EDR watches endpoints, XDR correlates signals from several sources, and MDR is a managed service where an outside team runs detection and response for you. The first two describe technology. The third describes who operates it. Vendors stretch all three, so ask what data is collected and who acts on it.
EDR: the endpoint view
Endpoint detection and response puts an agent on laptops and servers. It records process starts, file changes and network connections, compares them with known bad behavior, and gives responders ways to act, such as isolating a machine or killing a process.
The question it answers is: what happened on this device? NIST lists EDR as a glossary term, citing it in several of its publications, but the day to day meaning comes from how products behave.
XDR: the correlation view
Extended detection and response widens the input beyond endpoints. The usual idea is to pull in identity, email, cloud and network signals and connect them, so a suspicious login, a strange email and an odd process on one laptop show up as one story instead of three alerts.
The question it answers is: how do these signals fit together? One plain description from a vendor guide puts it as XDR correlating signals across multiple sources, while EDR monitors endpoint processes and files and NDR monitors network traffic. There is no single industry standard for exactly which sources count, so two products called XDR can differ a lot.
MDR: the service
Managed detection and response is people. A provider's analysts watch your telemetry, investigate, and either act or tell you what to do. It often runs on top of an EDR or XDR product.
The question it answers is: who is looking at this at three in the morning?
Side by side
- EDR: technology. Main input is endpoint activity. Operated by you or a provider.
- XDR: technology. Main input is several sources, correlated. Operated by you or a provider.
- MDR: a service. Main input is whatever the provider is given. Operated by the provider, with you.
How to choose
Start from your gaps, not the acronym.
If you have no endpoint visibility, EDR coverage comes first. If you already collect endpoint, identity and cloud logs but cannot connect them, correlation is the gap. If you have tools but nobody to watch them out of hours, the gap is people, and a managed service or an on call rota addresses it.
Also ask three buying questions. What does it collect by default? How long is data kept? What can responders do remotely, and who approves it?
Quick check
Can I have MDR without EDR?
Yes in principle, since a provider can work from logs you send. In practice most providers want endpoint telemetry because it is the richest source of evidence.
Does XDR replace a SIEM?
Not automatically. A SIEM is a general purpose log store and search tool, often used for compliance retention too. Some organizations use both, some consolidate. Check retention and query needs before deciding.
Sources
- NIST CSRC glossary: endpoint detection and response
- Wiz Academy: AI detection and response, for the one line comparison of EDR, XDR and NDR.
Last reviewed: 19 October 2026.
