When the antivirus reports success, yet no one can say what actually happened

A typical Monday morning in any company: The antivirus software reports that it has removed a malicious file from the accounting department’s laptop. Status: green, check mark, done. Two questions later, things get uncomfortable. How did the file end up on the device? And was it perhaps also on the eleven other devices that received the same email during the same time period?

This is
precisely where the concepts represented by the three acronyms EDR, XDR, and MDR come into play. They don’t stand for three competing products, but rather for three complementary solutions to the same security gap. This article explains what the terms mean, where the lines between them are drawn, which level suits which starting point, and what you need to look for in a product offering so you don’t end up paying for features you can’t use.

Why can’t traditional antivirus software tell you what happened after an attack?

Because it isn’t designed to do so. An endpoint protection product—that is, traditional antivirus software with behavioral analysis, a firewall, and a web filter—is designed to prevent an attack. If it succeeds, the case is closed from its perspective. A log entry is recorded—timestamp, filename, action—but not the sequence of events that led to that file.

The difference can be summed up in one sentence: Antivirus detects; EDR reconstructs. After an incident, you don’t need to know that something was blocked. You need the chain of events leading up to and following it. Which process wrote the file? Was a macro executed beforehand? Did the computer connect to an unknown address afterward? And most importantly: Did the same sequence of events occur on other devices as well, but without triggering a detection there because the file had been slightly modified?

Without logging, you’ll answer these questions with “we don’t know for sure.” That’s the moment when many companies, just to be safe, reinstall all their devices—not because it’s necessary, but because they can’t rule it out.

What does EDR stand for, and what does an EDR agent actually record?

EDR stands for Endpoint Detection and Response. The agent continuously logs system activity: which process started which other process, which files were written to or renamed, which registry keys were modified, and which network connections were established. This log is stored in the management console and remains available even long after the triggering event has ended.

This results in three functions that are crucial in day-to-day operations. Root cause analysis displays the chain as a process tree: Outlook opens a document, the document launches PowerShell, and PowerShell loads a file. Kaspersky calls this root cause analysis; Bitdefender refers to it as cross-device detection and visualization; Sophos creates a threat case in Sophos Central.

The second feature is retroactive searching across the entire infrastructure. You have a file hash or a domain from an alert and can query all devices simultaneously to see if it has ever appeared there before. At Kaspersky, this is called IoC Search; at WithSecure, Event Search; and at ThreatDown, Flight Recorder Search. In an emergency, this query replaces days of manual work.

The third feature is response from the console: isolate a device from the network, terminate a process, move a file to quarantine, or open a remote shell. Here, the products differ much more significantly than they do in detection. ThreatDown also offers the ability to roll back ransomware damage for up to seven days, while ESET Inspect allows remote PowerShell access to managed computers.

What are the ongoing operational costs of EDR that aren’t listed in any quote?

Work time. Antivirus software reports “removed,” while EDR reports “unusual—please check.” This isn’t a design flaw, but rather the intended purpose: The agent flags activities that look suspicious but aren’t definitively malicious. Someone has to read, evaluate, and resolve these alerts.

Realistically, it takes several hours per week until the policies and exceptions for your environment are set up—industry-specific software that runs scripts at runtime reliably generates false positives at first. After that, you’ll need a fixed time slot each day. If you can’t fill this role, you’re buying a log that’s valuable in an emergency but reaches no one in day-to-day operations. For this scenario, there are the managed options described below, and they’re usually more cost-effective than a larger license package that goes unused.

What is the difference between EDR and XDR?

XDR stands for Extended Detection and Response. It’s not the response that’s expanded, but the data set. In addition to endpoint telemetry, other sources feed into the same analysis: login events from the directory service, email and cloud events from Microsoft 365, firewall logs, and cloud workloads.

The reason is practical: A large portion of today’s incidents do not begin with malware, but with a valid password. Someone logging in with valid credentials does not initially trigger any alerts on the endpoint. It’s only the combination that raises a red flag—a login from an unusual country, followed shortly thereafter by a new forwarding rule in the mailbox, and then access to the file storage. Each signal on its own is unremarkable. It’s only when these are linked together that an incident is identified, and that’s exactly what XDR does.

