What's the difference between EDR and MDR?
Short answer
EDR (endpoint detection and response) is software on each computer that watches for suspicious behavior and can stop it. MDR (managed detection and response) adds people: a security team that monitors those alerts around the clock, investigates, and responds. EDR is the tool; MDR is the tool plus the team watching it.
Draft · pending expert review
Traditional antivirus looks for known bad files. Modern attacks often don't use files at all, which is why EDR and MDR exist.
EDR
Records what's happening on each computer and flags or blocks behavior that looks like an attack, such as encrypting files en masse or running suspicious scripts.
MDR
EDR generates alerts. MDR is a 24/7 team that triages those alerts, investigates the real ones, and takes action, like isolating a computer, even at 3am on a holiday.
Which do you need?
If nobody is watching the alerts overnight and on weekends, EDR alone leaves a gap. For most growing organizations, MDR is the right answer, and many cyber insurers now expect it.