EDR vs antivirus: how they differ and when a business needs EDR

The antivirus console shows a green status on every computer, and yet someone from outside has been logging in to the file server for several days. This scenario does not require the protection to fail. It is enough for the attacker to use tools the company already has: the PowerShell console, remote desktop, the backup software. None of these programs is a file the antivirus would have any reason to block.

This is exactly where the line between antivirus and EDR runs. The first answers the question of whether something looks like a known threat. The second tries to answer whether what is happening on the computer makes sense.

Below we sort out the terms, show when a small business needs detection and response, and what a person does in all of this. We describe the selection criteria so that they can be applied to any vendor's offer.

What EDR is and how it differs from antivirus

Antivirus in the classic sense compares files against known threat patterns and blocks those that match. Modern products add behavioural analysis, but their job remains prevention: stopping a harmful file before it runs.

EPP, or Endpoint Protection Platform, is a broader category. In its glossary, NIST defines it as software safeguards that protect user computers from attack, listing antivirus, anti-spyware, a host-based firewall and device-level intrusion detection and prevention systems. In practice, most business “antivirus” products today are an EPP managed from a single console.

EDR, or Endpoint Detection and Response, assumes that some attacks will get past the prevention layer. The agent collects events from the device: running processes, network connections, system changes, logins. In its technical documentation, Bitdefender describes EDR as a mechanism that collects data from all devices and automatically identifies incidents that have bypassed preventive protection. On top of that come response tools, the most important of which is isolating the computer from the network.

AV, EPP, EDR, XDR and MDR side by side

The abbreviations get mixed up in offers because some describe software and some describe a service. The table below is meant to bring order; the specific scope always has to be checked in the feature table of the given product.

Category	What it does	Where its data comes from	Who responds
Antivirus (AV)	Blocks known harmful files	A file on the computer	Automated, sometimes the user
EPP	Prevents attacks on the device: AV, firewall, device and web control	The computer and its traffic	Automated and the console administrator
EDR	Detects suspicious chains of events, lets you investigate them and isolate the device	Telemetry from computers and servers	A person who analyses alerts
XDR	Combines events from computers with data from email, network, identity and cloud	Many sources at once	A person or team with access to all the sources
MDR	A service: an external team monitors alerts and responds within an agreed scope	Usually the client's EDR or XDR	The service provider's team

According to Bitdefender's description, XDR (Extended Detection and Response) extends EDR with sensors in email, network, identity systems and cloud, so that an attack can be seen along its whole path. The vendor describes MDR (Managed Detection and Response) as round-the-clock monitoring for companies without their own security team, with analysts who actively hunt for traces of an attack.

For a small business, the most important row is the last column. EDR without a person who reads the alerts gives you a lot of data and little security.

An example of an attack antivirus may not notice

An employee opens an attachment with an invoice. The document runs a script, the script downloads a legitimate administration tool, and that tool connects to other computers on the network and tries to read stored passwords. Each step on its own may look like ordinary admin work.

EDR sees this chain as a whole: an office program launched a command console, the console connected to an unknown address, and then login attempts to the server appeared from an account that had never done so before. Bitdefender's documentation gives the example of detecting lateral movement, that is, the attacker moving between computers, by observing remote command execution techniques and correlating events.

Such behaviour is described using MITRE ATT&CK, a public knowledge base of attacker tactics and techniques, built from observations of real attacks. For a buyer it is useful as a common language: it lets you ask a vendor which techniques the product detects and how it shows them in the console.

When a small business needs EDR

According to the ENISA Threat Landscape 2025 report, covering the period from July 2024 to June 2025, phishing accounted for around 60% of initial intrusion vectors and vulnerability exploitation for 21.3%. ENISA identifies ransomware as the most impactful threat in the European Union. In Poland, CERT Polska recorded almost 3,500 malware-related incidents in 2025, 81% more than a year earlier, including 179 ransomware incidents.

These figures do not mean every company has to buy EDR. They show that an attack usually starts with a person and email and ends with data. Detection and response make particular sense when:

• downtime of your ERP system, production or warehouse costs more than a few hours of work;
• you store client data, technical documentation or special category data;
• staff work remotely and laptops regularly leave the office network;
• a client, insurer or regulation requires you to show how you detect and handle incidents;
• you need to be able to cut a computer off from the network quickly without physical access to it;
• after an incident you want to know what happened and how the attacker got in.

For a very simple environment, a few computers with no server and no sensitive data, a managed EPP with well-configured policies is a sensible starting point.

