Hi Needa,
RSA ECAT doesn't rely on signatures to detect threats (malware, rootkits, RATs, etc.). Instead, ECAT looks more for suspicious activity. For example, if an unknown executable file loads in memory, starts hooking into different processes, creating new processes, etc. ECAT can alert you of this type of suspicious activity, give you a deep view of what's happening on the endpoint, and flag the suspicious activity for faster investigations.
RSA ECAT maintains a repository of all files found across your environment, and you can easily see how many other machines a file has been found on (which is especially helpful when you have a malicious file). With ECAT's Behavior Tracking system, the endpoint data is updated within seconds, not just after a scan.
RSA ECAT scales beyond 50k- each ECAT server supports up to 50k endpoints, and then we have a multi-server architecture where you can deploy as many servers as needed. You have a lot of flexibility with scanning in ECAT, so you can set up scan schedules for different groups and the system can also automatically stagger scans.
Hope this helps! Thanks for the feedback.
