EDR vs. MDR: what each one does and which your organization needs

EDR (endpoint detection and response) is software that detects and helps stop threats on laptops, desktops and servers, while MDR (managed detection and response) is a service in which security analysts use tools such as EDR to monitor, investigate and respond to threats around the clock. If nobody in your organization watches security alerts at night and on weekends, MDR is usually the better fit, because EDR alerts only help when someone qualified acts on them.

EDR and MDR appear in cyber-insurance applications, vendor proposals and board conversations, often in the same sentence. They sound almost identical, and they are related, but one is a technology and the other is a service.

Understanding the difference helps you buy what you actually need, ask better questions of providers, and avoid a common gap: security tools that generate alerts nobody is watching.

The short answer

Endpoint detection and response (EDR) is software installed on laptops, desktops and servers. It records activity on each device, detects suspicious behavior and gives administrators tools to respond.

Managed detection and response (MDR) is a service in which a team of security analysts uses detection technology, usually including EDR, to monitor your environment around the clock, investigate what it finds and respond on your behalf.

For most organizations, the real question is not EDR or MDR. It is who watches the alerts that EDR produces, who decides what they mean, and who acts on them at any hour.

What EDR does

Traditional antivirus compares files against a list of known threats. EDR goes further by watching behavior, which helps it spot attacks that use new tools or legitimate system utilities. A typical EDR product will:

• Record endpoint activity, such as processes, file changes, network connections and sign-ins
• Detect suspicious patterns, such as unusual encryption activity or credential theft techniques
• Raise alerts with supporting detail for an analyst to review
• Provide response actions, such as isolating a device from the network, stopping a process or quarantining a file
• Keep a searchable history that helps investigators reconstruct what happened

EDR is a strong foundation. Many cyber-insurance applications ask whether it is deployed across endpoints and servers, and for good reason.

Where EDR on its own falls short

EDR is only as effective as the people and processes behind it. On its own, it leaves several questions unanswered:

• Who reviews the alerts? Some alerts are serious, many are benign, and telling them apart takes experience and context.
• What happens at night and on weekends? Attackers do not keep business hours. An alert that waits until Monday may be too late.
• Who tunes it? Without ongoing adjustment, EDR can become noisy, and important alerts get lost.
• What about everything that is not an endpoint? EDR sees devices. It does not, by itself, see a compromised Microsoft 365 account, a malicious inbox rule or a risky sign-in from another country.
• Who decides to act? Isolating a server can stop an attack or interrupt a critical business process. Someone has to make that call quickly and well.

What MDR adds

MDR combines technology with experienced investigation, defined response processes and ongoing improvement. The tools generate signals; the service turns them into decisions. A well-run MDR service typically provides:

• 24/7 security monitoring by analysts who watch for meaningful activity at any hour
• Alert validation and investigation, so you hear about real threats with context, not a stream of raw alerts
• Response, including containment actions taken under rules you agree in advance, and clear guidance for anything that needs your decision
• Threat hunting for activity that did not trigger an alert
• Coverage beyond endpoints, which, depending on the provider, can include identity, Microsoft 365, email, cloud platforms and network activity
• Reporting and recommendations that show what happened, what was done and what to improve
• Escalation into incident response when an alert turns out to be part of a larger incident

EDR and MDR side by side

Area	EDR	MDR
What it is	Software installed on endpoints	A managed service delivered by a security team
Who watches alerts	Your team	The provider’s analysts, around the clock
Investigation	Your team, using the EDR console	Analysts validate and investigate, then report with context
Response	Automated rules plus whatever your team does	Containment under agreed rules, plus guidance and escalation
Coverage	Endpoints	Endpoints and, depending on the provider, identity, email, cloud and network
Improvement over time	Depends on your team’s capacity	Tuning, reporting and recommendations as part of the service

Where incident response fits

MDR is ongoing: it watches for threats and stops them early. Incident response is an engagement that starts when an incident is already underway: it contains the attack, investigates what happened and supports recovery. If you have already been hit, start with incident response. Our Have you been compromised? page explains how we help you recover and prevent a repeat.

Which does your organization need?

EDR on its own can work if

• You have a dedicated security team with coverage outside business hours
• That team has documented processes for triage, escalation and containment
• Someone has the time and expertise to tune detections and investigate alerts
• Ownership is clear: a named person is accountable for acting on what EDR finds

MDR is usually the better fit if

• Nobody is watching security alerts at night, on weekends or during holidays
• Your IT team or IT provider is capable but already stretched by day-to-day operations
• Insurers, clients or auditors are asking how you monitor and respond to threats
• You have had an incident, or a near miss, that went unnoticed for too long
• You want visibility across Microsoft 365, identity and email, not only devices

Many organizations with internal IT choose MDR to add specialized security operations without building their own security operations center (SOC). Their IT staff stay focused on running the business, and the MDR team focuses on threats. If your IT team also needs extra capacity, Atlantic Computer Systems, our parent company, offers co-managed IT services.

Questions to ask any MDR provider

1. Who investigates alerts, and is the SOC run in-house or by a third party?
2. What actions can you take on our behalf, and which require our approval?
3. Who supplies and manages the EDR agent on our devices?
4. Which sources do you monitor beyond endpoints, such as identity, Microsoft 365, Google Workspace, cloud platforms and network?
5. How will you notify us, and who will we talk to when something happens?
6. What happens when an alert becomes an incident? Do you handle incident response and forensic investigation yourselves?
7. What reporting do we receive, and how often do you review it with us?
8. How do onboarding and tuning work, and how long does onboarding usually take?
9. How do your recommendations connect to fixing the underlying issues in our environment?

How ACS Cyber approaches MDR

ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. Our managed detection and response service is delivered by our own SOC analysts, who provide 24/7 security monitoring and human-led investigation.

We supply and manage the EDR agent on your endpoints, so your team does not have to run a separate tool. Our monitoring also covers Microsoft 365, Google Workspace, Azure and AWS, plus firewall, network and server activity.

When something needs action, our SOC analysts take pre-approved containment actions, for example isolating a device or disabling an account, under rules agreed with you in advance. Anything outside those rules comes to you with a clear recommendation. If an alert turns out to be part of a larger incident, it moves directly into our incident response process, with forensic investigation performed in-house.

Typical onboarding takes 2-4 weeks. Each month, we review a security report with you that shows what we saw, what we did and what we recommend improving.

Because Atlantic Computer Systems provides managed IT, including helpdesk, Microsoft 365 administration, cloud and networks, the fixes our investigations recommend can be carried through in the underlying IT. Learn about Atlantic Computer Systems.

Detection is one layer, not the whole program

Neither EDR nor MDR replaces basic hygiene. Monitoring is most effective alongside strong sign-in protection, timely patching, reliable backups and staff who recognize suspicious requests. Useful next reads and services include:

• Our Microsoft 365 security baseline for identity, email and sharing settings
• Vulnerability management to find and prioritize weaknesses before attackers do
• Security awareness training to reduce the chance a phishing email succeeds
• Our guide to the controls underwriters commonly ask about

Talk it through

If you are weighing EDR, MDR or a mix of both, book a free 30-minute consultation with our security team. We will look at what you have today, who is watching it, and what would close the gaps. If you are dealing with an active incident, call our 24/7 incident line at 1-650-300-7557.