EDR vs MDR: What's the Difference and Which Do You Need?

What is EDR?

EDR replaced traditional antivirus. Antivirus compares files against a list of known-bad signatures, which stops commodity malware but misses anything new, and misses attackers who use legitimate tools already on the machine. EDR instead records activity on each endpoint continuously and looks for behaviour that indicates an attack, whether or not anything matches a known signature.

Typical EDR capabilities include:

• Continuous telemetry: processes, command lines, network connections, file and registry changes, and logons on every endpoint.
• Behavioural detection of techniques such as credential dumping, ransomware encryption patterns and suspicious PowerShell.
• An investigation timeline that shows how an attack unfolded, step by step.
• Response actions: isolate a host from the network, kill a process, quarantine a file, and on some platforms roll back changes.
• Threat hunting: search every endpoint at once for an indicator or behaviour.
• Next-generation antivirus built in, so a separate legacy antivirus product is no longer needed.

What is MDR?

MDR is detection and response delivered as a service. The provider deploys and tunes the tooling, which is almost always an EDR platform and often wider telemetry from network, cloud, email and identity systems. Their security operations centre (SOC) then watches it continuously.

What you are buying is not the software. It is the operating model around it:

• 24/7/365 monitoring, including nights, weekends and public holidays when many attacks are launched precisely because nobody is watching.
• Triage of every alert, so your team sees confirmed incidents rather than a queue of raw detections.
• Investigation by analysts who see attack patterns across many organisations, not just yours.
• Agreed response: the provider contains the threat directly under pre-approved rules, or tells your team exactly what to do.
• Proactive threat hunting for activity that did not trigger an alert.
• Reporting that a board or regulator can read.

MDR vs EDR features compared

Compared feature by feature, the two overlap heavily because MDR usually runs on EDR. Detection engines, telemetry, isolation and rollback are the same software either way. The features that differ are the ones that need people.

Alert triage, investigation, threat hunting and out-of-hours response are things EDR makes possible and MDR actually performs. An EDR console will happily show you a high-severity alert at 2am on a Sunday. Whether anything happens next depends entirely on whether someone is looking. That gap, between detecting an attack and acting on it, is where most of the damage in a ransomware incident is done.

When you compare MDR providers, look past the platform name. Ask for the response time commitment, what actions they will take without calling you first, how many analysts cover your account overnight, and what their reporting looks like after an incident.

Where XDR and SIEM fit

XDR (Extended Detection and Response) widens EDR beyond endpoints. It correlates signals from endpoints, network, email, identity and cloud workloads so that a phishing email, a suspicious sign-in and a process on a laptop are seen as one attack rather than three unrelated alerts. Like EDR, XDR is a technology that someone still has to operate, and many providers now sell it as managed XDR, which is MDR with wider coverage.

A SIEM (Security Information and Event Management) collects and correlates logs from across your environment: firewalls, servers, applications, cloud services and identity systems. It is the system of record for investigations and for compliance evidence, and it is where log retention requirements are usually met.

Does EDR replace a SIEM? No. EDR sees deep detail on endpoints only. A SIEM sees broad, shallower data from everything. Many organisations start with EDR or MDR because that layer can actually stop an attack in progress, then add a SIEM when they need wider correlation, longer retention or audit evidence. An MDR provider that ingests your logs alongside endpoint telemetry gives you much of the benefit of both.

What each really costs

The EDR licence is the smallest part of the cost of running EDR well. The large part is people: analysts capable of investigating attacks, enough of them to cover every hour of every day, plus their training, retention and tooling. Covering a single seat around the clock takes several full-time staff once leave, sickness and shifts are counted, and experienced security analysts are scarce and expensive to keep in Kenya as everywhere else.

MDR is a predictable subscription, usually priced per endpoint or per user. It is higher than an EDR licence alone, but it replaces the cost and risk of building that team. For most small and mid-sized organisations, MDR is the cheaper way to get the same protection. For a large organisation that already runs a SOC, owning the EDR and operating it in-house can be cheaper and gives more control.

We do not publish a price here because it depends on endpoint count, telemetry sources and the response model you need. Our cybersecurity cost guide explains what drives the number and how to compare quotes like for like.

How to choose

Use this test. Imagine an EDR alert fires at 3am on a public holiday. Name the person who sees it, confirm they are on a rota that night, and confirm they have the authority and skill to isolate the affected server. If you cannot do all three, you need MDR rather than more tooling.

• Choose EDR if you have an in-house security team that already covers 24/7, you want full control of tooling and data, and you have the capacity to tune detections.
• Choose MDR if you have no round-the-clock security team, you have bought security tools before that nobody had time to watch, or you need expert incident response without hiring for it.
• Choose a co-managed model if you have a small team that covers business hours: they keep control during the day and the provider covers nights, weekends and surge.
• Consider XDR or managed XDR once endpoints are covered and your next gap is correlating email, identity and cloud activity.

Questions to ask an MDR provider

MDR quality varies far more than EDR quality, because the product is the people. Before you sign, ask:

• What is your committed time from detection to containment, and is it in the contract?
• Which response actions will you take without calling us first, and who approves them?
• Where is the SOC, who staffs it overnight, and where is our data stored and processed? This matters under the Kenya Data Protection Act's cross-border transfer rules.
• Which EDR platform do you use, and do we own the licences if we leave?
• What does an incident report look like, and how quickly do we get it?
• Can you show evidence of an incident you contained for a client in our sector, with names removed?

Key takeaways

• EDR is software; MDR is a service that operates detection and response for you, usually on top of an EDR platform.
• The features that differ are the human ones: 24/7 triage, investigation, threat hunting and out-of-hours response.
• EDR does not replace a SIEM. EDR sees endpoints in depth; a SIEM sees everything more broadly and holds the log record.
• EDR's real cost is the analyst team it needs. For most organisations without a 24/7 SOC, MDR is the cheaper route to the same protection.
• Choose by asking who acts on an alert at 3am on a public holiday. If you cannot name them, choose MDR.

Frequently asked questions