EDR vs antivirus: what is the difference and which do you need?

Antivirus aims to stop known malicious files from running on a device. Endpoint detection and response, or EDR, continuously records what happens on endpoints, such as processes, network connections and logins, so analysts can spot suspicious behaviour, investigate it and contain a machine. Antivirus prevents. EDR also gives you evidence and response.

What does antivirus do well?

Traditional antivirus compares files against known signatures and, in modern products, adds heuristics and reputation checks. It is good at the volume problem: the large number of commodity malware samples that circulate every day.

NIST SP 800-83 Rev. 1, the guide to malware incident prevention and handling, notes that malware is the most common external threat to most hosts and recommends layered prevention. Antivirus belongs in that stack. The guide also asks for an incident response capability for cases that get through, which is where the next tool comes in.

What does EDR add?

An EDR agent collects telemetry from the endpoint: which process started which, what files were written, which connections were opened, which accounts logged in. It stores or streams that data to a console.

Three capabilities follow from the data.

Detection by behaviour. A document that spawns a command shell that downloads a file is suspicious even if no file matches a signature.

Investigation. An analyst can see the sequence of events across a machine, not only the alert.

Response. From the console you can isolate a host from the network, kill a process, or collect files, without walking to the machine.

Where do the two blur together?

Many current products bundle both. The label on the box matters less than three questions. Does it keep a history you can search? Can you isolate a host remotely? Who will watch the alerts? An agent with no one reading it protects less than its feature list suggests.

What does EDR not do?

It sees endpoints, so it misses what happens elsewhere: a stolen cloud token used from a different network, a malicious email never opened on a managed device, an unmanaged laptop. It also generates alerts that need skilled triage. Small teams often buy it as a managed service for that reason.

How does EDR fit into incident response?

NIST SP 800-61 Rev. 3 ties incident response to the Cybersecurity Framework functions, including detection, response and recovery. Endpoint telemetry feeds the first of those, and isolation or process termination serves the second. After an incident, the recorded history helps you work out how far an intruder got, which decides whether you rebuild one laptop or a whole network segment.

A constructed example

An accountant opens an attachment. The file is new and matches no signature, so antivirus stays quiet. The document launches a script, which starts a remote access tool and begins listing network shares.

With EDR, that chain triggers a behavioural alert. An analyst isolates the laptop within minutes, reviews the process tree, finds the first file and searches other machines for it. Without EDR, the first sign might be files encrypting on a shared drive.

How to check or apply this

1. Count your endpoints, including servers and unmanaged devices, and decide which need coverage.
2. Confirm antivirus or equivalent prevention is installed and updating on all managed devices.
3. If you add EDR, decide who watches alerts at night and weekends. If nobody, price a managed service.
4. Check retention: how many days of telemetry stay searchable?
5. Test isolation on a lab machine before you need it.
6. Write a short runbook that says who may isolate a business critical server.
7. Review coverage monthly for machines that dropped off.

Quick check

Sources

• NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
• NIST SP 800-61 Rev. 3, Incident Response Recommendations

Last reviewed: 18 October 2026.