How does Field Effect manage resource efficiency of the agent with both EDR and NGAV running?

Adding NGAV doesn’t change how EDR runs. EDR continues to operate as effectively as it did before the AV scanning component is heavily throttled when running a scheduled scan and as new files are written. If a large number of files are written at once, the scan catches up instead of holding things up or blocking, so performance should be fine. Full scans are heavily throttled, “low and slow,” so they take much longer but don’t noticeably impact the system. Scanning is not run at startup, when many other processes are already starting. Instead, there is an overnight scan, after which results are cached, so files don’t need to be rescanned unless something changes or the signatures are updated.