The Acronym Soup
The endpoint security market loves three-letter acronyms:
- AV — Antivirus
- NGAV — Next-Generation Antivirus
- EDR — Endpoint Detection and Response
- MDR — Managed Detection and Response
- XDR — Extended Detection and Response
Vendors have used these terms in overlapping and confusing ways. Here is a working definition for each.
Antivirus (AV)
The traditional model. The agent on the endpoint:
- Scans files on access or on schedule.
- Matches them against a signature database.
- Quarantines or deletes matches.
Modern AV products also include some heuristic and behavioural detection. Suitable for: home users, small offices, low-risk environments. Roughly the cost of a coffee per device per year.
Next-Generation Antivirus (NGAV)
Marketing term for AV with machine learning and behavioural analytics added. Most "modern AV" today is really NGAV. The hard line between AV and NGAV blurred years ago.
Endpoint Detection and Response (EDR)
Adds continuous telemetry and investigation capability:
- Records every process start, network connection, file write, and registry change.
- Streams this telemetry to a central platform.
- Allows analysts to search history ("show me everywhere this hash ran in the last 90 days").
- Provides response actions — isolate a host, kill a process, roll back changes.
EDR shifts the value from prevention only to prevention + visibility + rapid response. Critical when prevention fails, which it always eventually does.
Suitable for: small-medium organisations with at least one part-time security responsibility, anyone handling sensitive data.
Managed Detection and Response (MDR)
EDR + a 24/7 team of analysts watching it for you. The vendor handles initial triage and response; your team handles containment and remediation.
Suitable for: organisations that have EDR but lack the in-house expertise or coverage to monitor it around the clock. Cost: significant — but cheaper than building a 24/7 in-house SOC.
Extended Detection and Response (XDR)
EDR plus telemetry from other security layers — email, identity, cloud workloads, network — correlated into a single investigation view.
The promise: instead of separately investigating "user clicked a phishing email", "an unusual OAuth grant", and "a strange file appeared on the laptop", XDR ties all three into one attack story.
Suitable for: medium-large organisations already using multiple security tools who want to reduce alert fragmentation.
Which Do You Actually Need?
| You are | You need |
|---|---|
| A home user | A reputable AV / NGAV product |
| A small business (< 50 staff) | NGAV at minimum; EDR if you handle financial or personal data |
| A regulated business (healthcare, finance, legal) | EDR — usually mandated |
| A larger org with no in-house security expertise | MDR |
| A larger org with a SOC and multi-tool stack | XDR (or build it from existing tools) |
A Common Mistake
Buying expensive EDR or XDR without the people and processes to use it. The agent will dutifully record everything — but if no one is watching the console, the value is roughly zero. Budget the people before the licence.
Conversely: do not skimp on tooling and then expect overworked staff to defend with nothing. The sweet spot is a tool sized to the team that runs it.