Does a small business need EDR? What to do before and after

Endpoint detection and response (EDR) records what happens on laptops and servers so threats can be spotted, investigated and contained. A small business benefits most when the basics are already in place and someone, in house or outside, will act on alerts. Without that, EDR is a log nobody reads.

What does EDR actually do?

Traditional antivirus compares files to known bad patterns. EDR adds continuous recording of endpoint activity, such as process starts, file changes and network connections, plus tools to look back through that record and to isolate a device remotely. It answers questions like: what ran on this laptop, where did it come from and what else did it touch.

That second half, response, is the reason for the name. The ability to cut a machine off the network at 2 a.m. is worth little if no one is awake to use it.

Do the basics come first?

Yes, in most cases. The UK National Cyber Security Centre's small organisations guide organizes its advice around five areas: securing email, securing important online accounts, protecting devices, backing up data and spotting attacks. It says many steps take as little as five minutes, and that responsibility should not rest with a single person. It also reports that one in two small businesses suffers a cyber incident each year, which is the NCSC's figure.

Those basics block a large share of routine attacks cheaply. A phishing email that never arrives, a stolen password that cannot log in without a second factor and a ransomware infection you can restore from backup all matter more than detection tooling. EDR sits on top of that foundation. It does not replace it.

When does EDR earn its cost?

Consider it when one or more of these apply:

• You hold data that would hurt customers if lost, such as health, financial or identity records.
• You have remote staff on laptops outside any office network.
• A customer, insurer or contract asks for endpoint detection.
• You have been hit before and could not tell afterward what the attacker did.

A constructed example: a 25-person accounting firm has multi-factor authentication, patched laptops and tested backups. A staff member opens a booby-trapped spreadsheet. Antivirus misses it. An EDR product flags a spreadsheet launching a command shell, and the managed service provider isolates the laptop within minutes. Without EDR, the same event might have run for days before anyone noticed.

Who will respond to alerts?

This is the real question. A small company has three realistic choices: an IT person who owns alerts with a clear after-hours plan, a managed provider who monitors and acts on your behalf, or a product configured to contain threats automatically with a person reviewing afterward. NIST's incident response guidance recognizes that handlers may be on staff, on contract or available when needed, and that responsibilities with a provider should be defined in a contract. Write down who may isolate a machine and who may approve unisolating it.

Ask any provider what they do with an alert at night, how fast, and what authority they have. Get the answer in the contract.

How to check or apply this

1. Confirm the basics: email filtering, multi-factor authentication on key accounts, device updates and backups you have restored in a test.
2. List the devices and data you most need to protect.
3. Decide who responds to an alert at 2 a.m. Name a person and a backup.
4. Pick a product or service only after you know the answer to step 3.
5. Pilot on ten devices for a month. Count alerts per week and how many needed action.
6. Write rules for automatic isolation, and who can lift it.
7. Practice once: simulate a harmless test event and time how long it takes to isolate the device.

Quick check

Sources

• NCSC, Small organisations guide to cyber security
• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management

Last reviewed: 18 October 2026.