Antivirus vs EDR vs MDR: Which One Does Your Business Need?

The short version: Antivirus (or anti-malware) tries to stop bad files and behaviour before they run. EDR (endpoint detection and response) records what happens on each device so someone can detect, investigate and contain an attack. MDR (managed detection and response) is EDR plus a team that watches the alerts and acts on them. The deciding question is not "which is strongest" but "who will read an alert at 2 a.m. and what are they allowed to do?"

This guide is for business owners and IT managers choosing endpoint protection. After reading it you can compare the three on the same points, apply five selection rules based on your risk and staffing, and check what your current setup really does.

The three options, point by point

Each option below uses the same points in the same order.

Antivirus and anti-malware

• What it does: scans files and watches behaviour on the device to block known and suspected malware. Modern products add cloud lookups and behaviour monitoring, not just signature lists.
• What it records: mostly detections and blocks. It is not designed to give you a full history of what happened on the device.
• Who watches the alerts: nobody has to. It acts automatically, and you review reports.
• Response: automatic quarantine or removal of what it detects.
• Skills needed in-house: low. Keep it on, updated and not disabled.
• Gap: an attacker who uses legitimate tools or stolen credentials may not trigger a detection, and you will have little evidence afterwards.

On Windows, Microsoft Defender Antivirus is built in. Microsoft's documentation says it uses machine learning and cloud-delivered protection and can stop threats based on behaviour even after they have started to run (checked against Microsoft Learn, 28 October 2026).

EDR (endpoint detection and response)

• What it does: everything above can sit underneath it, and EDR adds continuous collection of device activity, alerts that group related events into an incident, and response actions.
• What it records: process, network, sign-in, registry and file activity. For Microsoft Defender for Endpoint, Microsoft states the telemetry is kept for six months so an analyst can look back to the start of an attack (checked against Microsoft Learn, 28 October 2026). Microsoft also notes that detection is not meant to log every operation on an endpoint.
• Who watches the alerts: you must. Someone has to read incidents and decide.
• Response: manual or automated actions such as isolating a device from the network, running a scan and blocking a file.
• Skills needed in-house: moderate to high. Triage takes judgement.
• Gap: an alert nobody reads at night is a record of the attack, not protection from it.

MDR (managed detection and response)

• What it does: a provider's analysts monitor the EDR (and often other) alerts around the clock, investigate, and respond or tell you exactly what to do.
• What it records: the same telemetry as the underlying tool, plus the provider's investigation notes and reports.
• Who watches the alerts: the provider's team. Your team receives escalations.
• Response: depends on the contract. Some providers take containment actions themselves; others only recommend. Get this in writing.
• Skills needed in-house: low to moderate. You still need someone who can approve actions and handle business decisions.
• Gap: MDR is not the same as incident response for a full breach. Microsoft's own documentation for Defender Experts MDR says it is not an incident response engagement (checked against Microsoft Learn, 28 October 2026). For how MDR differs from an MSP or MSSP contract, see MSSP vs MSP vs MDR.

XDR is the same idea extended beyond the endpoint, so that email, identity and cloud signals are correlated with device signals. It matters when you compare tools, but the antivirus, EDR and MDR split above still applies.

What Microsoft's own plans include

Facts below were checked against Microsoft Learn on 28 October 2026. Plan names and bundles change, so confirm on your own tenant before you buy.

• Microsoft Defender for Endpoint Plan 1 includes next-generation protection (antivirus and anti-malware), attack surface reduction, and a limited set of manual response actions (per Microsoft's EDR overview): run an antivirus scan, isolate a device, stop and quarantine a file, and add an indicator to block or allow a file. It is available as a standalone subscription or as part of Microsoft 365 E3.
• Microsoft Defender for Business is built for businesses of up to 300 users and is included in Microsoft 365 Business Premium. Microsoft's own comparison lists EDR (optimized), automated investigation and remediation, and automatic attack disruption for it, which Plan 1 does not have. Check your licence: if you hold Business Premium, you may already own EDR.
• Microsoft Defender for Endpoint Plan 2 is the plan formerly known simply as Defender for Endpoint, and it is the full EDR plan. Microsoft's EDR overview page lists only manual response actions for Plan 1 and Defender for Business, while the Defender for Business page lists EDR (optimized) for Business. Use the comparison page when you check what your licence includes.
• Microsoft Defender Experts MDR is a separate managed service. Microsoft says it is sold separately from other Defender products. Plan 1 covers your Microsoft Defender workloads; Plan 2 adds selected non-Microsoft telemetry through Microsoft Sentinel and requires a minimum of 1,500 licensed seats.