How XDR is implemented technically varies by vendor. Bitdefender deploys sensors for identity, network, and productivity applications on Business Security Enterprise and calls the result Defense XDR. Sophos consolidates endpoint, server, firewall, email, and cloud data into a separate license tier. WithSecure’s Elements XDR covers endpoints, identity, Microsoft 365, and the cloud via a single agent. Kaspersky offers XDR as a separate edition above the EDR tiers. ESET positions Inspect as an XDR component with integration into SIEM and ticketing systems.

Is XDR worth it without your own security team?

Only under one condition: You must actually own the additional data sources, and currently, no one is systematically analyzing them. Those who use Microsoft 365, operate a Sophos firewall, and have been monitoring both separately so far will see tangible benefits. Those who have only on-premises devices and no cloud services are paying for sensors that have nothing to do.

The second point is often overlooked: XDR increases the value of alerts, but also their number and complexity. Without a designated team, the combination of EDR and a third-party monitoring service is generally more cost-effective than an XDR platform that no one is fully analyzing.

What exactly am I buying when I purchase MDR?

People and a shift. MDR stands for Managed Detection and Response and is not a technology, but a service: the vendor’s analysts monitor your alerts around the clock, review them, and take action themselves within the contractually agreed-upon scope.

The benefit is in terms of time, not functionality. Encryption attacks are typically launched at night, on weekends, and on holidays because that’s when no one is at their computer. An EDR alert at 2:00 a.m. that isn’t read until 8:00 a.m. wastes six hours—exactly the amount of time it typically takes for an attack to spread from the first device to the file server.

When making a selection, one question is paramount: Is the service provider authorized to take action, or only to call? This is reflected in the service tiers. Sophos distinguishes between MDR Essentials and MDR Complete. ESET offers PROTECT MDR for smaller organizations and MDR Ultimate with forensic support. Bitdefender distinguishes between MDR and MDR PLUS, with the higher tier additionally including dark web monitoring. With ThreatDown, managed detection and response is included starting with the Elite bundle.

ThreatDown Elite Corporate

View ThreatDown Elite Corporate ⧉

Elite corresponds to the Advanced bundle and supplements it with 24/7 managed detection and response by Malwarebytes analysts. For businesses without their own security team, this is the point at which a tool becomes a service. Servers are licensed separately with ThreatDown.

Is there an intermediate step between EDR and MDR?

Yes, and for medium-sized businesses, it’s often the right choice. Between “we do everything ourselves” and “we outsource everything,” there’s paid expert assistance on demand, without a full-service contract.

WithSecure has distinguished these levels most clearly. Elevate gives Elements EDR users access, when needed, to analysts who assess a specific incident and guide the response. The Co-Monitoring Service supplements your own team with round-the-clock monitoring, during which threat hunters review high-risk alerts and escalate confirmed incidents to your team. Only above that level is full MDR with its own response team. A similar model exists at ThreatDown, where managed threat hunting is already included in the Advanced bundle and reports critical findings, while the response service is only included starting with the Elite tier.

WithSecure Co-Monitoring Service

View the WithSecure Co-Monitoring Service ⧉

Ideal for organizations that operate an EDR deployment but cannot provide night and weekend coverage and still want to keep the response in-house.

WithSecure Elevate

View WithSecure Elevate ⧉

The smaller option: expert support for individual challenging cases, managed either through your assigned partner or directly by your own company. This makes sense if your IT team generally handles alerts on its own and only needs a second opinion for complex incidents.

How do antivirus, EDR, XDR, and MDR differ when compared side by side?

Two fields are intentionally left blank. With MDR, whether only endpoint data or also identity and cloud signals are managed depends on the scope of the subscription. A virus protection log is of limited use as evidence because it does not depict the sequence of events but merely lists individual detections.

Which level is appropriate for which situation?

The decision depends less on the number of employees than on who reviews alerts at your organization and how long a system outage would be tolerable.

Which companies are specifically subject to reporting requirements—and at what point large clients begin demanding proof—depends on the sector and company size—not on the chosen security level. This distinction goes beyond the scope of this topic.

What obligations apply starting at what company size?
Determine when reporting requirements, customer requirements, and documentation obligations actually take effect for a business.

Which EDR products are comparable, and how do they differ?

