EDR vs antivirus: what UK small businesses actually need.
Antivirus checks files against a list of known threats. EDR — endpoint detection and response — watches how software behaves and stops attacks it has never seen before. For a modern small business, that difference is the difference between a contained incident and a closed company.
- Antivirus asks “is this a known threat?” EDR asks “is this device behaving like it’s under attack?”
- Modern ransomware is usually signatureless until it’s too late — which is exactly what antivirus can’t catch.
- EDR is the technology; MDR is EDR plus a 24/7 human SOC that actually responds.
- For any business holding client data or unable to survive days of downtime, EDR is now the practical minimum.
What antivirus does — and where it stops
Traditional antivirus works by signature matching. Security vendors catalogue known malicious files, each with a unique fingerprint, and your antivirus blocks anything that matches. It’s fast, cheap and genuinely useful against the flood of old, recycled malware. For two decades it was enough.
The problem: a signature only exists after someone has seen the threat. Attackers now generate unique malware per target, run attacks entirely in memory, or use legitimate built-in tools (“living off the land”) so there’s no malicious file to match at all. Against modern ransomware, signature antivirus is often looking for a fingerprint that doesn’t exist yet.
What EDR adds
EDR doesn’t care whether it’s seen a threat before. It continuously records what’s happening on the device — which processes spawn which, what touches memory, what connects to the network, what tries to persist after reboot — and flags behaviour that looks like an attack.
A Word document spawning PowerShell that reaches out to an unknown server and starts encrypting files has no known signature. But the behaviour is unmistakable, and EDR can:
- Detect the malicious behaviour in seconds, signature or not.
- Isolate the device from the network automatically, before it spreads.
- Roll back the damage — some EDR can revert files an attack encrypted on that device.
- Retain forensics — a full timeline of what happened, for investigation and insurance.
Antivirus is a smoke alarm. EDR is the sprinkler system — it doesn’t just tell you there’s a fire, it puts it out.
EDR vs MDR: the bit that catches people out
Here’s the trap. EDR generates alerts — sometimes a lot of them. If nobody is watching at 3am on a Sunday, an alert is just a light blinking in an empty room. EDR technology without monitoring is a louder alarm, not protection.
MDR — managed detection and response — is EDR plus a human Security Operations Centre watching it around the clock, triaging every alert and responding on your behalf. For an SMB with no security team of its own, MDR is the model that actually works, because the response doesn’t depend on someone in your office noticing.
So what does a small business actually need?
A simple way to decide:
- You hold client data, take payments, or can’t lose a few days to downtime. You need EDR, monitored — i.e. MDR with a 24/7 SOC. This is most businesses.
- Enterprise clients or cyber insurers are asking about your security. They increasingly mandate EDR with 24/7 response. Antivirus alone will lose you contracts and cover.
- You’re a very small, low-risk operation with nothing critical to lose. Reputable antivirus may be a defensible minimum — but understand the gap you’re accepting.
For the majority of UK SMBs, the honest answer is the first one. The good news is that Managed EDR at SMB scale is no longer enterprise-priced — it’s a per-device line item, and it’s usually the single highest-impact security spend a small business can make.
Questions we get asked.
What’s the difference between antivirus and EDR?
Antivirus matches files against known-bad signatures and blocks matches. EDR watches how software behaves — processes, memory, network, persistence — and stops or reverses anything malicious, seen before or not. Antivirus asks “is this a known threat?”; EDR asks “is this device behaving like it’s under attack?”
Does a small business really need EDR, or is antivirus enough?
For any business holding client data, taking payments, or unable to survive a few days of downtime, EDR is now the practical minimum — modern ransomware is signatureless until it’s too late. Very small, low-risk operations may accept antivirus, but insurers and enterprise clients increasingly require EDR.
What’s the difference between EDR and MDR?
EDR is the technology on the endpoint. MDR is EDR plus a human SOC watching it 24/7 and responding for you. EDR without monitoring is just a louder alarm; MDR is the alarm plus someone who answers it at 3am.
Will EDR slow our computers down?
Modern EDR agents are lightweight — typically under 2% CPU at idle — and most users never notice them. Reputable providers test against your standard device image before rollout.
See a real
EDR console.
Book 30 minutes. We’ll show you a live detection, the exact steps the SOC takes, and tell you honestly whether your current protection has a gap worth closing.