The insurance renewal form asks whether you have “EDR deployed on all endpoints”, and the honest answer in the office is that every computer has antivirus and nobody is quite sure whether that counts. It usually does not, and the reason is worth understanding, because the difference between the two is not a marketing distinction. It is a difference in what the software can see and what it can do about it.
How traditional antivirus works
Antivirus, in its classic form, is a lookup. The software holds a database of signatures, meaning patterns that identify known malicious files, and it checks files against that database when they are written, opened or scanned. If a file matches, it is quarantined. Modern products add heuristics that flag files which look suspicious, and most now consult a cloud service rather than relying only on local definitions.
The approach is genuinely useful against known, file-based threats, and it is cheap and quiet. Its weakness is structural: it can only stop what it recognizes, and it looks at files rather than at behaviour. An attacker who uses a freshly built piece of malware, or who uses no malware at all and simply runs the administrative tools already present on the machine, walks past a signature check without triggering it.
What endpoint detection and response adds
Endpoint detection and response, or EDR, starts from a different premise. Instead of asking “is this file known to be bad?”, it records what is happening on the device continuously: which processes start, what they launch, which files they touch, which network connections they open, which registry keys and credentials they reach for. That stream of activity is analysed for patterns of behaviour that indicate an attack, regardless of whether the tools involved are known malware or ordinary system utilities being misused.
Visibility
Because EDR keeps a record, an analyst can answer questions antivirus cannot: how did this get here, what did it do next, which other machines did it touch, and is it still present? That is the difference between “we cleaned a file” and “we know the extent of the incident”.
Response and rollback
EDR can act. A device can be isolated from the network with one action while remaining reachable by the security team, so an infection cannot spread while it is investigated. Malicious processes can be killed remotely, persistence removed, and on many platforms the changes made by ransomware can be rolled back to a pre-attack state. Antivirus, by contrast, generally stops at quarantine.
Who watches the alerts
The uncomfortable truth about EDR is that it produces alerts, and alerts need people. A tool that raises a high-severity detection at eleven at night on a Saturday has done its job only if someone sees it and acts before Monday. In a small or mid-sized organization there is rarely anyone in that role, which is why EDR is so often bought together with a monitoring service.
That service goes by names such as managed detection and response, or supervised detection and response. It means trained analysts watching the EDR console around the clock, triaging what the tool raises, discarding false positives, investigating real detections and taking containment action within an agreed time. Without it, EDR is a very good flight recorder that nobody reads until after the crash. Our supervised detection and response service is the human layer on top of the tooling for exactly this reason.
Why insurers and customers now ask for it
Cyber insurers have learned that the difference between a contained incident and a business-ending one is usually how early the intrusion was noticed and how quickly it was cut off. EDR with someone watching it is the control that most directly changes that outcome, so it has become a standard question on renewal forms, alongside multi-factor authentication and tested backups. Larger customers ask the same question in supplier questionnaires for the same reason. Being able to answer yes, accurately, is increasingly a condition of doing business rather than a technical nicety.
Laptops that never come back to the office
The old model of protection assumed devices lived behind the office firewall. Laptops now spend most of their lives on home networks, hotel wireless and mobile hotspots, and the security has to travel with the device. EDR agents connect to a cloud console over any internet connection, so a laptop in a coffee shop is watched exactly as closely as a desktop in the office, and can be isolated from wherever it is. That is a meaningful difference from a legacy antivirus deployment that phones home to a management server only when the device is back on the office network.
Common questions
Do I still need antivirus if I have EDR?
Most modern EDR platforms include a prevention layer that performs the traditional antivirus role of blocking known malicious files, so you generally do not run two products side by side. What matters is that the endpoint has both capabilities: known-threat prevention and behavioural detection with response. Running two separate agents from different vendors on one machine usually causes conflicts and is rarely recommended.
Is EDR only for large companies?
No. Small and mid-sized organizations are targeted precisely because attackers expect weaker monitoring, and EDR is delivered as a cloud service that scales down to a handful of devices. The realistic constraint is not the software but the people to watch it, which is why smaller organizations usually take EDR as part of a managed detection and response service rather than running the console themselves.
What is the difference between EDR and MDR?
EDR is the technology: the agent on each device and the console that records and analyses activity and allows response actions. MDR, managed detection and response, is the service in which trained analysts operate that technology on your behalf, watching alerts around the clock, investigating and containing threats. EDR without MDR is a tool; MDR without EDR has nothing to watch.
Will EDR slow down our computers?
Modern agents are designed to run continuously with a light footprint, and on well-specified machines most users do not notice them. Very old hardware or machines already short of memory can feel the difference, which is a reason to include EDR in the standard build and to retire equipment that cannot carry current security tooling. Performance concerns are worth testing on a pilot group first.
If you have been asked whether EDR is deployed and are not certain of the answer, our endpoint detection and response and supervised detection and response pages describe what we deploy and who watches it, and you can contact us to have your current endpoint protection reviewed against what insurers and customers now expect.
