EDR vs antivirus: what's the difference for SMEs?

Every business computer has some protection installed. The question is what it detects, and above all what happens when it does detect something. Antivirus, EDR and MDR do not mean the same thing.

Traditional antivirus

It compares files against a database of known threats. That is useful and necessary, but limited against new variants, attacks that write no files at all, and legitimate tools turned to malicious use (PowerShell, remote access software), which attackers rely on heavily today.

What EDR adds

• Behavioral analysis: a program that encrypts hundreds of files in a few seconds is suspicious, even if it is unknown.
• A history of events on the computer, to reconstruct what happened.
• Remote isolation of a compromised computer, which cuts it off from the network while keeping it reachable for investigation.
• Searching for the same traces across all your devices.

The weak point of EDR on its own

An EDR produces alerts. If nobody reads them, especially at night and on weekends, the times attackers choose, detection serves no purpose. Alerts also need sorting: some are false leads, and dealing with them takes time and experience.

MDR: EDR with a team behind it

MDR (Managed Detection and Response) adds a security operations center that receives alerts around the clock, assesses them and triggers urgent actions, such as isolating a computer. The IT provider then carries out the remediation, within or in addition to its contract, and explains the situation to you.

Questions to help you choose

• Which systems are covered: Windows, macOS, servers?
• Who receives the alerts, at what hours, and how quickly are they handled?
• Who can isolate a computer, and who carries out the remediation?
• What reports do you receive?
• Is the solution already included in your licenses? Microsoft 365 Business Premium, for example, includes Defender for Business.

What EDR does not replace

EDR protects computers. It does not replace updates, multi-factor authentication, backups or staff vigilance against phishing. It is one layer, not a complete solution.