Industrial Cybersecurity & OT Risk calculator

EDR Agent Coverage Calculator

EDR agent coverage is the share of your eligible operational-technology (OT) endpoints — HMIs, engineering workstations, historians, Windows-based PLCs and SCADA servers — that are actually running an approved endpoint detection and response agent. OT security leads, plant IT managers and IEC 62443 auditors track it because it is the single clearest measure of how much of your industrial estate is being monitored for malware, lateral movement and ransomware staging. A high headline percentage can still hide a dangerous gap if your most critical Level 2 control endpoints are the ones missing an agent, so coverage is read alongside criticality. It is one of the first metrics a cyber-insurer or OT pen-test report will ask for.

What this calculator does

  • Calculate endpoint detection and response coverage across eligible OT and manufacturing support endpoints.
  • Use it when tracking monitoring coverage for HMIs, engineering workstations, servers, and supported industrial PCs.
  • It computes the percentage of in-scope OT endpoints carrying an approved EDR agent and the number of percentage points you sit above or below your coverage target.

Formula used

  • EDR agent coverage = eligible OT endpoints with approved EDR ÷ total eligible OT endpoints × 100
  • EDR agent coverage gap to target = EDR agent coverage - target EDR coverage

Inputs explained

  • Eligible OT endpoints with approved EDR agent installed:
  • Total eligible OT endpoints in scope:
  • Target EDR coverage threshold:

How to use the result

  • Use it for monthly OT security posture reporting, before a cyber-insurance renewal, and when scoping an EDR rollout campaign across plants.
  • A flat percentage treats every endpoint as equal — it does not weight by asset criticality, so 80% coverage that excludes safety-critical or domain-controller endpoints is far worse than the number suggests.

Common questions

  • How do you calculate EDR agent coverage? Divide the eligible OT endpoints with an approved EDR agent by the total eligible OT endpoints, then multiply by 100. With 210 protected out of 260 eligible, coverage is 210 / 260 x 100 = 80.77%.
  • What is a good EDR coverage percentage for OT? Most mature OT programs target 95-100% of eligible (agent-capable) endpoints. In the example, 80.77% against a 90% target leaves a 9.23-point gap, which is acceptable for an early rollout but should be closed before an insurance or 62443 audit.
  • Why is my OT EDR coverage below my IT coverage? Many OT endpoints are agent-ineligible (embedded controllers, thin clients, vendor-locked HMIs) or run legacy Windows that the EDR vendor no longer supports. That is why this metric counts only eligible endpoints rather than every device on the network.
  • What counts as an eligible OT endpoint? An endpoint is eligible if it runs a supported operating system the EDR agent can be installed on and change-management allows it. Bare PLCs, RTUs and unsupported legacy boxes are typically excluded and tracked under a separate compensating-controls metric.
  • How do I close an EDR coverage gap? Rank the unprotected endpoints by criticality, schedule agent deployment inside approved OT change windows, and re-run this calculator after each wave. Closing the 50-endpoint shortfall in the example would move coverage from 80.77% to 100%.

Last reviewed 2026-05-12.