For prices, use Microsoft's official price pages. We do not quote them here. For how we price endpoint security services, see our security services pricing.

Five selection rules

1. Everyone gets antivirus plus attack surface reduction. It is the baseline. Make sure it is on, updated, centrally reported and cannot be switched off by users.
2. Buy EDR only if someone will read the alerts within a day, every day. If that is nobody, EDR alone gives you evidence, not protection. Choose MDR instead, or do not buy EDR yet.
3. Choose MDR when you hold sensitive data or cannot tolerate days of downtime and have no security staff on call. This describes many small firms, because attackers do not keep office hours. See our security operations centre service for what round-the-clock monitoring involves.
4. Choose EDR with your own team when you have security or senior IT staff who can cover rota hours and have time to tune alerts. Add MDR for nights and weekends if the rota is thin.
5. Match the tool to the device mix. Servers, Macs, and mobile devices need to be in scope too. Ask the vendor which platforms get detection and which get only antivirus.

Two more factors push the decision up a level: how many people work remotely, and whether a customer or insurer asks you to describe your detection and response. We cannot say what a particular insurer or customer will accept. Ask them for the wording of their requirement, then map it to the capabilities above.

Questions to ask before you buy

1. Which devices and operating systems are covered by detection, and which only by antivirus?
2. How long is telemetry kept?
3. Who is notified at night, and within what time?
4. Which response actions can the provider take without calling you (for example isolate a device)?
5. What does the tool do if it cannot reach the internet?
6. How do we turn it off for troubleshooting, and who is alerted when it is turned off?
7. What happens to our data and our alerts if we leave?

Common mistakes

• Buying EDR with no one to respond. The alerts pile up. Fix: decide the response owner and hours before the purchase.
• Running two security products in active mode on one device. They compete. Microsoft Defender Antivirus can run in passive mode next to another product only on devices onboarded to Defender for Endpoint. Fix: choose one primary antivirus per device.
• Assuming MDR includes full incident response. Fix: ask in writing what the provider does during containment, and what costs extra.
• Leaving servers and personal-use devices out. Attackers go where protection is thinnest. Fix: list every device type, then confirm coverage.
• Assuming an included licence means it is switched on. Fix: check the device status in the console, not the licence sheet.
• Disabling protection for a slow application and forgetting. Fix: use scoped exclusions, record them, and review them quarterly.

How to check it worked

1. On a Windows device, open PowerShell and run the command below. In Microsoft's documentation, Normal means Microsoft Defender Antivirus is the active antivirus, Passive mode means another product is primary, and EDR Block Mode means EDR in block mode is enabled.

Get-MpComputerStatus | Select-Object AMRunningMode

1. In the Microsoft Defender portal, confirm every device you expect is listed, onboarded and reporting recently.
2. On a test device, run the Isolate device action from the device page, confirm the machine loses network access, then release it. Time how long each step takes.
3. Ask the provider (or your own team) to show the last alert that was triaged, who handled it and how long it took.
4. Confirm that tamper protection is on, so that a user or malware cannot quietly turn protection off.

FAQ

What are the three main types of endpoint security?

There is no single official list. A practical way to split it is: prevention (antivirus, anti-malware, attack surface reduction), detection and response (EDR), and managed response (MDR, where a provider's team watches and acts). Most businesses need the first, and add the others based on risk and staffing.

Is Microsoft Defender an EDR?

Microsoft Defender Antivirus is antivirus. EDR capabilities belong to Microsoft Defender for Endpoint Plan 2 and to Defender for Business, according to Microsoft's comparison. Plan 1 has manual response actions only. Check which one your licence includes.

What is an example of EDR?

Microsoft Defender for Endpoint Plan 2 is one example. It collects device telemetry, groups alerts into incidents, and lets analysts investigate and take response actions such as isolating a device.

Does Symantec have an EDR?

Product names and editions change, so the answer depends on the exact Symantec edition and licence you hold. Use the buying questions above: ask the vendor in writing which response actions it offers, how long telemetry is kept and who watches the alerts.

What is the difference between antivirus and EDR?

Antivirus blocks threats it recognises, mostly automatically. EDR records device activity and gives people the means to investigate and respond, but needs someone to use it.

If you want the people and the process behind your endpoint protection rather than just the tool, see our managed endpoint security protection.