EDR, MDR and XDR, minus the jargon

The short answer

EDR (endpoint detection and response) is software on each computer and server that spots and stops suspicious activity. XDR (extended detection and response) is software that pulls signals from endpoints plus email, identity, cloud apps and sometimes the network into one console, so related alerts become one incident. MDR (managed detection and response) is not software at all: it is a service where a team of analysts watches your EDR or XDR alerts around the clock, investigates and takes action.

So the real question for most small businesses is not which acronym to buy. It is who will watch the alerts and act on them, especially at night and on weekends. If the answer is nobody, managed detection is usually worth paying for.

EDR: the sensor on every device

EDR replaces traditional antivirus. It records what happens on each device, detects attacker behavior and can isolate a machine with one click or automatically. Microsoft Defender for Business, CrowdStrike Falcon, SentinelOne and Sophos Intercept X are common examples.

EDR sees only endpoints. It will not notice a suspicious sign-in to Microsoft 365 from another country or a malicious inbox rule unless something else feeds it that information.

XDR: connecting the dots

XDR widens the view. Microsoft Defender XDR, for example, correlates signals from endpoints, email, identities and cloud apps into single incidents. A typical XDR incident might link a phishing email, the risky sign-in that followed, a new inbox rule and an unusual process on the user’s laptop.

• Benefit: fewer, richer alerts and faster investigations.
• Catch: it is still software. Someone has to review incidents and respond.
• Small business reality: if you run Microsoft 365 Business Premium, you already have many of the pieces. The work is onboarding every device and tuning policies.

MDR: people who respond

MDR providers run a security operations center (SOC) that monitors your alerts, decides which ones are real, investigates and either acts directly, such as isolating a laptop or disabling an account, or calls you with clear instructions. Microsoft’s own Defender Experts MDR service describes this model: analysts manage the incident queue around the clock, triage and investigate, and take action or guide your team through the response.

Many MDR services are built on top of a specific EDR or XDR product. Some bring their own agent. Either way, MDR is the people layer on top of the software layer.

How the three work together on a real alert

Say an attacker signs in to your bookkeeper’s account at 2 a.m. using a stolen password and an MFA prompt the bookkeeper approved by mistake.

1. XDR links the unusual sign-in location to a new inbox rule that hides messages about payments, and raises one high-severity incident.
2. EDR on the bookkeeper’s laptop shows a remote access tool was installed an hour earlier from a phishing link.
3. MDR analysts review the incident within minutes, disable the account, revoke its sessions, isolate the laptop and remove the rule.
4. At 8 a.m. you get a summary: what happened, what was done and what you need to do, such as resetting the password with the bookkeeper and warning the bank.

Without MDR, the same alert sits in a console until someone checks it in the morning, after the attacker has had six hours to send fake invoices.

Other acronyms you will see

• NDR (network detection and response) watches network traffic. Useful for businesses with significant on-premises networks; less important for cloud-first offices.
• SIEM (security information and event management) collects logs from many systems for search and correlation. Powerful, but expensive and labor-heavy for small businesses.
• SOC (security operations center) is the team, in-house or outsourced, that watches alerts. MDR is essentially a SOC you rent.
• MSSP (managed security service provider) is a broader term for a company that manages security tools, sometimes including MDR.

Not sure who is watching your alerts today? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and business continuity, with the next steps in order. It is yours to keep, with no obligation. Book your assessment.

When managed detection is worth paying for

Use these decision rules.

• You need it if nobody on staff reviews security alerts daily, attacks after hours would go unnoticed until morning, or your insurer or clients expect continuous monitoring.
• You need it if you handle regulated or high-value data, such as health records, legal files or large payments, where a few hours of attacker access is costly.
• You may not need it yet if the basics are missing. MFA, patching, EDR on every device and tested backups come first. MDR on top of a messy environment mostly generates alarms.
• You may manage without it if you have a capable internal IT person, automatic response is switched on, and you accept that overnight alerts wait until morning.

What MDR costs

Monitoring is labor, so it is the priciest part of security. Provider guides published in 2026 give rough ranges: Digacore’s budget guide puts premium managed security packages that include a SOC and MDR at about $225 to $350 per user per month, and Datapath prices security-forward managed IT with EDR or MDR at about $200 to $400 per user per month, with help desk included. Both are providers, and ranges vary widely by scope.

There can be an insurance upside. In 2024 the insurer Coalition said businesses using its MDR service, or certain MDR services from CrowdStrike and SentinelOne, could qualify for a premium credit of up to 12.5 percent. Ask your broker whether your carrier offers anything similar. Our cyber insurance requirements guide covers what carriers ask.

Questions to ask an MDR provider

1. Which EDR or XDR product do you use, and who owns the licenses if we leave?
2. Do your analysts take action themselves, such as isolating a device or disabling an account, or only notify us?
3. What are your response times for critical alerts, at night and on weekends?
4. Do you cover Microsoft 365 or Google Workspace identity and email, or only endpoints?
5. Is incident response included, or billed separately if a real attack happens?
6. What do monthly reports show, and who explains them in plain English?
7. How do you work with our existing IT person or provider?

A practical path for a small business

1. Get the basics in place: MFA, patching, tested backups.
2. Deploy EDR on every device and turn on automatic response.
3. Connect email and identity signals, which Microsoft 365 Business Premium makes easier.
4. Decide who watches alerts. If it is nobody, add MDR.

JLB USA’s cybersecurity services cover endpoint protection, email security and monitored backups for businesses with roughly 25 to 100 employees, and we can help you decide whether managed detection makes sense for your risk and budget.

Keep reading

• Password manager for business: how to choose one and roll it out
• Vulnerability scan vs penetration test: what is the difference and which do you need?
• EDR vs antivirus: what is the difference and which does a small business need?
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026