Practical cyber security guidance
Antivirus vs EDR vs MDR for small businesses
The difference is not simply 'basic, better, best'. Antivirus, EDR and MDR solve related but different problems. The key question is not only whether malicious activity can be detected, but who investigates it and what happens next.
Frequently asked questions
6 practical answers.
### What does antivirus do?
Antivirus and anti-malware technologies aim to detect and block malicious software. Modern endpoint products may include behavioural and cloud-based detection as well as traditional signatures.
### What is EDR?
Endpoint Detection and Response records and analyses endpoint activity so suspicious behaviour can be detected, investigated and contained. It provides more visibility than relying only on malware signatures.
### What is MDR?
Managed Detection and Response adds a human service around security telemetry. Analysts monitor, investigate and respond to suspicious activity according to the agreed service and escalation process.
### Does a small business need MDR?
It depends on the risk and who currently owns security alerts. If nobody is consistently investigating endpoint or identity alerts, a managed service can close an important operational gap.
### Can EDR replace backups?
No. Detection and containment reduce the chance or impact of compromise, while backup supports recovery when data is deleted, encrypted or otherwise lost.
### What should we ask an MDR provider?
Ask what data is monitored, hours of coverage, how incidents are triaged, what containment actions can be taken, how quickly you are contacted, what is excluded and what reporting you receive.
Related guidance