EDR vs antivirus: why blocking known malware is no longer enough

The short answer

Antivirus tries to stop known malicious files before they run, mostly by matching them against signatures and patterns. Endpoint detection and response (EDR) includes that prevention but also records what happens on each device, spots suspicious behavior such as an attacker using legitimate admin tools, and lets someone isolate the machine, investigate and roll back the damage.

For a business with employees, client data or cyber insurance, EDR is now the baseline. Many attacks use stolen passwords and built-in tools rather than malware files, and traditional antivirus does not see them. Insurers and brokers list EDR among their key controls, and the FBI recommends it in its 2025 Internet Crime Report. The good news: as of 2026, EDR can cost a few dollars per user per month, and you may already own it.

How traditional antivirus works

• Signatures: it compares files against a list of known malware.
• Heuristics: newer products also flag files that look or act like malware.
• Action: it blocks or quarantines the file and shows an alert on that one computer.

That is useful against commodity malware, infected downloads and old threats. Its limits show when there is no bad file to catch: an attacker who logs in with a stolen password, runs PowerShell, uses a remote support tool or turns off security settings looks like a normal user to classic antivirus.

How EDR works

• Prevention: next-generation antivirus is usually built in, so EDR replaces antivirus rather than sitting beside it.
• Recording: it logs process starts, network connections, file changes and logins on every device and sends them to a central console.
• Detection: it looks for behavior that matches attacker techniques, such as credential dumping, mass file encryption or a tool spreading from one machine to the next.
• Response: an admin, or the software automatically, can isolate a device from the network, kill a process, delete files and sometimes roll back changes.
• Investigation: the timeline shows where an attack started and which other machines it touched.

The FBI’s report notes that EDR tools are particularly useful for detecting the lateral movement that comes before ransomware encryption.

One attack, seen two ways

Picture a common small business incident. An employee’s Microsoft 365 password was stolen by an infostealer on a home computer. The attacker signs in to the company VPN, which has no MFA, and reaches an office PC.

• With antivirus only: the attacker runs built-in Windows tools to look around, copies a remote access program that is not on any malware list, and collects saved passwords. Antivirus sees nothing it recognizes. Days later, ransomware is launched across every machine at once, and the first alert anyone sees is the ransom note.
• With EDR: the same activity is recorded. The credential theft and unusual use of admin tools trigger a high-severity alert within minutes. Automated response isolates the PC from the network, and the person watching alerts disables the stolen account and blocks the VPN session. The timeline shows exactly which machines the attacker touched.

EDR did not prevent the stolen password. MFA would have. But it turned a business-stopping event into a contained incident, which is why the two controls belong together.

Side by side

Why insurers now ask about EDR

Cyber insurance applications increasingly ask whether EDR is deployed on every endpoint and server. Marsh, a large insurance broker, lists endpoint detection and response among its twelve key cybersecurity controls and says adopting certain controls has become a minimum requirement of insurers.

Answer these questions carefully. If the application says EDR is on all devices and an old server or a laptop at home was missed, that gap can matter if you file a claim. Our cyber insurance requirements guide covers the other controls carriers check. This is general information; confirm your policy’s wording with your broker.

Not sure whether you have EDR or just antivirus? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity and IT operations, including endpoint protection coverage, with the next steps in order. It is yours to keep, with no obligation. Book your assessment.

What it costs, and you may already have it

• Microsoft Defender Antivirus is built into Windows at no extra cost. It is solid antivirus, but on its own it is not EDR.
• Microsoft Defender for Business adds EDR, automated investigation and response and vulnerability management. Microsoft lists it at $3.00 per user per month standalone, covering up to five devices per user, for organizations of up to 300 users, as of 2026.
• Microsoft 365 Business Premium includes Defender for Business, so many small businesses already pay for EDR but never turned it on or onboarded their devices.
• Third-party EDR from vendors such as CrowdStrike, SentinelOne and Sophos is priced per endpoint and often bought through an IT provider.

Servers usually need extra licenses. Microsoft notes that Windows and Linux server protection is not included in Defender for Business by default.

Common objections

• “We are too small to be targeted.” Most attacks are automated and opportunistic. Small organizations make up the large majority of ransomware victims in the 2026 Verizon Data Breach Investigations Report, according to the Cyber Readiness Institute’s summary.
• “It will slow our computers down.” Modern EDR agents are lightweight. Running two security products at once is what slows machines, so remove the old antivirus when you deploy EDR.
• “Nobody will read the alerts.” A fair concern. Turn on automatic response features, and make sure alerts go to a person or a provider who acts on them.
• “We use Macs.” Macs get malware and account takeovers too. Most EDR products support macOS.

What a small business should run

1. EDR, not just antivirus, on every Windows and Mac computer, plus servers.
2. Tamper protection turned on so attackers cannot switch the agent off.
3. Old antivirus removed, so there is one product per device.
4. Alerts routed to someone with authority to isolate a machine quickly.
5. A monthly check that every device is reporting in. Unmanaged devices are where attacks start.

JLB USA’s cybersecurity services include endpoint protection and updates for businesses with roughly 25 to 100 employees, and we can work alongside an existing IT person.

Keep reading

• EDR vs MDR vs XDR: plain-English definitions and when managed detection is worth it
• Password manager for business: how to choose one and roll it out
• Phishing training for employees: how to run a program that changes behavior
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026