What is included in Bitdefender GravityZone EDR Cloud?

EDR sensor – Records endpoint activity and sends events to the cloud console.
GravityZone Control Center – Single web console for policies, incidents and response actions.
Cross-endpoint correlation – Joins related detections on several machines into one incident.
Sandbox Analyzer – Detonates suspicious files in an isolated cloud environment.
Search and telemetry – Historical and live search across recorded EDR raw events.
Important – No firewall, device control, patch management or encryption included.

What are the main benefits of Bitdefender GravityZone EDR Cloud?

Bitdefender GravityZone EDR Cloud is a standalone endpoint detection and response product that records what happens on Windows endpoints and turns those events into investigable incidents. It is managed entirely from the cloud-hosted GravityZone Control Center and is built to run next to an endpoint protection platform that is already in place, including one from another vendor.

No AV replacement – Deploys without removing the antivirus you already run.
Faster root cause – Shows where an incident started and how it spread.
Fewer separate alerts – Related detections arrive as one incident, not dozens.
Direct response actions – Isolate a host or stop a process from the console.
MITRE ATT&CK mapping – Detections are labelled with recognised attacker techniques.
Path to MDR – Bitdefender MDR builds on the same EDR deployment.

Why Windows Defender alone is not enough
Explains why prevention on its own leaves attacks unnoticed, which is the gap an EDR layer is meant to close.

Which company size is Bitdefender GravityZone EDR Cloud suitable for?

The deciding factor is not headcount but whether someone will actually look at the incidents. EDR produces findings that a human has to triage, so a company without that capacity should pair the product with a managed service rather than buy detection it will never read.

Does Bitdefender GravityZone EDR Cloud meet the requirements of Swiss cybersecurity legislation?

The obligation that matters here applies to operators of critical infrastructure, not to every Swiss company. Since 1 April 2025 the revised Information Security Act requires those operators to report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering it, with a further 14 days to complete the report. A 24-hour deadline is an evidence problem before it is a paperwork problem, and that is the part this product supports: the incident view reconstructs which process started the attack, which endpoints it reached and in what order, which is the substance of a first notification. What it does not do is decide whether an event is reportable, produce the notification itself, or say anything about systems its Windows sensor is not installed on, so a Linux server or a Mac outside the sensor scope contributes nothing to that timeline. It also does not replace the internal duty roster that has to notice an alert on a Saturday night. This describes product capabilities and is not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does Bitdefender GravityZone EDR Cloud meet the requirements of European cybersecurity legislation?

No software product makes an organisation compliant with the NIS 2 Directive, because the directive addresses management responsibility, processes and evidence rather than tooling. NIS 2 requires a set of risk management measures from essential and important entities, among them incident handling, detection and reporting, business continuity and backup, supply chain security, cyber hygiene and training, access control, and the use of cryptography. Bitdefender GravityZone EDR Cloud contributes to the detection and incident handling category: it records endpoint activity, correlates it into incidents, and supports response actions and post-incident analysis. It contributes nothing to backup and continuity, encryption, multi-factor authentication, awareness training, patching or supplier assessment, and it produces no evidence at all for endpoints outside its Windows sensor scope. Treat it as one measure inside a larger programme, not as a compliance component.

Does Bitdefender GravityZone EDR Cloud help with security questionnaires from large customers?

Yes, for a specific and fairly narrow group of questions. It answers the items on endpoint detection and response coverage, alert triage, attack chain reconstruction, incident retention, response actions such as host isolation, and whether security events can be forwarded to a SIEM. It does not answer the items on antivirus and malware blocking, firewall and device control, patch levels, disk encryption, mobile device management, backup and restore testing, or coverage of macOS and Linux machines, and answering those with this product in place means naming the other tools that carry them. If a questionnaire keeps failing on those points, moving up to GravityZone Business Security Enterprise is usually cheaper than pairing this product with a second vendor, because the prevention layer, the add-on options and the EDR data then sit in one console under one supplier relationship.

Data loss is expensive: how backups help you avoid outages
Covers the backup and recovery side that endpoint detection does not touch, and that questionnaires ask about separately.

What is the difference between GravityZone EDR Cloud and GravityZone Business Security Enterprise?

The decisive difference is that GravityZone Business Security Enterprise includes the blocking endpoint protection platform and GravityZone EDR Cloud does not; EDR Cloud is the detection and investigation layer you place next to protection you already own. The second difference is reach: the Enterprise edition extends EDR to macOS and Linux and accepts XDR sensors for identity, network, cloud and productivity applications, while EDR Cloud stays on Windows. Buyers who remember the older catalogue should note that the bundled protection and EDR product Bitdefender sold as GravityZone Ultra was renamed GravityZone Business Security Enterprise in April 2022, with no change to what it contained. Choose EDR Cloud when a third-party antivirus is staying in place for now, and the Enterprise edition when you are prepared to replace it.

Which limitations should you know before buying?

The EDR sensor runs on Windows endpoints only, so macOS and Linux machines stay outside the recorded telemetry and need either a different Bitdefender edition or a different tool. The prevention modules that come with this licence model, including Advanced Threat Control, Network Protection and Fileless Attack Protection, are preset to report only, which means the product tells you what happened but is not the component that stops it. Investigable incidents are retained for 90 days, while the searchable raw event history depends on a separate data retention entitlement sold in 90, 180 and 365 day steps, so decide on the look-back window before you promise an auditor a specific one. Patch management, full disk encryption, storage protection and the Report Builder are not available on this product, and that is where most follow-up purchases originate. The cloud console runs in several hosting regions and Bitdefender also offers an EU-hosted variant, so confirm which region your tenant is created in before signing a data processing agreement.

Best antivirus programs for Windows 2025
Helps you choose the prevention layer this product expects to find already installed on the endpoint.

Frequently asked questions about Bitdefender GravityZone EDR Cloud

Does it work with any antivirus already installed?

It is designed to work alongside competing endpoint security products, with one documented exception: products that use the Bitdefender SDK under the hood. Several vendors license Bitdefender engines for their own suites, so check what your current product actually runs on before you plan the rollout.

Which response actions can an administrator take from the console?

From an incident you can isolate the affected host, terminate a running process, and add a file hash to a blocklist that applies across the company. Beyond that, custom detection rules and YARA rules let you turn a finding from one investigation into an ongoing detection.

Can EDR events be forwarded to an existing SIEM?

Yes. The Security Telemetry feature streams EDR raw events out of the console, and Bitdefender documents integrations for Splunk, IBM QRadar and Microsoft Sentinel. This matters if your incident evidence has to be retained centrally rather than only inside the GravityZone console.