If you’ve shopped for endpoint security lately, you’ve been hit with an alphabet soup: AV, EPP, EDR, MDR, XDR. Vendors use them loosely, and the differences actually matter — especially for your cyber-insurance renewal, where the questionnaire now asks specifically about EDR coverage. Here’s the plain-English version.

AV (antivirus): the old baseline

Traditional antivirus matches files against a database of known-bad signatures. If a file matches a known virus, it’s blocked. This still has value, but it has a fatal weakness in 2025: it only catches what it already recognizes. Huntress found that 60% of ransomware incidents involved unknown or “defunct” strains — exactly the kind of novel threat a signature database misses.

EDR (Endpoint Detection & Response): behavior, not signatures

EDR watches what a process does, not just what it is. It records endpoint behavior — process trees, file access, registry changes, network connections — and detects malicious patterns even from never-before-seen malware. Crucially, it can respond: isolate a machine, kill a process, quarantine a file.

This is the layer cyber-insurance carriers now require. The typical questionnaire asks: “What percentage of endpoints have an EDR (not AV) agent installed and reporting?” — and they want Mac and Linux covered, not just Windows.

MDR (Managed Detection & Response): EDR plus a human team

MDR is EDR plus an operations team watching it for you, 24/7. The pitch is simple: EDR generates alerts; someone has to triage and act on them at 3 a.m. MDR providers staff that watch. The catch is cost and headcount — you’re effectively renting a SOC.

The real SMB problem

Here’s the bind most small businesses are in:

  • AV alone is no longer enough — signature detection misses 60% of modern ransomware strains.
  • EDR gives you the detection, but someone still has to watch the console. Cisco found 86% of organizations cite the skills shortage as a major challenge, and at sub-500-employee firms, “no dedicated security headcount” is the most common answer.
  • MDR solves the watching problem but at a price and contract structure built for bigger companies.

You need EDR-grade detection and the around-the-clock response of MDR — without hiring a 24/7 team.

How Centeye closes the gap

Centeye’s Endpoint/EDR surface gives you behavioral detection on macOS, Windows, and Linux: a native agent plus multi-source ingestion, 51 Sigma rules across 35 MITRE techniques, and the ransomware trifecta — canary files, mass-encryption detection, and shadow-copy tamper monitoring — with isolate / kill / quarantine response.

The “managed” part is handled by Kavach, the AI SOC analyst, which watches every endpoint 24/7, correlates endpoint events with identity, email, and DNS signals, and contains threats in seconds — with your team setting how much autonomy it has. That’s EDR detection with MDR-style coverage, sized and priced for the companies ransomware crews are actually hunting.

Confused by the acronyms? Our glossary defines EDR, MDR, and more. Want to see behavioral detection live? Get a demo.

Figures cited from the Huntress 2025 Cyber Threat Report and the Cisco 2025 Cybersecurity Readiness Index. EDR capabilities described reflect the shipped Centeye product.