MDR, EDR and Antivirus Explained

These terms describe different parts of protection and response. The important buying question is who will do the work when a signal needs investigation or a device needs action.

PUBLISHED 22 OCTOBER 2026 / CYBERXPERT WEBSITE RESOURCE

Antivirus is a protection capability

Antivirus and broader endpoint protection aim to detect or prevent malicious activity on devices. Effective operation still depends on supported systems, sensible policies, healthy agents and attention to alerts. A product being licensed does not prove that every relevant device is protected.

EDR adds investigation and response capability

Endpoint Detection and Response provides information and tools for investigating endpoint activity and taking supported actions. The features available depend on the platform and licence. EDR is a capability that someone must configure, maintain and use; it is not automatically a staffed response service.

MDR describes a managed service

Managed Detection and Response adds people and operational processes around agreed security signals. A service should explain how alerts are triaged, what investigation is included and which actions can be taken. Some services draw on endpoints alone; others include identity, cloud or additional sources.

Conceptual flow from endpoint and email signals through investigation to authorised response.

Do not buy a label without the boundary

Ask for the covered systems, telemetry requirements and exclusions. Establish service hours, customer contacts and escalation methods. Clarify whether the provider can isolate a device automatically, needs permission first or only recommends action. Each model has different implications for your team.

Response authority matters

Containment can affect business operations. A service needs an agreed way to balance urgency with impact, including who can approve disruptive actions. If a key decision-maker is unavailable, the escalation process should still be understood. Test those arrangements during onboarding.

SOC-as-a-Service is another operating description

A Security Operations Centre is an organisational capability for security operations. The term alone does not establish staffing, location, data-source coverage or response depth. Ask what the service actually does and avoid assuming round-the-clock support from the acronym.

Keep the surrounding controls

MDR does not remove the need for patching, strong identity controls, backup testing or an incident plan. These activities reduce exposure and support recovery. A good operating model connects them without implying that one product or service can cover every responsibility.

A practical selection checklist

List the systems that need coverage. Check licences and compatibility. Agree investigation and response scope, hours and authority. Identify what your IT team retains. Ask for reports that show material findings and decisions. Finally, define how coverage and responsibilities will be reviewed as the business changes.