevention. Bitdefender offers a separate standalone EDR product type for exactly that situation, where the sensor is installed next to an existing third-party endpoint platform. That is a different purchase, so check the product type on the quote before ordering.

Can we hand the monitoring over to Bitdefender later?

Yes, and the EDR add-on is the prerequisite for it. Bitdefender MDR requires EDR to be present, so companies that start with the add-on and later find nobody has time to read incidents can move to the managed service without replacing the agent or the console.