The short version
Antivirus blocks known and suspicious files. EDR (endpoint detection and response) records what happens on each device so threats can be detected, investigated and contained. XDR (extended detection and response) correlates endpoint data with email, identity, network and cloud signals. MDR (managed detection and response) is a service where the vendor's analysts watch and respond for you, often 24×7.
The jump from one level to the next is not only technology. Each step usually needs more skilled people, or a partner, to act on what the tools find.
The terms at a glance
| Term | What it is | The question it answers |
|---|---|---|
| Antivirus / NGAV | Prevents known and suspicious malware using signatures, reputation and behaviour rules | Is this file bad? |
| EDR | Continuously records process, network and login activity on each device; detects suspicious behaviour; lets you investigate and isolate a device | What happened on this PC, and how do we stop it spreading? |
| XDR | Correlates signals from endpoints plus email, identity, network and cloud in one console | Are these separate alerts one attack? |
| MDR | A service: analysts monitor your tools and respond, often around the clock | Who is watching at 2 a.m.? |
| SIEM | Collects and stores logs from many systems for search, alerting and compliance | What do the logs say, and can we prove it? |
Capability comparison
| Capability | Antivirus | EDR | XDR | MDR |
|---|---|---|---|---|
| Blocks known malware | Yes | Yes | Yes | Yes |
| Detects suspicious behaviour | Limited | Yes | Yes | Yes |
| Investigation timeline | No | Yes | Yes | Yes |
| Isolate a device remotely | No | Yes | Yes | Yes |
| Correlates across email, identity, network | No | No | Yes | Yes |
| Humans watching 24×7 | No | No | No | Yes (service) |
| Skill needed to operate | Low | Medium to high | High | Low (outsourced) |
How much do you actually need?
| Organisation | Sensible baseline | Add when |
|---|---|---|
| 1–10 PCs | Reputable endpoint protection with EDR features, MFA, patching, tested backups | Customer data or contract requirements grow |
| 10–100 users | Central EDR console, device encryption, patch management, immutable backups, email filtering | You have remote staff, sensitive data or no one watching alerts |
| 100+ users or regulated data | EDR plus MDR or an in-house SOC, identity protection, log retention, incident response plan | Multiple sites, compliance audits, cyber insurance requirements |
An XDR you cannot staff is shelfware. A well-run EDR with MFA, patching and immutable backups beats a sophisticated stack nobody monitors.
Seven controls that matter more than the brand
- Multi-factor authentication on email, VPN and all admin accounts
- Patching of operating systems, browsers, firmware, firewalls and switches
- Least privilege: remove local admin rights from daily-use accounts
- Immutable or offline backups with a tested restore
- Email filtering and a simple way for staff to report suspicious mail
- Disk encryption on laptops (for example BitLocker)
- Awareness: short, regular, practical training
Rolling out EDR without breaking work
- Inventory every device first. You cannot protect what you cannot see
- Pilot on a small, mixed group (IT, finance, a power user)
- Run in detect or audit mode and review false positives
- Keep exclusions few, specific and documented
- Switch to prevent mode in waves
- Rehearse isolating a device and restoring it
- Review alerts weekly and coverage monthly
Common mistakes
- Installing EDR but sending alerts to an unmonitored mailbox
- Running two security products that conflict or hide each other's detections
- Broad exclusions for whole folders or processes, which attackers exploit
- Leaving servers, laptops off the domain or contractor devices uncovered
- Assuming cloud email is safe by default
- No documented answer to: who isolates a device and who do we call?
Questions to ask any vendor
- What does this licence tier include, and what is an extra?
- Who responds to alerts, when, and what actions can they take on my behalf?
- How long is telemetry retained and where is it stored?
- Which independent tests cover this product?
- What happens to protection if the device is offline?
- What is the exit process and data export?
India context
Organisations that fall under India's CERT-In Directions (April 2022) must report specified cyber incidents within six hours and retain relevant logs for 180 days. Whether and how these apply to you depends on your type of organisation. The Digital Personal Data Protection Act, 2023 requires reasonable security safeguards and breach notification once its rules are in force. Take legal advice on your own obligations; good endpoint telemetry makes both far easier to meet.
Key takeaways
- Antivirus prevents; EDR detects and responds; XDR connects; MDR adds people
- Match the level to who can actually operate it
- MFA, patching and immutable backups are non-negotiable at every size
- Decide in advance who isolates a device and who gets called
References and further reading
- CERT-In (Indian Computer Emergency Response Team)
- NIST Cybersecurity Framework
- CISA: cybersecurity best practices
General information for orientation; it is not legal or professional advice. Specifications, products and regulations change, so verify current details before acting. Product names belong to their owners and are mentioned only as examples.