Endpoint Protection Services That Watch Back

Antivirus, EDR, and MDR in plain language

The endpoint security industry has stacked three acronyms on top of each other, and vendors blur them on purpose. The distinctions matter because they determine what happens at 2 a.m. when something malicious runs on the bookkeeper’s laptop.

Traditional antivirus matches files against signatures of known malware — a wanted-poster approach that misses anything new or modified. EDR (endpoint detection and response) watches behavior instead: process trees, registry changes, credential access, file-encryption patterns. It catches novel threats and, crucially, can respond — kill the process, roll back changes, cut the machine off the network. But EDR generates alerts, and alerts need a human. MDR (managed detection and response) is EDR plus the people: someone actually investigates every detection and takes action, around the clock.

Why Defender alone is a tool, not a strategy

Microsoft Defender is a legitimately capable engine — it scores well in independent AV-TEST and MITRE ATT&CK evaluations. The problem is operational, not technical. On unmanaged machines, Defender’s detections go to a local notification the user dismisses. Nobody correlates a suspicious PowerShell alert on one laptop with a credential-theft alert on another twenty minutes later — which is exactly what the early stage of a real intrusion looks like. Exclusions accumulate (a line-of-business vendor says “just exclude the whole C: drive” and someone does), tamper protection gets left off, and there is no central record that all fifteen machines are even running current definitions. Detection without anyone watching is a smoke alarm in an empty building.

The ransomware chain, and where endpoint tools break it

Ransomware is not a single event; it is a sequence, and each stage is an interception point:

1. Initial access — a phishing attachment, a malicious download, or an exposed RDP login. Email filtering and DNS filtering work here; on the endpoint, behavioral detection flags the macro spawning PowerShell.
2. Privilege escalation — the attacker moves from a user account to admin rights, often by dumping credentials from memory (the LSASS process). EDR treats credential-dump behavior as a high-severity detection regardless of what tool performs it.
3. Lateral movement — hopping machine to machine over SMB or remote management tools, locating servers and backups. Unusual internal connection patterns and remote-execution behavior trip alerts; isolating the first machine here ends the incident.
4. Encryption — the visible finale, usually launched at night or on a weekend. Anti-ransomware modules detect mass file modification within seconds, kill the process, and isolate the host; some platforms roll encrypted files back from local shadow copies.

The economics favor early interception: caught at stage one, the incident is a fifteen-minute cleanup on one laptop; at stage four, it is a business-continuity event even when backups work.

Coverage: which devices actually need an agent

The honest answer is every device that touches company data, with different treatment by class. Windows and Mac laptops and desktops all get full EDR — including the owner’s home machine if it holds company files. Servers matter most of all, since they are the ransomware target, yet they are the machines most often found running nothing because “nobody browses the web on them.” Phones and BYOD devices generally do not need EDR agents; the risk there is data access, better handled through mobile device management or app-protection policies that enforce a screen lock and allow remote wipe of company data without touching personal photos. The device you forget — the old PC running the door controller, the conference-room machine — is the one attackers find.

Hygiene controls that multiply the value of EDR

• Patch management. Most exploited vulnerabilities are ones a patch already existed for. A managed cadence — OS updates on a tested schedule, third-party apps like Chrome and Adobe Reader updated automatically, with compliance reporting — removes the attack surface EDR would otherwise have to defend.
• Application allowlisting. Instead of blocking known-bad software, only approved software runs. Aggressive for laptops, but excellent for servers and single-purpose machines where the software list never changes.
• USB device control. Policies that block unknown storage devices or force read-only access close off both malware introduction and quiet data exfiltration via thumb drive.
• Local admin removal. Users running as standard users, with admin elevation available on request, blunts stage two of the chain above at zero licensing cost.

What isolation looks like when something fires

On a high-confidence detection, the agent cuts the machine’s network access — no file shares, no internet, no lateral movement — while keeping a management tunnel open so we can investigate remotely. The user sees a machine that is off the network, not a ransom note. We then establish what ran, how it arrived, and whether credentials were touched; remediate; and release the machine, usually within hours. Compare that with the unmanaged version of the same event, where the first symptom anyone notices is that the shared drive won’t open.

Frequently asked questions

What does “next-gen antivirus” actually mean?

Mostly marketing shorthand for “behavioral detection with machine-learning models instead of pure signatures” — the detection half of EDR without necessarily the response tooling. When a vendor says next-gen, the useful questions are concrete: can it isolate a host remotely, can it roll back ransomware changes, does it record process history for investigation, and who reviews its alerts?

Will an EDR agent slow down our computers?

Modern agents (SentinelOne, CrowdStrike, Defender for Business and similar) typically sit at 1–3% CPU and a few hundred MB of RAM — unnoticeable on any machine from the last five or six years. When users complain about a “slow security tool,” the culprit is usually two overlapping products fighting each other, which is why we remove the old antivirus rather than layer on top of it.

Our staff use their own laptops. Can you protect those?

Yes, with a conversation first. Options range from installing the full agent on personal machines (with the owner’s written consent), to restricting company data to browser sessions protected by conditional access, to issuing inexpensive company laptops — which, at current hardware prices, is often cheaper than the risk management around BYOD.

If we have good backups, is endpoint protection still necessary?

Backups address one outcome (encrypted files) of one attack type. They do nothing about stolen data — modern ransomware crews exfiltrate before encrypting and extort on the threat of publication — nor about credential theft, mailbox compromise, or the week of downtime a full restore takes. Backups are the last layer, not a substitute for the ones in front.