Several recent ransomware outbreaks at a company have cost a significant amount of lost revenue. The security team needs to find a technical control mechanism that will meet the following…

A host-based firewall controls inbound and outbound network traffic by port and protocol; it cannot analyze process behavior or detect malware execution.

EDR continuously monitors endpoint behavior and uses heuristic and machine learning analysis to detect suspicious activity that does not match any known signature. It can identify, alert on, and block previously unknown threats in real time, and it augments existing security tools by providing deeper forensic telemetry and automated response capabilities - directly satisfying all four listed requirements.

A HIPS uses predefined rule sets and signatures to block known attack patterns; it lacks the behavioral analytics needed to stop unknown or signature-less threats.

Patch management reduces the attack surface by remediating known vulnerabilities; it is a preventive control and cannot detect or respond to active ransomware executing on a host.