Antivirus, EDR and MDR: what are you actually buying?
Antivirus focuses on preventing and detecting malicious software. Endpoint detection and response (EDR) adds endpoint activity visibility and investigation/response capabilities. Managed detection and response (MDR) is an operating service. The deciding question is who investigates a detection and is authorized to act.
Compare the responsibility, not just the acronym
These are working buying definitions, not mutually exclusive product boxes. A package can combine prevention, EDR features and a managed service. Microsoft’s Defender for Business documentation, for example, lists next-generation protection and EDR within the same product; Sophos describes its MDR service in terms of monitoring, investigation and response.
On a small screen, scroll the table sideways to see every column.
| Layer | What to establish in a demo | What your quote must clarify |
|---|---|---|
| Antivirus / prevention | How protection is configured and monitored | Who fixes a disabled or unhealthy installation |
| EDR | How an analyst investigates an endpoint event | Who watches alerts and takes action |
| MDR | How the service handles a reported incident | Covered assets, operating hours and authorized actions |
Source: Microsoft Learn: Defender for Business overview · Sophos: Managed Detection and Response
Does EDR include someone to watch it?
Do not infer staffing from an EDR feature list. Ask who receives a high-priority alert, how they distinguish a false alarm, and what happens when your usual administrator is unavailable. A product’s automated action and a contracted human response service are different things to verify.
Likewise, “managed” needs a boundary. Is the provider responsible only for an endpoint agent, or also identity and email signals? Which containment actions require customer approval? Record the answers against your exact package.
Example: an alert at 2 a.m.
In this fictional scenario, a laptop raises a suspicious-activity alert while the owner is asleep. Run the same tabletop question with each supplier: who sees it, who investigates, who can disconnect the laptop from the network, and who contacts the business?
A good answer names a role, an escalation path and an action boundary. “Our platform is intelligent” does not complete that worksheet. Use a harmless tabletop discussion; you do not need to introduce malware to compare service responsibilities.
Which option fits your team?
If you have people who can operate an endpoint platform, evaluate EDR against their workflow. If you cannot cover investigation and response yourself, compare managed services against that missing work. A business may need both the endpoint technology and an operator; the contract should explain how they fit together.
- Ask for an example escalation, with identifying data removed.
- Separate notification targets from response-time commitments.
- Confirm who approves containment of a business-critical device.
- Ask who helps restore service after containment.