The packages that are comparable are those that actually include an EDR component and are intended for businesses without their own security center. The table compares them. Pure prevention packages such as Sophos Intercept X Essentials or ThreatDown Core are deliberately excluded because they do not include detection-and-response capabilities; neither are platforms for large security departments, such as the Kaspersky Anti Targeted Attack Platform, which serve a different target audience.

Regarding the open fields: With ESET, Inspect is a component whose scope depends on the selected PROTECT level—which additional features are included is therefore determined by the level and not by Inspect itself. Only Bitdefender publishes the telemetry retention period as a clearly defined module; for the other providers, it depends on the deployment type and agreement and is therefore included in the offer. Whether servers are licensed separately also varies: Sophos and ThreatDown list servers as separate items, while for the others it depends on the package and the ratio of servers to workstations.

Which product suits which need?

The recommendation is based on the specific situation, not the brand. Four typical scenarios:

Kaspersky Next EDR Optimum

View Kaspersky Next EDR Optimum ⧉

The tier at which the EDR component is actually included—along with patch management, encryption management, adaptive anomaly detection, and protection for Microsoft 365. Can be operated either from the cloud or on-premises. A good fit for businesses that want to bundle multiple modules into a single console instead of managing three separate products side by side.

Bitdefender GravityZone Business Security Enterprise

View Bitdefender GravityZone Business Security Enterprise ⧉

The tier featuring cross-device detection, investigation with one-click response, threat hunting, and the option to extend retention to 90, 180, or 365 days. Can be expanded to Defense XDR via sensors for identity, network, and productivity applications without changing the agent.

SOPHOS Central Intercept X Advanced with XDR

View SOPHOS Central Intercept X Advanced with XDR ⧉

Consolidates endpoint, server, firewall, email, and cloud data in Sophos Central. It offers the greatest value where a Sophos firewall and Microsoft 365 are already in use, as correlation then works without the need for additional integration.

ESET Inspect

View ESET Inspect ⧉

ESET’s detection-and-response
component, featuring API integration with SIEM, SOAR, and ticketing systems, as well as remote PowerShell access to managed computers. The right choice for environments that already perform centralized log analysis and want to collect alerts there instead of using yet another interface.

How long must the recorded data be retained?

At least as long as an attack could realistically remain undetected in your environment. This is the most commonly overlooked factor when making a purchase. If an incident isn’t detected until sixty days later, but the telemetry is only retained for thirty days, you’ve paid for EDR and still have no answer.

As a guideline: Thirty days cover a typical encryption incident, which becomes apparent quickly. For stealthy data access that no one notices immediately, ninety days or more is appropriate. With Bitdefender, the extension is a paid module available in 90-, 180-, and 365-day increments, starting with the Business Security Enterprise plan. Be sure to actively ask for this detail in every quote—it’s rarely included by default.

Does the management console have to run in the cloud, and are servers included in the license?

There are real differences in terms of where the service is hosted. ThreatDown is managed exclusively via the Nebula or OneView cloud consoles; installation in your own data center is not supported. Sophos Central is also a cloud-only service. Kaspersky Next EDR Optimum can be operated either from the cloud or on-premises, while Bitdefender and ESET offer on-premises installation in addition to cloud-based options. For organizations with location-specific requirements, this is a deal-breaker, not just a minor detail.

When it comes to servers, it’s worth taking a closer look at the product descriptions. Sophos and ThreatDown offer server licenses as separate products that must be ordered in addition to the workstation licenses. An EDR solution that excludes the file server misses the very device where the damage occurs—in an encryption attack, the server is the target, and the workstation is merely the means to get there.

SOPHOS Central Intercept X Advanced for Server with XDR

View SOPHOS Central Intercept X Advanced for Server with XDR ⧉

The server version at the same tier. If you’re protecting workstations with XDR, you should upgrade the servers to the same tier; otherwise, the chain breaks exactly where it matters most.

ThreatDown Advanced Corporate

View ThreatDown Advanced Corporate ⧉

EDR with ransomware damage rollback for seven days, patch management, and managed threat hunting that reports critical findings without requiring a full service contract. A separate version is available for servers.

Why do some products have “EDR” in their name even though they don’t include EDR?

Because product names are marketing terms, not descriptions of functionality. Here are three examples that regularly lead to mispurchases.

