Unlike traditional antivirus, which relies on known signatures, EDR monitors endpoint behavior to detect anomalies and potential threats.