When a company buys a cybersecurity solution, it usually hears three abbreviations: EDR, XDR and MDR. Vendors use them as if they were self-explanatory, and the CEO or the finance director is left with a question: do we need all three or is one enough, and how is it different from the antivirus we already pay for?
The question matters not only for technical reasons. NIS2 and DORA require companies not just to have protection but to prove that incidents are detected and responded to. An installed program does not prove that. Someone has to watch what it shows and react when it shows red.
In this article we explain what each abbreviation really means, where the capabilities of one solution end and the next begin, and how to choose for a company of about 50 people with no dedicated security team.
Antivirus and EDR are not the same thing
A classic antivirus compares files against signatures of known malware and blocks what it recognises. This works against mass-distributed, long-known threats. It no longer works against attackers who use legitimate system tools, such as PowerShell, remote administration software and ordinary admin scripts, and leave no file that could be recognised by a signature.
EDR (Endpoint Detection and Response) looks not at files but at behaviour. An agent on the workstation or server records processes, network connections and registry changes and looks for suspicious sequences: for example, a Word document launches a command line that downloads a file and tries to disable backups. Each step looks harmless on its own, but the sequence does not.
The second important part of EDR is the response. The console lets you isolate a computer from the network, terminate a process, roll back changed files and see the whole chain of events: where it started and what was touched. An antivirus does not show that; it only reports “detected and removed”.
The practical consequence: EDR generates far more information than an antivirus. If nobody reads that information, EDR becomes simply a more expensive antivirus.
XDR: when one device is not enough
XDR (Extended Detection and Response) extends the same principle beyond the workstation. Data from e-mail, the identity system (for example Microsoft Entra ID), network devices, cloud services and servers is combined into a single view.
Why does this matter? A typical modern incident does not start on a computer. First an employee receives an e-mail, then enters a password into a fake sign-in page, then the attacker signs in to Microsoft 365 from another country, and only a few days later does something appear on a workstation. EDR sees only the last step. XDR connects all four into a single event and shows that this is one attack, not four unrelated alerts.
Bitdefender GravityZone, SentinelOne and CrowdStrike all offer an XDR layer today as an extension of EDR. The difference between them is which sources they connect without extra work and how much configuration is needed. We write about choosing between these three platforms in a separate article.
An important nuance: XDR increases the flow of information even further. The more sources, the more correlations, and the more alerts that someone has to assess.
MDR: people who watch 24/7
MDR (Managed Detection and Response) is not a technology but a service. The provider’s team of security analysts monitors the alerts of the EDR or XDR platform around the clock, separates real incidents from false ones, responds (isolates a device, blocks an account) and contacts you only when your decision is needed.
Why is it a separate service? Because attackers work at night and on weekends, exactly when your IT specialist is not looking at the console. Ransomware attacks are usually launched on Friday evening so that as much as possible is encrypted by Monday morning. An EDR that shows a red alert on Friday evening with nobody watching does not stop the incident.
MDR can be delivered by the platform vendor itself or by your IT support partner using the vendor’s tools. Both options make sense; the difference is how well the provider knows your environment. A vendor’s analyst sees only alerts; a partner who maintains your servers knows that a nightly script on the accounting server is not an attack but the month-end close.
How to choose by company size and team
It is not size that determines the choice but who will read the alerts, and when. In our experience, companies can be roughly divided like this.
Up to 20 employees, no IT specialist
You need EDR with managed monitoring. You do not need the console; you need someone to watch it and respond. Here MDR is usually included in the IT support service rather than purchased separately.
20 to 100 employees, one IT specialist or an external partner
The typical 50-person company. The IT specialist is busy with daily support and has no time (and often no specialisation) to investigate security alerts. You need EDR, and if you use Microsoft 365, XDR with identity and e-mail signals, plus MDR from a partner. The in-house specialist remains the decision maker, not the on-call watcher.
Over 100 employees or a regulated business
When you have NIS2 or DORA obligations, XDR becomes a necessity, because you need to prove that incidents are detected across the whole infrastructure, not just on computers. MDR with a clear SLA and incident reports is what you will show during an audit.
| Question | Antivirus | EDR | XDR | MDR |
|---|---|---|---|---|
| Blocks known viruses | Yes | Yes | Yes | Yes |
| Sees suspicious behaviour | No | Yes | Yes | Yes |
| Connects e-mail, identity, servers | No | No | Yes | Depends on the platform |
| Who responds at night | Nobody | Your IT | Your IT | The provider’s analysts |
What MDP CLOUD management includes
In our IT support service, security monitoring is not a separate line item. We deploy an EDR or XDR agent on every workstation and server (Bitdefender GravityZone, SentinelOne or CrowdStrike, depending on the customer’s environment), our team watches the alerts, and the response starts within 30 minutes.
Specifically, this means:
- agent deployment and policy configuration according to the nature of the company’s work, so that legitimate applications are not blocked;
- alert review and separation from false positives, so the customer receives only what needs its attention;
- device isolation and account blocking once an incident is confirmed, before we even call;
- a monthly report on detected events that can be attached to NIS2 or DORA documentation;
- coordination with backups, so there is something to restore from after an incident.
For servers, the same applies through our server management service, and our cloud servers are rented with GravityZone protection already installed.
Where to start
- Check what is currently installed: antivirus or EDR. If you do not know, it is most likely antivirus.
- Answer the question of who will see an alert on Saturday at 3 a.m. If the answer is “nobody”, what is missing is not technology but MDR.
- Write down where your data lives: computers, servers, Microsoft 365, cloud services. If it is not only on computers, consider XDR.
- If you operate in a regulated sector, check whether your current solution produces reports you can show to an audit.
- Get in touch with us. We will assess your current environment and propose what is included in IT support with no add-ons, and we will choose licences for Bitdefender GravityZone or another platform based on your number of devices.