In Kaspersky’s official edition overview, the Endpoint Detection and Response feature is listed only for Next EDR Optimum. Next EDR Foundations includes root-cause analysis—that is, identifying the cause—but not the full EDR component with IoC search and guided response. Also available only starting with the Optimum edition: patch management, encryption management, adaptive anomaly detection, and protection for Microsoft 365.

Kaspersky Next EDR Foundations

View Kaspersky Next EDR Foundations ⧉

Nevertheless, it’s a useful package—but for a different purpose: robust protection with centralized management, vulnerability assessment, device and application control, and root-cause analysis. If you’re deliberately choosing not to use EDR analysis just yet, this is the right choice for you. If you’re looking for EDR in the stricter sense, go with Optimum.

The second case is Bitdefender: “Premium” sounds like the top tier, but according to the manufacturer’s comparison, it includes neither cross-device detection nor threat hunting. Both features are only available starting with Business Security Enterprise. “Premium” is the robust prevention tier with a sandbox and forensic analysis, not the detection-and-response tier.

Bitdefender GravityZone Business Security Premium

View Bitdefender GravityZone Business Security Premium ⧉

The right choice when prevention and sandbox analysis are required, but no one in-house will be evaluating alerts. If you need EDR later, you can switch to the Enterprise tier within the same console.

The third scenario involves Sophos: Without the “with XDR” designation, you’ll receive the prevention tier. The previous “with EDR” version has been reclassified as the XDR tier, which is why older quotes and current product names no longer match. When comparing two offers, check to make sure the same tier was actually used in the calculation.

In addition, there are simple name changes without any functional changes: ESET Inspect was formerly known as ESET Enterprise Inspector, and Malwarebytes’ business customer line has been marketed under the name ThreatDown since November 2023. If you search for the old names, you often won’t find the current products.

Can I add EDR to my existing antivirus protection?

Within the same vendor family, usually yes; across different vendors, practically never. Having two agents from different providers on the same device leads to performance issues and mutual interference, and in the event of a problem, each support team will refer you to the other.

Within a single vendor family, there are two options: upgrading to a higher package tier or adding an add-on module. Bitdefender offers the Detection and Response feature both as part of Business Security Enterprise and as a standalone product. In addition to its Next editions, Kaspersky also offers separate EDR products, some of which are add-ons that require a compatible base product. Which combination is permitted for your existing license depends on the base package—this must be clarified before ordering, otherwise you’ll end up purchasing a module that cannot be activated.

As a rule of thumb: Upgrading to a higher tier from the same vendor is almost always more cost-effective and easier to manage than using two different vendors side by side.

Whether an ordered item can be activated at all depends on its designation in the store. Which of these require an existing license is a separate issue.

Base, Base Plus, Add-On, or Renewal—what these terms mean
Explains how to interpret the package names in the store and which of them require an existing license.

Which base license does an MDR service require?

Almost always a specific one, and that significantly changes the cost calculation. According to its own service description, Sophos requires that Sophos XDR or the XDR Sensor be running on the managed devices. ESET requires the PROTECT Elite or Enterprise tiers for PROTECT MDR and MDR Ultimate. Bitdefender bases its managed services on GravityZone Business Security Enterprise.

Therefore,
an MDR price per device is never the total price. Always calculate the base license plus the service, and only then compare with offers from other providers. Otherwise, an offer that tacitly assumes the base license may appear inexpensive.

ESET PROTECT Elite

View ESET PROTECT Elite ⧉

The tier that already includes ESET Inspect and also serves as the foundation for the managed service. If you plan to use both, this option is more cost-effective than purchasing Inspect and basic protection separately.

How does EDR help with the reporting requirement in Switzerland?

Since April 1, 2025, Switzerland has had a mandatory reporting requirement for cyberattacks on critical infrastructure. The legal basis for this is the revised Information Security Act, together with the Cybersecurity Ordinance. This applies to government agencies and organizations as defined in Art. 74b of the Information Security Act (ISG), including energy and drinking water utilities, transportation companies, designated hospitals, cloud service providers, and data centers, as well as cantonal and municipal administrations. The ordinance provides for exceptions for smaller organizations and for attacks with minor impacts.

The deadline is short: An initial report must be submitted to the Federal Office for Cybersecurity within 24 hours of discovery; missing information can be provided within 14 days. For the initial report, you need to include details on the time of discovery, the type of attack, and the affected area. Without recorded telemetry, you’ll have to include your best guesses; with recorded data, you’ll provide timestamps, affected systems, and a detailed account of the sequence of events. The 14-day period for completing the report is precisely the time during which a retrospective search across the entire device inventory proves most valuable.

