EDR vs antivirus: what protection does a small business need?

Antivirus software aims, among other things, to prevent and block malicious activity. EDR adds endpoint visibility, investigation capabilities and response actions. Features overlap between products. For a small business, the decision should focus on what is actually deployed and who handles incidents.

A console collecting alerts with nobody to assess them does not provide the same service as a team authorized to act. Conversely, a product labeled “antivirus” may already use behavioral analysis and cloud services. Comparing signature-only antivirus with supposedly infallible EDR leads to poor purchasing decisions.

Microsoft's Windows endpoint protection documentation distinguishes prevention, EDR and investigation capabilities. When comparing offers, follow the path from an event on a device to an action actually carried out.

Antivirus, EDR, MDR and XDR: the useful distinctions

Antivirus and EDR describe technical capabilities. MDR describes a managed detection and response service. XDR broadens analysis and correlation across multiple sources, depending on the solution. A commercial label alone does not specify service hours, authorized actions or covered equipment.

The difference between a tool and a service is explicit in Microsoft's managed response documentation: actions depend in part on the permissions granted to the experts. Its XDR explanation describes bringing together signals from several domains. Verify those capabilities in the particular offer under consideration.

Measure coverage against the right inventory

The number of licenses purchased does not measure protection. Compare expected devices with devices whose protection is active and whose reporting is recent enough for your operating model. A device missing from the console must remain in the denominator. A duplicate or retired workstation must not inflate the numerator.

In this fictional example, a company has 50 devices within scope:

The calculation 48 ÷ 50 × 100 = 96% is correct. It would still be misleading to conclude that the remaining problem is minor. Also report uncovered critical devices, their owners and the planned action. A percentage alone hides concentrated risk.

For each device, keep at least its operating system, last report, protection status, exclusions and owner. Distinguish equipment deliberately offline from a silent agent on a running server. Agree with the operator when a lack of reporting becomes an anomaly.

Coverage also involves administration rights and evidence availability: who can create an exclusion, how long useful events remain accessible and who can export them during an incident. History that is shorter than your actual response delay limits an investigation.

France's ANSSI MonServiceSécurisé control framework addresses antivirus and EDR alert monitoring. The contract therefore needs to connect the monitored fleet with responsibility for handling alerts.

Fictional example: an alert on Friday evening

In this scenario, a laptop triggers an alert at 21:10. The product can supply investigation evidence and suggest isolating the device. What the business receives next depends on the service purchased and the decisions authorized.

Three organizations could use a product capable of detecting this event, yet get very different operational outcomes.

The console alone. The alert is recorded, but nobody reviews it outside working hours. The product works; alert triage at 21:10 is not part of the contract. The business needs to recognize that period without an analyst.

An analyst without response authority. Someone examines the alert and recommends isolating the laptop but must wait for approval. If the designated contact does not answer, the decision remains pending. Having a team available around the clock does not remove that dependency.

An analyst authorized to act within an agreed scope. They can request isolation when the agreed conditions are met. They still need to verify execution. An offline computer can leave the command pending: the ticket must distinguish action recommended, command submitted and execution observed.

These scenarios are fictional. They lead to a precise question before signing: “At 21:10, who can decide, what can they do without reaching us, and how will they know the action succeeded?”

Device isolation: check what else you interrupt

The same button can have very different consequences depending on the equipment. Microsoft states, for example, that isolating a Hyper-V host blocks network traffic for its virtual machines. It also notes that a device behind a full-tunnel VPN can lose access to the Defender cloud service after isolation. See response action conditions.

Prepare for those limits. Identify hosts supporting multiple services, the remaining path to the console and the way to release isolation. Test a remote laptop on a device designated for the exercise, not only a workstation in the office.

The response mandate should specify allowed actions on critical equipment, known consequences and who can make the business decision. A blanket prohibition can delay containment; unrestricted authority can interrupt several activities at once. Agree the boundaries with the relevant owners before an alert occurs.

Compare two quotations without getting lost in features

Ask both providers to address the same scenario and show the same type of evidence. A sales demonstration may illustrate a capability; acceptance testing must establish that it works in your environment with the rights actually granted.

For time commitments, distinguish when an event is detected, when an alert is assessed and when an action is executed. Our managed IT SLA article helps define measurements and exceptions.

Price comparisons must include the same equipment, hours and responsibilities. A per-workstation fee with business-hours handling is not directly comparable to a service with overnight analysts and broader response authority.

If you already have Microsoft 365 Business Premium

Start by checking what you have. Business Premium includes Defender for Business, combining endpoint protection, detection and response capabilities. That does not prove that devices are onboarded or alerts are handled. See Microsoft's Defender for Business overview.

Request onboarding and reporting evidence for each device category. Defender for Business requirements distinguish workstations, mobile devices and servers. Windows or Linux servers require an appropriate additional license; a Premium user license alone does not establish their coverage. Then compare the capabilities you need with your existing solution before deciding whether there is duplication.

Do not deploy two active protection engines arbitrarily. Coexistence, active or passive modes and available functions depend on the products and operating systems. Documentation and a pilot should determine a supported combination.

Microsoft response actions depend on platform and license. For example, at the date of review, the “stop and quarantine a file” action documented for some plans is not included in Defender for Business. Request the list of operations available on your systems; a demonstration of another plan is insufficient.

Useful acceptance testing can remain harmless

You do not need to launch a real attack to test operations. With the provider, select a vendor-documented test mechanism, a pilot device and an authorized window. Notify the appropriate people and define when the test ends.

The test can follow device reporting, generation of a simulated alert, arrival in the expected queue, triage and escalation to the right person. Isolation can be a separate exercise, only on a designated device and with a recovery procedure.

Record generation, triage, decision and execution times, along with observed deviations. An announced exercise validates that workflow under the test conditions; it measures neither detection of every attack nor response time to an unexpected incident. A pending action must remain marked as pending in the report.

Questions to resolve for your business

Does EDR replace backups?

No. Detection or isolation alone does not provide a restorable copy of your data. Prepare backup recovery with its own test procedure.

Does a small team need MDR?

Internal operation can work when a team has the skills, permissions, time and coverage required, with backup during absences. If one person receives alerts between other tasks and has no replacement, there is already a gap in the handling service.

Consider MDR when that service is missing, then specify its authority. “Notify the business owner” and “isolate a device without waiting for approval under agreed conditions” are different services. Extended hours do not remove business decisions that remain yours.

How can you judge whether the investment is useful?

Start with observable criteria: expected devices actually monitored, gaps corrected, alerts assessed and successful exercises. These indicators do not calculate a percentage of attacks prevented. They show whether the service you pay for works in your environment.

Before choosing a new product, request the last exercise result and the list of uncovered critical devices. If both are missing, work on your systems should establish them first. An Initial Infra assessment can start with your inventory, current contract and planned alert workflow to distinguish the tool from the service.

Sources reviewed on 9 October 2026. Coverage figures and the Friday-evening scenario are fictional. English translation prepared on 12 October; product capabilities must be rechecked before publication.