[kermatt]

CYA incentives:

If I don't install one of these system (and global IT) killing EDR systems, and I have a breach _I_ am responsible.

If my company requires it, and I install it and the entire network falls over, responsibility is passed to the EDR vendor. Everytime the EDR platform in my org kills an app, much of the reaction internally is "Oh well, at least we are protected. Let's open a support ticket."

"Security" software has been troublesome since the first AV platform was released. But the personal risk for management to not deploy it is high.

[nothercastle]

Yeah this allows outsourcing both risk and responsibility. The institutional risk that you take in exchange is acceptable because it lowers personal risk