If you’ve shopped for endpoint security lately, you’ve been hit with a pile of letters: AV, EPP, EDR, MDR, XDR. Vendors use them loosely, and the differences matter, because they decide whether an attack on a Friday night is stopped in minutes or found on Monday morning.
Here’s the plain-English version: what each one does, where each one falls short, and how to decide what your business actually needs.
The short answer
- AV (antivirus) blocks files it already knows are bad.
- EDR (endpoint detection and response) watches how each machine behaves, catches attacks nobody has seen before, and can act on them.
- MDR (managed detection and response) is EDR plus a team of people who watch it and respond for you.
Most small businesses need EDR-grade detection and someone, or something, acting on it quickly. The question is how to get the second part without hiring a security team.
AV: the old baseline
Traditional antivirus compares each file against a list of known-bad fingerprints. If the file matches a known virus, it’s blocked. That still has value, and modern antivirus such as Microsoft Defender does more than fingerprints alone.
Its weakness is that it is built to catch what it already recognises. Attackers know this. Many now avoid malware entirely and use ordinary admin and remote-access tools that every antivirus trusts. Others change their files just enough that the fingerprint is new. Antivirus is a seatbelt, not a full safety system.
EDR: behaviour, not just fingerprints
EDR watches what a program does, not only what it is. It records what starts on each machine, what started it, what it changes and what it connects to. That lets it spot patterns that only make sense as an attack, even from malware nobody has seen before:
- Word opening a command prompt, which starts PowerShell, which downloads a file from a site registered last week.
- A program deleting Windows’ file-recovery snapshots and renaming hundreds of files a minute.
- A remote-access tool nobody approved being installed at 2 am.
- Security software being switched off on one laptop, just before something else runs.
Crucially, EDR can respond. It can stop the program, quarantine the file and cut the machine off the network so the attack can’t spread. For a closer look at how this works against ransomware, read how to protect a business from ransomware.
MDR: EDR plus people
MDR is EDR with a team watching it for you. EDR raises alerts; someone has to look at each one, decide whether it’s real and act, including at 3 am on a Saturday. MDR providers staff that watch.
It solves a real problem, but it has trade-offs:
- Cost and contracts are often built for bigger companies.
- Your team still gets the call. Many MDR services alert you and leave the clean-up to your IT team or MSP.
- It usually covers the endpoint only. Identity, email and AI use may sit with other tools and other people.
The real problem for small businesses
Here’s the bind most small and mid-market businesses are in:
- AV alone isn’t enough against attackers who don’t use known malware.
- EDR gives you the detection, but someone still has to work the alerts. Cisco’s 2025 Cybersecurity Readiness Index found 86% of organisations say the shortage of skilled security people is a challenge.
- MDR solves the watching problem, but at a price and contract built for bigger companies.
And the stakes are real. Coveware’s Q4 2025 data puts the median ransomware victim at 200 employees. Sophos’s State of Ransomware 2026 found that organisations with 100 to 250 employees stopped attacks before encryption or extortion only 34% of the time, compared with 46% at organisations of 3,001 to 5,000 employees. Smaller businesses have less time and fewer people to catch an attack early.
A worked example: Friday, 11:40 pm
Here’s an illustrative example at a 60-person firm.
Someone in operations opened a “shipping document” on Friday afternoon. At 11:40 pm a program it dropped starts encrypting files in a shared folder.
With antivirus only, the program is new, so it doesn’t match a known fingerprint. It encrypts the shared folder overnight. On Monday morning nobody can open a file.
With EDR but nobody watching, the EDR spots hundreds of files changing in seconds and raises a critical alert. It may stop the process on its own. But the alert about cutting the laptop off the network and checking other machines sits in a console until Monday.
With EDR and a response layer, the program is stopped and the file quarantined straight away. The case links the encryption to the email that delivered the file that afternoon, and checks every other machine for the same file. Cutting the laptop off the network waits for one tap from the on-call tech’s phone, and file recovery is switched back on. On Monday the team reads a summary, not a ransom note.
How to choose
Ask three questions:
- Do all your laptops and servers run EDR, not just antivirus? If not, start there.
- Who looks at an EDR alert at 11 pm on a Friday? If the honest answer is “nobody”, you need a response layer, whether that is people, AI agents or both.
- Does your protection see beyond the laptop? Most attacks today start with a stolen login or a phishing email. EDR can’t see a sign-in from another country. Read ITDR vs EDR for why identity needs its own watch.
Checklist: is your endpoint protection doing its job?
- Every laptop and server runs EDR and reports in, Windows and Mac.
- A machine that stops reporting is noticed, not mistaken for a clean one.
- Security being switched off on a machine raises an alarm.
- Ransomware behaviour is stopped on its own, without waiting for a person.
- Someone can cut a laptop off the network quickly, at any hour.
- Remote-access tools are known, and a new one appearing is flagged.
- Endpoint alerts are linked to the email and sign-in that started them.
- Every action taken is recorded and can be undone where possible.
How Centeye closes the gap
Centeye Ironwatch is a lightweight EDR agent for Windows and Mac. It follows every program back to what started it, checks new files against live threat intelligence, picks up what Microsoft Defender has already found, and notices if Defender is switched off. It stops a ransomware process the moment it is spotted and quarantines the file. Cutting a laptop off the network and rolling files back from a snapshot run with your approval.
The response part is handled by Praxis. Kavach, the security operations agent, works every case day and night: it joins endpoint events with identity and email signals into one case, runs the playbook for that kind of attack, and takes each step at the setting you chose: tell me, ask me first, or handle it. Disruptive steps like rolling files back always wait for a person. Cases arrive as tickets in the PSA you already use.
That’s EDR-grade detection with the investigation already done, sized for the companies ransomware crews are actually going after.
Frequently asked questions
Is EDR better than antivirus?
EDR does more. It includes what antivirus does and adds behaviour monitoring and response. Many EDR tools, including Ironwatch, work beside the antivirus you already have rather than replacing it.
Do I need MDR if I have EDR?
You need someone or something acting on what EDR finds, quickly. That can be an MDR service, your MSP, an AI response layer, or a mix.
What is XDR?
Extended detection and response. It joins signals from more than the endpoint, such as identity and email, into one view. It’s the right idea, because attacks rarely stay on one machine.
Does EDR work on Mac?
Many EDR tools cover Mac as well as Windows. Ironwatch covers both.
Can I keep Microsoft Defender?
Yes. Read is Microsoft Defender enough for small business? for where Defender is strong and where the gaps are.
Confused by the letters? Start with what EDR is, or see our glossary for EDR, MDR and more. For how an AI security team takes on the response work, read why MSPs need an AI security team. Want to see behavioural detection live? Start a free trial.
Figures cited from the Cisco 2025 Cybersecurity Readiness Index, the Coveware Q4 2025 quarterly ransomware report and the Sophos State of Ransomware 2026 report. The worked example is illustrative. EDR capabilities described reflect the shipped Centeye product.