# Antivirus vs EDR vs MDR: Which Endpoint Protection Do You Need?

Source : https://cybercaribou.com/en/comparisons/antivirus-vs-edr-vs-mdr · Cyber Caribou

> Antivirus, EDR or MDR? Detection, response, 24/7 monitoring, in-house skills and cost model compared for small businesses with 10, 50 or 150 employees.

"We have antivirus, so we're fine." That's often the first thing a small business owner says when endpoint protection comes up. The trouble is that today's attacks rarely involve a file antivirus recognizes. The intruder signs in with a stolen password, uses the admin tools already on the network and takes their time.

Antivirus, EDR and MDR aren't three competing brands. They're three layers of protection that stack on top of each other. This comparison helps you pick the right layer for your size and resources. To compare EDR products themselves, see our [EDR comparison for small businesses](https://cybercaribou.com/en/comparisons/edr-for-small-business).

- We compare approaches, not products. Every value in the table is based on publications from the Canadian Centre for Cyber Security, CISA and the UK NCSC, reviewed in October 2026.
- Criteria: detection approach, response capability, 24/7 monitoring, skills required, evidence for investigation, cost model and what the authorities recommend.
- No prices are quoted: cost models are described qualitatively.
- This comparison is not sponsored.

## Antivirus: the floor, not the ceiling

Antivirus is still a must. The Canadian Centre for Cyber Security's baseline controls ask every small and medium organization to run anti-malware that updates and scans automatically. The good news: the antivirus built into Windows and macOS, switched on and up to date, can fill that role. The UK NCSC even says it will meet the needs of many organizations.

Its limit is its method. Traditional antivirus compares files against signatures of known malicious code, and the NCSC notes that advances in malware have limited how well that works. CISA, for its part, observes that many organizations lack the capabilities to detect attackers who "live off the land," using legitimate tools already on the system. Antivirus sees very little of that.

## EDR: you can see the attack, if someone is looking

EDR continuously watches what happens on workstations and servers: processes launched, connections, file changes. The Canadian Centre for Cyber Security recommends considering EDR, or XDR, to detect and respond to abnormal system activity, and lists EDR logs among the security logs that matter when an incident occurs. Depending on the product, EDR can also roll a device back to its pre-infection state. In its ransomware guide, CISA recommends application allowlisting and/or EDR on all assets.

The catch: the Canadian Centre classes EDR among advanced controls that require additional resources. A poorly configured EDR, or one whose alerts nobody reads, reassures without protecting. Read our [anatomy of a ransomware attack](https://cybercaribou.com/en/blog/ransomware-small-business-attack-anatomy): all it takes is an alert that fires at 11 p.m. on a Friday and gets read Monday morning.

## MDR: eyes open day and night

MDR answers one question: who's watching? An outside team monitors your detection tools around the clock, validates alerts and either acts or notifies you, depending on the contract. The Canadian Centre for Cyber Security lists this continuous monitoring among the benefits of managed security service providers, along with lower costs than hiring in-house specialists.

It also names the downsides. The cost can be prohibitive for some organizations. You hand monitoring to a third party, but you still own the risk and remain accountable for incident response. The UK NCSC adds that an outside team knows your systems less well and may respond more slowly than an internal one. That's why the contract matters: guaranteed response times, how you're notified, what the provider may do without your approval, and where your logs are stored.

## How to choose

Start with a simple question: if an attack starts at 2 a.m. on a Saturday, who notices, and when?

1. **Under 15 employees, part-time IT provider**: EDR, often already paid for in your Microsoft 365 plan, with alerts routed to the IT provider and a written response time.
2. **25 to 100 employees, nobody dedicated to security**: MDR. Triaging alerts quickly takes more time than a generalist IT provider can give.
3. **Over 100 employees with an IT team**: MDR that backs up the team in the evenings, on weekends and during holidays.
4. **Everywhere**: keep the built-in antivirus on every device, including those EDR doesn't cover.

Before signing with an MDR provider, ask at least these questions: do you act, or only alert? Within how many minutes? Who do you call on our side at night? Where are our logs stored? The answers will also help you with your [cyber insurance questionnaire](https://cybercaribou.com/en/blog/cyber-insurance-questionnaire-requirements).

Not sure your EDR really covers every workstation and server, or who receives its alerts? Our [cybersecurity audit](https://cybercaribou.com/en/services/cybersecurity-audit) checks it device by device and gives you a prioritized plan.

## FAQ

**What's the difference between antivirus and EDR?**
Antivirus mainly looks for known malicious code and quarantines it. EDR continuously monitors device behaviour to spot abnormal activity, even with no known malicious file, and lets you respond remotely. Don't run two antivirus products on the same device: the UK NCSC warns they can conflict. Check with the vendor how its EDR coexists with the built-in antivirus.

**Is Microsoft Defender enough for a small business?**
The Microsoft Defender Antivirus built into Windows covers the baseline control. For EDR, you need Microsoft Defender for Business, included in Microsoft 365 Business Premium or sold separately. Either way, the key question is the same: who reads the alerts, and how fast?

**Does an MDR service replace our IT provider?**
No. MDR monitors threats and responds; your IT provider still manages devices, patching and backups. The Canadian Centre for Cyber Security reminds organizations that they remain accountable for incident response, so the contract should spell out response times, how you're notified and what the provider may do without your approval.

**Is XDR better than EDR?**
XDR extends detection beyond devices to email, cloud accounts and the network. The Canadian Centre for Cyber Security mentions it alongside EDR, but there's no single official definition and the scope varies from vendor to vendor. Ask which data sources are actually covered rather than trusting the label.

## Sources

- [Canadian Centre for Cyber Security: Choosing the best cyber security solution for your organization (ITSM.10.023)](https://www.cyber.gc.ca/en/guidance/choosing-best-cyber-security-solution-your-organization-itsm10023)
- [Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations)
- [Canadian Centre for Cyber Security: Cyber security considerations for consumers of managed services (ITSM.50.030)](https://www.cyber.gc.ca/en/guidance/cyber-security-considerations-consumers-managed-services-itsm50030)
- [Canadian Centre for Cyber Security: Cyber incident reporting guidelines (ITSM.00.140)](https://www.cyber.gc.ca/en/guidance/cyber-incident-reporting-guidelines-key-information-sharing-requirements-itsm00140)
- [Canadian Centre for Cyber Security: End user device security for BYOD deployment models (ITSM.70.003)](https://www.cyber.gc.ca/en/guidance/end-user-device-security-bring-your-own-device-byod-deployment-models-itsm70003)
- [UK NCSC: Antivirus and other security software](https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software)
- [UK NCSC: To SOC or not to SOC?](https://www.ncsc.gov.uk/blog-post/soc-or-not)
- [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [CISA: Identifying and Mitigating Living Off the Land Techniques (February 2024)](https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques)
- [Microsoft: Microsoft Defender for Business](https://www.microsoft.com/en-ca/security/business/endpoint-security/microsoft-defender-business)