What traditional antivirus does well
Classic antivirus compares files against a database of known threats and blocks anything that matches. Modern products add heuristics, cloud lookups and some behaviour checks, so they catch a fair amount of everyday junk: infected downloads, malicious email attachments, old worms and the bulk of commodity malware. Microsoft Defender Antivirus, built into Windows, does this job well enough that buying a separate consumer antivirus product adds little for most offices.
The weakness is in the name. Antivirus is built to recognise bad things. It is far less useful when an attacker uses tools that are not malicious at all, such as PowerShell, remote management software or the built-in Windows backup commands, to do harm. Those tools are on every computer for good reasons, so a scanner sees nothing to block.
What EDR adds
EDR software records activity on each computer: which processes started, what they launched, which files they changed, what network connections they made and which accounts were used. It looks for patterns that suggest an attack, such as Office spawning a command prompt, a process reading saved passwords from memory, or mass renaming of files, and raises an alert with the full chain of events attached.
Crucially, EDR includes response tools. An analyst, or an automated rule, can isolate a computer from the network while keeping a connection to the security console, kill a process, quarantine files or roll back changes. That ability to stop an attack in progress, rather than simply report it afterwards, is the real difference.
Why the gap matters now
Ransomware groups and business email compromise crews have moved towards living-off-the-land techniques precisely because they slip past signature scanning. A typical intrusion might involve a stolen password, a legitimate remote access tool installed under a plausible name, and a few commands to disable backups. None of those steps involves a file that antivirus would call malicious. By the time encryption starts, the attacker may have been inside for a week, and the only evidence is a trail of normal-looking commands that EDR records and antivirus ignores.
Insurers have noticed. Cyber insurance applications in New Zealand commonly ask whether you run EDR on all endpoints, not just whether you have antivirus, and some policies price or limit cover accordingly. Answering yes when only antivirus is installed creates a problem at claim time. It is worth checking exactly what is installed on every device before filling in the form, rather than relying on memory.
The catch: someone has to watch it
EDR produces alerts, and alerts need a human. In a large company a security team reviews them. In a ten-person office there is nobody, so an EDR console nobody looks at is only slightly better than antivirus. The options are a managed detection and response service, where a vendor's analysts triage alerts and can isolate machines on your behalf, or an IT provider that monitors the console as part of its service. Ask any provider what happens when an alert fires at 2am on a Saturday. Will a machine be isolated automatically, will someone be woken, or will it wait until Monday? The answer should be written into your agreement so expectations are clear on both sides.
Choosing a product
Several well-known vendors offer EDR suitable for small businesses, including Microsoft Defender for Business, which is included in some Microsoft 365 business plans; check current licensing to see what yours covers. Others such as SentinelOne, CrowdStrike, Sophos and Huntress are common in managed IT. The brand matters less than three practical points: it covers every Windows and Mac device you own, it is managed centrally, and alerts reach a person who can act. Avoid running two security products that fight each other. If you add a third-party EDR, it usually puts Defender into a passive mode; if you use Defender for Business, remove leftover trial antivirus from new laptops so it does not interfere.
Where EDR fits in the bigger picture
EDR is a strong layer, not a whole strategy. It works best alongside patching, multi-factor sign-in, standard user accounts and tested backups, because each of those reduces how many alerts there are to deal with and how much damage an attacker can do before being caught. Think of EDR as the alarm and the security guard, and the other controls as the locks on the doors.
For a small business, a reasonable starting point is EDR on every computer and server, monitored by someone with authority to isolate, plus a quarterly look at what it caught. That review often reveals patterns, such as one team repeatedly downloading risky tools, that are cheap to fix with a conversation.
In short
- Antivirus recognises known bad files; EDR watches behaviour and can stop an attack
- Modern attacks use legitimate tools that antivirus does not flag
- EDR is only useful if someone reviews and acts on its alerts
- Insurers increasingly ask for EDR on every endpoint
- Pick one product, cover every device, and define who isolates a machine