Cyber Security
Antivirus, EDR, XDR and MDR: the differences and what an SME needs
Antivirus, EDR, XDR and MDR sound similar but do different jobs. We explain the differences in plain terms and show which combination makes sense for small and mid-sized businesses.
Q-entra editorial teamPublished on 6 min read
Contents
- The short answer: four terms, four jobs
- Antivirus: signature-based protection against known malware
- EDR: behaviour-based detection and response
- XDR: connecting signals across several sources
- MDR: specialists review the alerts
- Why alerts need someone to look at them
- Which solution fits an SME?
- Conclusion: technology and responsibility belong together
Key takeaways
- Classic antivirus mainly recognises known malware by its signatures.
- EDR watches behaviour on every device and can isolate devices or stop processes.
- XDR links signals from endpoints, email, identities and the network into one picture.
- MDR is a service: specialists review the alerts and respond according to agreed rules.
- For most SMEs, EDR on every device is the baseline. What matters most is who handles the alerts.
The short answer: four terms, four jobs
Classic antivirus recognises known malware by its signatures. EDR (endpoint detection and response) also watches what happens on each device and can step in when something looks suspicious. XDR (extended detection and response) links that data with email, user accounts, cloud services and the network. MDR (managed detection and response) is not a product but a service: specialists review the alerts and act on them.
For most SMEs, EDR on every device is the sensible baseline today. What matters more than the acronym, however, is who reads the alerts and what happens next. Vendors do not always use these terms consistently, so it pays to look at the actual features rather than the label.
Antivirus: signature-based protection against known malware
Classic antivirus compares files with a database of known malware. Each signature is a kind of fingerprint, such as a file hash or a characteristic code pattern. If a file matches, it is blocked or moved to quarantine. This works quickly and reliably as long as the malware is already known.
Modern products, often called endpoint protection platforms (EPP), add heuristics, cloud-based reputation checks and basic behaviour monitoring. The limitation remains, though: many attacks today do without a classic malicious file. Attackers sign in with stolen credentials, use built-in tools such as PowerShell or install legitimate remote support software. To a classic antivirus engine, this often looks unremarkable.
EDR: behaviour-based detection and response
EDR continuously records what happens on a device: which processes start, which programs they launch, which network connections are opened and which files change. The software analyses this data locally and in the cloud, looking for patterns that point to an attack. Typical examples include:
- A Word document spawns a command prompt or PowerShell, which then downloads code from the internet.
- A very large number of files are renamed or encrypted within a short time.
- Shadow copies and local backups are deleted.
- A program reads login credentials from memory.
- A remote support tool that nobody else uses is installed on a server at night.
The second half of the name matters just as much: response. An EDR tool can isolate a device from the network so that it only talks to the management console, stop a process or block a file. It also provides a timeline of events that helps you reconstruct how an attacker got in and what they did. That helps with the investigation and with working out which other systems are affected.
XDR: connecting signals across several sources
XDR widens the view beyond the individual device. It brings together signals from endpoints, email, identities, cloud applications and sometimes the firewall and network. This lets it spot connections that look harmless in each source on its own.
An example: an employee receives a phishing email, shortly afterwards her account signs in from an unusual country, a new forwarding rule appears in the mailbox and a suspicious process starts on her laptop. Instead of four separate alerts in four consoles, XDR shows one connected incident. That saves time and makes the assessment easier.
XDR is at its strongest when email, user accounts and endpoints come from one platform or integrate well. A SIEM, by contrast, collects logs from almost any source. It is more flexible but considerably more demanding to set up and run.
MDR: specialists review the alerts
MDR is a service built on EDR or XDR. The provider's analysts review alerts, investigate suspicious activity, put it into context and take agreed countermeasures, such as isolating a device. Many MDR providers work around the clock. For businesses without their own security team, MDR closes the gap between good technology and a lack of time.
Why alerts need someone to look at them
Every detection tool produces alerts of varying quality. Many are harmless, such as an admin script that happens to look suspicious. A few are serious and time-critical. Only someone who knows the environment can reliably tell whether a sign-in at night is the managing director on a business trip or an attacker.
Attackers also do not keep office hours. If an alert is only read on Monday, a single infected laptop may already have turned into an encrypted company network. So decide in advance:
- Who receives and assesses alerts: internal IT, your IT service provider or an MDR provider.
- At what times alerts are handled, and how quickly.
- Which responses happen automatically, for example isolating a device when ransomware is detected with high confidence.
- When management is informed and who decides on further steps.
Our article on the first 24 hours after a ransomware attack describes what to do in an emergency. If you are weighing up whether to handle the ongoing monitoring yourself or outsource it, our article on when to outsource managed security services will help you decide.
| Approach | Mainly detects | Response | Who reviews |
|---|---|---|---|
| Antivirus | Known malware via signatures | Block the file or move it to quarantine | Usually nobody, runs automatically |
| EDR | Suspicious behaviour on endpoints | Isolate device, stop process, timeline | Internal IT or service provider |
| XDR | Connections between devices, email, identities and network | Coordinated response across several systems | Internal IT or service provider |
| MDR | As EDR or XDR, plus human analysis | Agreed actions taken by the provider | The MDR provider's analysts |
Which solution fits an SME?
There is no one-size-fits-all solution, but there is a sensible order. For an office with 10 to 100 workstations, this approach is a good starting point:
- Use EDR on all laptops, PCs and servers, not just antivirus. Macs and servers without signed-in users belong in scope too.
- Check your existing licences: some Microsoft 365 business plans already include EDR features that only need to be activated and configured.
- Decide who reviews alerts and when. If there is no time internally, a service provider or MDR is the realistic answer.
- Do not forget the basics: multi-factor authentication, regular updates and a tested backup prevent many incidents before an EDR ever has to step in.
- Consider XDR once email, identities and endpoints run on one platform or the number of alerts grows noticeably.
Cyber insurers and larger customers also frequently ask about EDR in their questionnaires. If you document what you use and who responds, you will have the answers to hand.
Conclusion: technology and responsibility belong together
Antivirus is the minimum today, EDR the sensible baseline for businesses, XDR an extension when several connected sources are involved and MDR the answer to the question of who is watching. Q-entra sets up endpoint protection with EDR as part of cyber security and, if you wish, takes over ongoing operation and alert assessment during the contractually agreed hours with managed security.
