In reply to Jmccoy@manchesterct.gov.

Hi jmccoy,

Neither of Gartner's categories (EPP or EDR) explicitly call out zero-day detection as a required capability per se. But speaking for Cisco AMP for Endpoints, we do on-device static and dynamic behavioral analysis of files to detect zero-day threats and APTs. And AMP for Endpoints includes whitelisting.