Three acronyms describe three generations of endpoint defense. They are often marketed as interchangeable. They are not.
Antivirus (AV)
Traditional antivirus detects known threats by matching files against a signature database. It is fast and cheap and still catches a large volume of commodity malware. It is also blind to anything without a signature — which is most modern attacks.
Endpoint Detection and Response (EDR)
EDR watches behavior on the endpoint — processes, network connections, script execution, credential access — and flags patterns that look like an attack, even when no known malware is involved. It also records what happened so a responder can investigate and roll back.
Managed Detection and Response (MDR)
MDR is a service on top of EDR: a team of analysts monitors the EDR platform 24/7, triages alerts, and takes containment actions on your behalf. It exists because EDR tools generate more signal than most organizations can staff to review.
How to choose
- AV alone is no longer sufficient for anything holding sensitive data.
- EDR is the current baseline for most SMBs — required by many cyber-insurance carriers.
- MDR is the right choice when you have EDR data no one is watching, or when regulatory expectations require 24/7 response.
Rule of thumb
If you cannot describe who reviews EDR alerts at 2 a.m. on a Sunday, you either need MDR or a very honest conversation about your risk appetite.