EDR vs antivirus: what is the difference?
“We’ve got antivirus” used to be a reasonable answer to “How do you protect your laptops?” It is not enough on its own any more. Here is why, in plain English.
What antivirus does
Traditional antivirus checks files against a list of known bad software, and uses some rules of thumb to spot things that look similar. If it recognises something, it blocks or removes it.
That is still useful. It stops a huge amount of everyday junk. But it works best on threats someone has already seen and described.
What EDR does
Endpoint detection and response (EDR) is protection that watches what happens on a device, such as laptops, desktops and servers. It records activity like which programs start, what they change, and what they connect to.
When something looks wrong, it can:
- Detect unusual behaviour, even if the software has never been seen before
- Alert someone, so a person can look
- Investigate by showing exactly what happened and when
- Respond by isolating the device from the network, killing a process or rolling back changes
The key difference: antivirus asks “is this file known to be bad?” EDR asks “is this behaviour normal?”
Why it matters now
Many modern attacks do not drop an obvious virus. Attackers steal a password, log in, and then use tools that are already on the computer to move around. Because those tools are legitimate, a list of known bad files will not flag them. Behaviour is what gives them away: a finance laptop running scripts at 3am, say.
EDR gives you a way to catch that, and a way to stop it spreading while you work out what has happened.
Do you need both?
Most modern EDR products include antivirus-style prevention, so you do not run two separate tools. Running two overlapping products can also slow machines down and cause conflicts, so check before adding one on top of another.
What you should ask is: does the product we pay for just block known threats, or does it also detect and respond to suspicious behaviour?
If you are on Microsoft 365, some licences include Microsoft Defender for Business or Defender for Endpoint, which offer EDR features. It is worth checking what you already own before you buy something else. Our Microsoft 365 licensing guide explains how the plans differ.
What about “managed” detection?
EDR produces alerts. Someone has to read them. A small team with no security specialist can end up with a tool that shouts and nobody listening.
That is where a managed service helps. A provider watches the alerts, filters out the noise and acts when something real happens. When you compare options, ask:
- Who looks at alerts, and when? Business hours only, or around the clock?
- What can they do without calling you? Can they isolate a device?
- How quickly will you hear about a real incident?
- What do you get in a report?
Where it fits with Cyber Essentials
Cyber Essentials requires malware protection on your devices, and that can be met with a decent antivirus or anti-malware product. EDR goes beyond the baseline, which is why many organisations add it after they certify. If you are working towards the scheme, our Cyber Essentials service explains what the assessment checks.
The practical answer
- If you are a very small team with low-risk data, a good, well-managed antivirus plus automatic updates is a sensible start.
- If you hold customer data, handle payments, work in a regulated sector, or have remote staff, EDR is worth having.
- If you do not have anyone to watch alerts, choose a managed option.
For the bigger picture of how protection, backups and certification work together, see our cyber security hub. If an attack does get through, the next thing you need is a plan, so read what to do in the first hour of an incident.
Want to know how we protect devices for our customers? Talk to us about cyber security.
