Antivirus still has a role. It compares files with a stored list of known malware and blocks a match. That works against threats already catalogued. It fails when an attacker never drops a recognised file. Many incidents now run utilities that already sit on the device, abuse administrator tools, or exploit flaws no vendor list has recorded yet. Some execute in memory, so a scanner has nothing on disk to hash.
Endpoint Detection and Response (EDR) is the control built for those cases.
What EDR watches that antivirus does not
EDR records what a device is doing while people work. File inspection is one input. The platform also follows processes as they start, connections leaving the machine, registry edits, attempts to raise privileges and hops onto neighbouring systems. The test is behavioural: does this sequence look hostile, even if no known malware file appeared?
Typical signals:
- PowerShell launching at 2am and opening a connection to an external IP address
- An account reaching file shares it has never used
- An Excel macro starting a command prompt
- A process encrypting files at high speed, a pattern associated with ransomware
A signature scanner won't raise any of those. EDR does, because it's watching how the device behaves.
How EDR acts on what it finds
When the platform spots activity it doesn't trust, it can:
- Alert the security team with the sequence of events, the device involved and the user account
- Isolate the device from the network so the incident cannot spread
- Kill the malicious process
- Roll back file and system changes (supported by some EDR products)
- Collect forensic data so the incident can be reconstructed later
A known attack pattern can trigger an automatic response. A mixed picture waits for an analyst before anything is shut down.
EDR vs antivirus: the practical difference
| | Traditional antivirus | EDR | |---|---|---| | How it detects | Matches known signatures | Analyses behaviour | | Known malware | Detects | Detects | | Unknown malware | Misses | Detects | | Fileless attacks | Misses | Detects | | Response | Blocks or quarantines the file | Isolates the device, stops the process, can roll back | | Visibility | Little | A full activity timeline | | Investigation | Sparse | Forensic detail |
Where MDR comes in
Managed Detection and Response (MDR) puts operators behind the EDR alerts. Analysts in a security operations centre watch them 24/7, investigate what looks wrong and act on your behalf. If there's no internal security team to run EDR, MDR is the workable route.
What it costs
- EDR software (Microsoft Defender for Endpoint, SentinelOne, CrowdStrike): £3 to £8 per device per month
- MDR service (24/7 monitoring and response): £8 to £20 per device per month
For a 50-device business, MDR usually lands between £500 and £1,000 a month. A ransomware incident at a UK SME typically exceeds £100,000 once downtime, recovery work and reputational damage are counted.
How Wanzo puts EDR in place
Microsoft Defender for Endpoint is included with Microsoft 365 Business Premium. We set it as the default for managed IT clients and enrol every device. Businesses that want 24/7 coverage get MDR as well. We configure the policies and review the alert queue each day. Investigations sit with us.
Automated workflows run on the same laptops and servers as everyone else. Compromise those devices and the automation fails with them. EDR belongs in the cybersecurity layer that work depends on.
What to do next
If EDR or MDR is on your list, use the contact page or write to hello@wanzo.co.uk. We'll map the service to your device count and the Microsoft 365 licences you already hold.