In short
EDR vs XDR vs MDR comes down to scope and people. EDR is software that detects and responds to threats on endpoints. XDR extends detection across endpoints, email, identity, cloud and network in one platform. MDR is a service in which a vendor's or provider's analysts use EDR or XDR tools to investigate and respond for you.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The short definitions
- EDR (endpoint detection and response) is an agent on laptops and servers that records what happens on the device, detects suspicious behaviour and lets you respond, for example by isolating the machine or rolling back changes. It goes beyond traditional antivirus (endpoint protection, or EPP), which mainly tries to block known-bad files; see EDR vs antivirus.
- XDR (extended detection and response) takes the same idea across more than one layer. It correlates signals from endpoints, email, identity, cloud apps, cloud workloads and sometimes the network into a single incident, so an analyst sees one attack rather than twenty unrelated alerts.
- MDR (managed detection and response) is not a product but a service. A security operations centre watches your EDR or XDR telemetry, investigates, hunts for threats and takes agreed response actions.
Put simply: EDR and XDR are what you see with; MDR is who is looking. Our guides to endpoint detection and response and extended detection and response go deeper into the technology, and our MSSP site explains how managed detection and response (opens in a new tab) services work and how to choose one.
Side-by-side comparison
| EDR | XDR | MDR | |
|---|---|---|---|
| What it is | Software (agent and console) | Software platform | A service delivered by people |
| Main data source | Endpoints and servers | Endpoints plus email, identity, SaaS, cloud and network | Whatever EDR or XDR tools the service runs on |
| Who responds | Your IT or security team | Your IT or security team, with more automation | The provider's analysts, within limits you agree |
| Out-of-hours cover | Only if you staff it | Only if you staff it | Part of the service; hours and scope set by the provider |
| Typical strength | Deep visibility on devices, ransomware rollback on some products | Cross-domain correlation, faster investigation | Expertise and response when you are not watching |
| Main limitation | Blind to identity and cloud attacks that never touch a device | Still needs skilled people to act on it | Only as good as the telemetry and response authority it has |
| Examples | CrowdStrike Falcon Insight XDR, SentinelOne Singularity, Cisco EDR, Microsoft Defender for Endpoint (opens in a new tab) | TrendAI Vision One, GravityZone XDR, Microsoft Defender XDR (opens in a new tab), Cisco XDR (opens in a new tab) | Sophos MDR (opens in a new tab), CrowdStrike Falcon Complete Next-Gen MDR, WatchGuard MDR, Bitdefender MDR, Wayfinder MDR |
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Where SIEM, SOAR and MXDR fit
Three more terms come up in the same conversations:
- SIEM (security information and event management) collects and stores logs from almost anything (firewalls, servers, SaaS apps, identity providers) and runs detection rules over them. It is broader than XDR but needs more set-up, tuning and people. Microsoft Sentinel (opens in a new tab) is one cloud SIEM; our XDR guide compares XDR vs SIEM.
- SOAR (security orchestration, automation and response) runs playbooks automatically when certain alerts fire, such as disabling an account and opening a ticket. Many XDR and SIEM platforms now include it.
- MXDR (managed XDR) is MDR delivered on an XDR platform, so the service covers identity, email and cloud rather than just endpoints. Many MDR services now take in identity, email and cloud signals as well as endpoints, which makes them MXDR in practice; our MSSP site covers managed XDR (opens in a new tab).
Log retention is often the deciding factor. Regulators, insurers and incident responders may ask what happened weeks or months ago, which is beyond what many EDR tools keep by default. If you need long retention or compliance reporting, a SIEM, or an MDR service that includes one, is worth the extra cost.
What a small business needs
For most organisations with up to a few hundred staff and no dedicated security team, the practical answer is EDR plus MDR:
- Start with a solid EDR, or the EDR you already own. Microsoft 365 Business Premium includes Microsoft Defender for Business (opens in a new tab), which is a reasonable starting point for many small businesses; our EDR for small business guide covers the alternatives.
- Make sure identity and Microsoft 365 are monitored as well, because account takeover is a common way in.
- Add an MDR service so that alerts are acted on at night and at weekends.
- Back it up with tested backups and a written response plan, as our guide to preventing ransomware attacks explains.
Buying XDR or a SIEM without the people to run it usually produces a console that nobody looks at. Cyber Essentials does not require EDR or MDR, but its malware protection and patching controls are easier to evidence with them; see Cyber Essentials requirements (opens in a new tab).
Weighing up the options?
We can compare them against your own requirements and recommend what fits.
What a mid-sized organisation needs
Organisations with several hundred to a few thousand users, multiple cloud platforms or regulated data usually need XDR plus MDR, and sometimes a SIEM as well:
- XDR so that phishing, identity, endpoint and cloud events are joined into one incident
- MDR or MXDR so that a security operations centre works those incidents out of hours, even if you have an internal security person during the day
- SIEM when you have significant non-Microsoft infrastructure, compliance logging requirements or a need for long retention
- Specialist layers where the risk justifies them, such as identity threat detection and response (opens in a new tab), proactive threat hunting or a dedicated anti-ransomware layer like Halcyon (opens in a new tab)
If you are unsure where you stand, we can map your current tools against these layers and show where the gaps are.
How we help you decide
We supply several EDR and XDR platforms and the vendors' own managed services, so we can recommend the combination that fits rather than one vendor's answer. We look at the licences you already own (often more than you think, particularly in Microsoft 365), the people you have and how you want alerts handled, then suggest the most cost-effective mix of EDR, XDR, SIEM and MDR. Licensing detail is on our EDR, XDR and MDR software (opens in a new tab) pages; pricing is always "ask us for a quote".
Contact us for a view on which you need.
How we help with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos, Check Point, TrendAI and Cisco
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials (opens in a new tab) and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
Is XDR better than EDR?
XDR covers more than EDR, because it correlates endpoint data with email, identity, cloud and sometimes network signals. That is only better if someone uses it. For a small organisation, a well-run EDR with an MDR service often delivers more protection than an XDR platform nobody monitors.
Does MDR replace EDR?
No. MDR is a service that runs on top of EDR or XDR tools. The MDR provider either supplies the agent as part of the service or works with the EDR you already own.
Is Microsoft Defender an EDR or an XDR?
Both, depending on the product. Microsoft Defender for Endpoint and Defender for Business are EDR. Microsoft Defender XDR is the platform that joins endpoint, email, identity and cloud app signals into unified incidents in the Defender portal.
What is the difference between XDR and SIEM?
XDR is built around a vendor's own security tools and comes with ready-made correlation and response. A SIEM ingests logs from almost any source and is more flexible, but needs more tuning, storage and expertise. Many organisations use both, and the two are converging.
What is MXDR?
MXDR, or managed extended detection and response, is MDR delivered on an XDR platform. The service monitors identity, email and cloud signals as well as endpoints.
Do I need MDR or XDR?
They answer different questions. XDR is technology that correlates signals across endpoint, identity, email and cloud. MDR is a service where people monitor and respond for you, often using XDR tools. Organisations without their own out-of-hours security cover usually need MDR, delivered on whichever EDR or XDR platform they own.
Can MDR use my existing EDR?
Often, yes. Several MDR services work with Microsoft Defender, CrowdStrike or other EDR tools you already own, such as WatchGuard Open MDR, while others run only on the vendor's own agent. Replacing a working agent just to buy a service is rarely the cheapest route.
Still deciding?
Ask us and a member of our team will get back to you.