What these products cannot do: They cannot determine whether your organization is subject to reporting requirements, they do not fill out any forms, and they do not replace a designated responsible person or a well-rehearsed emergency response procedure. An EDR without defined responsibilities and without a tested reporting chain does not meet a single organizational requirement.

What does the NIS 2 Directive require, and what aspects of it does EDR cover?

For organizations with locations or customers in the European Union, the NIS 2 Directive is the governing standard. No single product ensures compliance, as the directive requires categories of measures rather than specific software. These include risk analysis and security policies, incident response, business continuity and backup management, supply chain security, vulnerability management, effectiveness assessment frameworks, training, as well as access control and multi-factor authentication.

This
supports incident response, vulnerability management (provided that vulnerability assessment and patch management are included), and access control at the device level. The tiered reporting system provided for in the guideline—an early warning within 24 hours, a report within 72 hours, and a final report within one month—is based on the same record-keeping requirements as the Swiss reporting obligation.

Not covered are backup and recovery, vendor management, employee training, self-assessment of effectiveness, and management accountability. Anyone seeking to address these points through endpoint software will not meet these requirements.

Companies headquartered in Switzerland with customers in the EU must comply with both sets of regulations simultaneously. A complete comparison is beyond the scope of this article and is available separately.

A Comparison of Cybersecurity Obligations in Switzerland and the EU
This article compares the Swiss reporting requirement with the requirements of the NIS 2 Directive and highlights where they differ.

What should buyers know about the regulatory assessments of Kaspersky?

Since Kaspersky products are mentioned in this article, this point is relevant to the topic. Since March 15, 2022, the German Federal Office for Information Security has been warning against the use of antivirus software from Kaspersky and recommending that such applications be replaced with alternative products. The rationale given is the need to trust a manufacturer’s reliability and ability to act, which is essential given the extensive access rights such software grants. The warning remains in effect and has been regulated in Germany since December 6, 2025, under Section 13 of the BSIG. In the United States, the Department of Commerce issued a ban in June 2024: New business has been prohibited since July 20, 2024; furthermore, as of September 29, 2024, signature and code base updates may no longer be provided there, and the Kaspersky Security Network may no longer be operated.

Kaspersky disputes this assessment. The company points out that it is run as a private, internationally active enterprise; that, according to its own statement, it is not obligated to disclose data to government agencies; and that it has had its transparency measures externally audited for years. It is taking legal action against the warning.

In
practical terms, this means that there is no corresponding official warning or sales restriction in Switzerland. Nevertheless, this issue becomes relevant in three scenarios: public sector contracts, corporate policies of international parent companies, and supplier questionnaires from major clients that inquire about the origin and location of the security software used. Anyone facing one of these scenarios should clarify the requirements before making a decision. Those who do not should decide, as with any other procurement, based on functionality, operating costs, and price.

Anyone
who needs a timeline of all official statements—for example, as a basis for an internal justification or a response to a supplier questionnaire—can find a detailed account elsewhere.

Overview
of Regulatory Warnings Regarding Kaspersky Summarizes which agencies have issued statements and when, what regulations remain in effect, and for which buyers this is relevant.

What Do EDR, XDR, and MDR Not Cover?

A significant portion of what matters in an emergency. None of these levels replaces a functioning data backup with tested recovery—and recovery determines the duration of downtime, not detection. Nor do they replace email protection at the inbox level, proper management of access rights, multi-factor authentication, or employee awareness training.

It therefore makes
sense to reverse the order: first, data backup with a restore test, multi-factor authentication, and up-to-date software; then EDR. Anyone who purchases EDR while their backup sits untested on a hard drive accessible via a network drive has deployed the more expensive product in the wrong place—encryption software will reliably find that drive.

How do I ultimately decide?

Antivirus software tells you whether something was blocked. EDR tells you how it got in and where else it might be. XDR answers the same question even if the attack began with a valid password rather than a file. MDR tells you who responds at three in the morning.

Therefore, don’t
ask which technology is the best, but rather what questions you’ll need to answer in an emergency and who in your organization can answer them. That determines the level of protection—and only then the vendor.