Why EDR without SIEM doesn’t stop ransomware: A breakdown of three incidents in 2025

In 2025, a common misconception among small and medium businesses is that deploying an EDR solution provides comprehensive protection against ransomware. While EDR is vital for endpoint security, it primarily focuses on individual device activities. Without a broader view of network-wide events, organizations often miss the early indicators of a coordinated attack. For instance, an EDR might flag malicious activity on a single workstation, but without correlating that alert with unusual network traffic, failed login attempts across multiple servers, or suspicious access to shared drives, the isolated event often gets lost in the noise.

From Softline IT’s experience, the key mistake at this stage is treating EDR as a standalone silver bullet. A system integrator since 1995, Softline IT engineers often encounter situations where businesses invest heavily in endpoint protection but neglect the crucial layer of centralized log management and correlation that a SIEM provides. This oversight leaves critical gaps, particularly when dealing with multi-stage ransomware campaigns.

Incident 1: Lateral movement undetected

A user receives a phishing email, and an EDR solution on their workstation successfully blocks the initial malware payload. However, the attacker has already gained a foothold through a credential stuffing attack on a less-monitored internal server, leveraging an old RDP port. EDR, focused on the workstation, sees no new malicious files executed there. Meanwhile, the attacker uses legitimate administrative tools to move laterally across the network, escalating privileges, and eventually deploying ransomware from a compromised domain controller. Without a SIEM correlating the RDP brute-force attempts, the unusual administrator logins from a new IP, and the subsequent access to sensitive file shares, the EDR alert remains an isolated, low-priority event.

Incident 2: Supply chain compromise and persistence

A legitimate software update from a trusted vendor is compromised, containing a stealthy backdoor. EDR might not flag the update as malicious because it’s signed and originates from a known source. The backdoor establishes persistence, quietly exfiltrating small amounts of data over weeks. EDR’s behavioral analysis might detect unusual outbound connections from the updated application, but without a SIEM to aggregate these low-volume alerts across multiple endpoints, identify the pattern of data exfiltration, and correlate it with external threat intelligence feeds, the activity appears as benign network noise. When the attacker finally activates the ransomware payload, it’s too late. The EDR might block the final encryption, but the attacker has already achieved their objective of data exfiltration and maintained access for an extended period.

Incident 3: Insider threat or legitimate tool misuse

An employee, either malicious or negligent, uses legitimate system administration tools (e.g., PowerShell, PsExec) to access sensitive data and deploy ransomware. EDR solutions are designed to monitor for known malicious executables and suspicious API calls. However, when legitimate tools are misused, EDR often struggles to differentiate between legitimate and malicious activity without extensive, finely tuned rules that can lead to high false positives. A SIEM, on the other hand, can correlate the use of these tools with unusual login times, access to files outside of typical work scope, or attempts to disable security features. For example, a SIEM could flag an administrator account using PowerShell to access hundreds of sensitive documents outside of business hours, followed by attempts to delete shadow copies – a clear precursor to ransomware deployment – even if the EDR sees the PowerShell activity as benign.

Practical steps for enhanced ransomware defense

To effectively combat ransomware, businesses need to move beyond isolated security solutions. Start by conducting a thorough audit of your existing IT infrastructure to identify all potential log sources – network devices, servers, firewalls, cloud services, and applications. Prioritize the implementation of a centralized logging system, even a basic one, as a first step towards SIEM capabilities. When planning your IT budget, allocate resources not just for endpoint protection, but also for log aggregation, correlation, and threat intelligence integration. Consider a phased approach: first, ensure all critical systems are logging effectively, then implement a basic SIEM to collect and normalize these logs, and finally, integrate it with your EDR for comprehensive visibility. This approach allows for proactive threat hunting and rapid incident response, significantly reducing the window of opportunity for ransomware attackers.