CDR stands for Cloud Detection and Response. It is a security discipline and product category focused on finding suspicious activity in cloud environments and then helping defenders investigate and contain it quickly. CDR tools usually collect telemetry from cloud control planes, workloads, identities, and sometimes runtime activity so they can correlate signals that would be weak on their own.
CDR matters because cloud attacks often move fast and rely on stolen tokens, privilege abuse, misconfigurations, or malicious workloads that appear and disappear quickly. In real defenses, CDR can alert on unusual logins, new permissions, risky API calls, or abnormal execution inside containers and virtual machines. It also supports response actions such as isolating workloads, revoking credentials, or triggering incident workflows. The main goal is not just detection, but fast, context-aware action in dynamic cloud infrastructure.