Endpoint security is full of three-letter acronyms that sound like competing products. They are better understood as layers. Antivirus tries to stop known threats. EDR records what happens on devices so that attacks can be detected and investigated. XDR extends that visibility beyond devices. MDR adds the people who actually do the watching and responding. This guide explains each one and how to decide what you need.
Antivirus and endpoint protection (EPP)
Traditional antivirus compares files against known malware signatures. Modern endpoint protection platforms add machine-learning detection, exploit prevention, anti-ransomware features and web and device controls. Their job is prevention: stop as much as possible before it runs.
Prevention is essential, but no product stops everything. Attackers increasingly use legitimate tools already on your systems, such as PowerShell and remote administration software, which look harmless to a file scanner.
EDR: endpoint detection and response
EDR continuously records activity on laptops and servers: processes started, files changed, network connections and user logons. It analyses that activity for suspicious behaviour, such as an office document launching a script that downloads a tool and tries to read stored passwords. It also gives investigators the tools to look back in time and to respond, for example by isolating a device from the network or stopping a process.
The catch is that EDR produces alerts and data, and somebody has to act on them, quickly and at any hour. Ransomware attacks often unfold at night or over a weekend. An EDR alert that nobody reads until Monday morning offers little protection.
XDR: extended detection and response
XDR applies the same idea across more sources: endpoints and servers, but also firewalls, email, cloud workloads and identity systems. Correlating these sources helps connect events that look harmless alone, such as a phishing email, a suspicious logon and an unusual connection, into a single incident. XDR improves what investigators can see. Like EDR, it still needs skilled people to use it.
MDR: managed detection and response
MDR is not a product category but a service. A provider’s analysts use EDR or XDR technology to monitor your environment around the clock, hunt for threats, investigate alerts and respond. Depending on the service and what you authorise, they either tell you what to do, or take containment actions themselves, such as isolating an infected laptop at 3 a.m. before the attack spreads.
For most organisations without their own 24/7 security operations team, MDR is the practical way to get the full value from EDR and XDR.
Side by side
| What it is | What it needs from you | |
|---|---|---|
| Antivirus / EPP | Software that prevents known and likely malware | Deployment, updates and policy management |
| EDR | Software that records device activity and detects suspicious behaviour | Skilled people to triage alerts, investigate and respond |
| XDR | EDR extended to firewall, email, cloud and identity data | As EDR, plus integration of the extra data sources |
| MDR | A service: analysts monitor and respond using EDR or XDR | Contacts, an agreed response mode and follow-up on recommendations |
Which do you need?
- Every organisation needs modern endpoint protection on every laptop and server. This is the baseline.
- If you have a security team that can respond to alerts at all hours, EDR or XDR gives them the visibility and tools to do it well.
- If you do not have that team, which is true of most small and mid-sized organisations, MDR is usually the right choice. Buying EDR without anyone to watch it leaves a gap exactly when attacks happen.
- If a customer, insurer or auditor is asking about “EDR and 24/7 monitoring”, MDR answers both parts of the question.
Questions to ask an MDR provider
- Who actually does the monitoring, and are they available 24 hours a day, every day?
- What response actions will they take on their own, and what needs your approval?
- What response commitments are written into the service description?
- Does the service include full incident response if a serious breach happens, or is that extra?
- Where is your data stored and processed, and who can access it?
- What reporting will you receive, and how often?
- What are the service roles, response authority and escalation paths?
MDR delivery models vary. Confirm who monitors, how response actions are handled and how responsibilities are documented before choosing a service.
How Cenvox delivers MDR
Cenvox can provide managed detection and response with 24/7 monitoring, investigation and response. We scope coverage, response options and responsibilities around your requirements and document them before the service begins. Our managed detection and response page explains the service.