Antivirus blocks known threats on each computer. EDR (endpoint detection and response) also records what happens on each computer, so suspicious behaviour can be spotted, investigated, and stopped. XDR (extended detection and response) applies the same idea across endpoints, email, firewalls, cloud, and identity. MDR (managed detection and response) is a service: a security team watches those tools around the clock and responds for you. Each level catches more, and each needs more people to use it well.
Antivirus and endpoint protection
Modern endpoint protection goes well beyond the virus scanners of the past. A current business product combines:
- Signature scanning for known malware
- Machine learning that judges files it has never seen
- Behaviour monitoring and anti-ransomware that roll back encrypted files
- Exploit prevention, web filtering, and device control for USB storage
- Central management, so every device's status is visible in one console
Best for: every business, as the minimum on every computer and server. It stops the large majority of everyday threats automatically.
The gap: attackers increasingly avoid malware altogether. They log in with stolen passwords and use tools already built into Windows. Endpoint protection alone may not notice, and it gives you little to investigate afterwards.
EDR: endpoint detection and response
EDR continuously records activity on each device, such as processes started, files changed, network connections, and logins, and analyses it for signs of an attack. When it finds something, it can:
- Alert with the full chain of events, from the first email or download to the current state
- Isolate a device from the network with one click while the rest of the business keeps working
- Kill processes, delete files, and roll back changes
- Let you search every device for an indicator, for example "has this file appeared anywhere?"
Best for: businesses with an IT team, or an IT provider, who can review alerts. EDR is also what many compliance frameworks now expect. SACS-210, for example, has a specific requirement (TPC-2.54) to detect and prevent unauthorized changes using technology such as EDR.
The catch: EDR generates alerts that someone must review. Unwatched EDR is little better than antivirus.
XDR: extended detection and response
XDR collects signals from more places than the endpoint: firewalls, email, Microsoft 365 or Google Workspace, cloud workloads, and identity. It links related events into a single incident. A phishing email, a suspicious sign-in, and an unusual process on a laptop become one story instead of three separate alerts in three consoles.
Best for: organisations with several security tools and an internal security function, or those that want one view across their whole environment.
MDR: managed detection and response
MDR is people, not just software. A provider's analysts monitor your EDR or XDR 24 hours a day, hunt for threats, and act when something is found, often within minutes, including at night and over the weekend when most ransomware attacks start.
Best for: businesses that need strong protection but cannot staff a security operations centre. For most small and mid-sized companies, MDR is the most realistic way to get round-the-clock coverage.
Side by side
| Antivirus / endpoint protection | EDR | XDR | MDR | |
|---|---|---|---|---|
| What it is | Software on each device | Software on each device | A platform across many tools | A 24/7 service by security analysts |
| Stops known malware | Yes | Yes | Yes | Yes |
| Spots attacks without malware | Limited | Yes | Yes, across more sources | Yes, with human analysis |
| Investigation and history | Minimal | Detailed, per device | Across the environment | Done for you |
| Who responds | Automatic only | Your IT team | Your security team | The provider's analysts |
| Effort for your team | Low | Medium | High | Low |
How to choose
- Start with endpoint protection on every device, including servers and Macs, with central management. Make sure nothing is missing; unprotected machines are a common way in.
- Add EDR if you have an IT team or provider who will review alerts, or if a customer or framework such as SACS-210 requires it.
- Choose MDR if you cannot watch alerts around the clock. Many vendors bundle MDR with their endpoint product.
- Consider XDR when you already run several security products and want them correlated.
Whatever you choose, the basics decide most outcomes: multi-factor authentication, prompt patching, tested backups, and email protection. See our guide to SPF, DKIM, and DMARC for one of the cheapest and most effective steps against phishing.
Products we work with
- Sophos: Intercept X endpoint protection, Sophos XDR, and Sophos MDR, all managed from Sophos Central. See our Sophos partner page.
- Kaspersky: the Kaspersky Next range, from EDR Foundations and EDR Optimum to XDR Expert, plus Kaspersky MDR. See our Kaspersky partner page.
Frequently asked questions
Is Microsoft Defender enough for a business?
The Defender antivirus built into Windows is a reasonable baseline on a single computer. Businesses need central management, reporting, server and Mac coverage, and usually EDR. Those come with business products such as Microsoft Defender for Business, Sophos Intercept X, or Kaspersky Next.
Does EDR replace antivirus?
No. Business EDR products include endpoint protection and add detection and response on top. You install one agent, not two.
Will EDR slow our computers down?
Current EDR agents are designed to run lightly on modern hardware. Performance problems usually come from running two security products on the same computer, which you should never do.
What do we need for SACS-210?
Every Aramco and SABIC supplier must keep signature-based antivirus and anti-malware up to date on its assets (TPC1.29) and enable firewalls on endpoints (TPC1.27). Depending on your classification, specific requirements such as TPC-2.54 call for EDR. Our SACS-210 consultation service confirms which controls apply to you.
Can Arab Spec manage this for us?
Yes. We supply and deploy endpoint protection, EDR, and MDR from Sophos and Kaspersky, review alerts as part of our cybersecurity services, and keep every device protected under one contract.