What a person does with an alert

An EDR alert is a question someone has to answer. First it has to be classified: a false alarm, a suspicious event or a confirmed incident. Then someone has to decide on isolation, contact the company, preserve evidence, remove the cause and describe what happened.

In SP 800-61 Rev. 3 from April 2025, NIST places incident response within overall risk management according to the NIST Cybersecurity Framework 2.0. For a small business, this translates into a few arrangements that need to be made before the first alert:

• who reviews alerts and during what hours;
• which actions the system performs automatically and which require the company's approval;
• who at the company can approve disconnecting a computer, for example in accounts on month-end closing day;
• how quickly the provider reports a high-severity event and through which channel;
• what the company receives after an incident: a description of the cause, the scope and the actions taken.

Without these arrangements, an alert about files being encrypted at 7:30 in the morning lands in a console nobody has opened yet.

Workstation protection needs the basics in place

The agent on the computer is one of the layers. Shared accounts, no two-factor authentication on email, users with administrator rights, outdated systems and a backup permanently connected to the server are gaps that no tool will close on its own. We set out the order of work, from inventory to backups, in our checklist for small business cybersecurity.

A backup separated from the production network is particularly important. Ransomware rollback mechanisms built into some products help, but they do not replace a separate backup system with a restore test, which we write about in our post on data backup in the company.

What workstation protection with EDR costs

Endpoint protection licences are usually billed per device per month. As a Bitdefender Partner, we price them in our price list as follows:

Variant	Net price
Endpoint protection, base tier	from PLN 19 per workstation per month
Endpoint protection with threat detection	from PLN 29 per workstation per month
Deployment assistance for up to 99 workstations	from PLN 1,000 one-off
Audit of an existing Bitdefender installation	from PLN 500 one-off

For a company with 10 computers, the difference between the basic option and the option with detection is therefore from PLN 100 net per month. The licence, however, is the smaller part of the bill. The bigger part is the time of the person who configures policies, reviews alerts and responds. This cost should be named explicitly in the offer: in the support subscription, in the MDR service or in hourly billing.

Vendor-neutral selection criteria

When comparing offers, do not start with the product name. A list of questions you can apply to any solution:

• Do all your systems (Windows, macOS, Linux, servers) get an agent with the full feature set, or only some of them?
• How long is the telemetry needed for incident analysis retained?
• Can a computer be isolated remotely, and what still works when it is?
• How does the product show the course of an incident, and does it describe techniques in MITRE ATT&CK terms?
• How many false alarms does it generate in the first few weeks, and who tunes them out?
• Who has access to the console: only the provider, or the company as well?
• If you change provider, can you transfer the licences or export the data?
• Who responds outside working hours, and to what extent?

If you already have a specific platform on the table, a description of the editions and limitations of one of the products is in the post on Bitdefender GravityZone, and the scope and cost of deployment on the page Bitdefender GravityZone: deployment and ongoing support. This text is about the category, those are about a specific tool.

How to make the decision

Start by asking how much a day without a key system costs you and who in the company would notice an attack that left no harmful file. If the answer to the second question is “nobody”, antivirus alone is not enough, and EDR only makes sense together with an agreed process for handling alerts.

We describe the scope of workstation, account and backup protection that we deploy and maintain on the page cybersecurity.

Sources

• NIST Computer Security Resource Centre, Glossary: Endpoint Protection Platform (definition source: NIST SP 800-128), https://csrc.nist.gov/glossary/term/endpoint_protection_platform (accessed 02/10/2026)
• NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025, https://csrc.nist.gov/pubs/sp/800/61/r3/final (accessed 02/10/2026)
• MITRE, ATT&CK Resources, https://attack.mitre.org/resources/ (accessed 02/10/2026)
• ENISA, ETL 2025: EU consistently targeted by diverse yet convergent threat groups, 1.10.2025, https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups (accessed 02/10/2026)
• NASK, Prawie 2 tys. zgłoszeń każdego dnia. Raport CERT Polska za 2025 rok (Almost 2,000 reports every day. CERT Polska report for 2025), 8.04.2026, https://www.nask.pl/aktualnosci/prawie-2-tys-zgloszen-kazdego-dnia-raport-cert-polska-za-2025-rok (accessed 02/10/2026)
• Bitdefender TechZone, EDR, XDR and MDR overview, https://techzone.bitdefender.com/en/security-layers/detection/edr-xdr-and-mdr-overview.html (accessed 02/10/2026)

As of 2 October 2026.