Every business has antivirus. Most ransomware incidents happen on machines that had antivirus installed, running and up to date. That is not because the product was bad. It is because the attacker was not using a file the product had ever seen, or was not using a file at all.
Endpoint detection and response, EDR, is the category that grew out of that failure. It is not a better signature database. It is a different job.
What antivirus does
Traditional antivirus scans files. When a file is written, opened or executed, the engine compares it against signatures of known malware and, in newer products, against heuristics that flag suspicious structure. If it matches, the file is quarantined. The decision happens at the moment of the scan and is mostly about the file.
That model works against commodity malware: mass-mailed trojans, cracked software bundles, infected downloads. It struggles when the attacker builds a fresh payload for you, packs it so the signature does not match, or never drops a file because they are using tools already on the machine: PowerShell, WMI, certutil, PsExec, the built-in backup deletion commands.
- Strength: cheap, quiet, catches the bulk of what arrives by email and download.
- Weakness: no memory of what happened before the detection. If it misses the first step, you learn about the incident from the ransom note.
What EDR adds
EDR records what processes do: what they spawn, which files they touch, which network connections they open, which registry keys they change, which credentials they access. That record streams to a console where rules and analysts look for chains of behavior rather than individual bad files. Word launching PowerShell which downloads something and creates a scheduled task is a chain, and the chain is suspicious even if every individual piece is a legitimate Windows binary.
Because the record exists, an EDR alert comes with a story: this process, started by this user, from this parent, at this time, did these things. And because the agent is always connected, you can act from the console: isolate the machine from the network while leaving it reachable for investigation, kill a process tree, pull a file, run a script.
- Behavioral detection: catches living-off-the-land techniques and fresh malware that no signature covers.
- Timeline: shows the first step, not just the last one, so you know what else the attacker touched.
- Remote isolation: one click to cut a machine off from everything except the EDR console. This is the single most useful feature in a live incident.
- Tamper protection: the agent resists being disabled by a local admin, which is the first thing ransomware operators try.
Real products and what to enable
Microsoft Defender for Endpoint is included in Microsoft 365 Business Premium (Plan 1) and E5 (Plan 2), which means many small businesses already own an EDR and have not turned it on. CrowdStrike Falcon, SentinelOne, Sophos Intercept X and Huntress are the other names you will meet, each with different pricing and management models.
Whichever you choose, the product is only as good as its configuration. The defaults are cautious to avoid false positives. Tighten them.
- Onboard every device, including servers. An EDR that covers workstations but not the domain controller is watching the wrong door.
- Turn on tamper protection. In Defender: Microsoft Defender portal > Settings > Endpoints > Advanced features > Tamper protection.
- Enable cloud-delivered protection and set the cloud block level to High via Intune or Group Policy.
- Enable Attack Surface Reduction rules in block mode after a period in audit mode.
- Set automated investigation and remediation to Full so the platform quarantines without waiting for a human.
- Confirm someone receives the alerts and will act on them at 2 a.m. An EDR nobody watches is an expensive antivirus.
# Confirm Defender for Endpoint sensor state on a Windows device
Get-Service -Name Sense | Select-Object Status, StartType
Get-MpComputerStatus | Select-Object AMRunningMode, IsTamperProtected, RealTimeProtectionEnabledThe part that is not software
EDR generates alerts, and alerts need a person. A managed detection and response service, MDR, is the layer where a security operations team watches the console around the clock, triages the noise, and isolates a machine at 3 a.m. before the encryptor runs. Most small businesses cannot staff that, which is why EDR is usually bought bundled with MDR.
When you evaluate a provider, ask the practical questions. Who sees the alert? How fast do they respond? Are they allowed to isolate a machine without calling you first? What do you get after an incident: a report, a timeline, or a phone call?
- Ask for the escalation path in writing. Names, hours, phone numbers.
- Ask what the service does with a confirmed detection at night. 'We email you' is not a response.
Frequently asked questions
Do I need both antivirus and EDR?
Every modern EDR includes the antivirus engine, so you run one agent. Defender for Endpoint sits on top of the built-in Defender Antivirus; the other vendors ship their own engine. Running two vendors' agents on the same machine causes conflicts and is not recommended.
Is EDR overkill for a company with twenty computers?
The attackers who hit twenty-computer companies use the same tools as the ones who hit large enterprises. If you have Microsoft 365 Business Premium you already own Defender for Endpoint Plan 1; the work is turning it on and putting someone on the alerts.
Will EDR slow down our machines?
Modern agents are light. The heavier cost is false positives in the first weeks, which is why rules go into audit mode before block mode. RackLedge tunes exclusions for line-of-business software as part of onboarding rather than leaving the defaults.
Takeaway
Antivirus asks whether a file is known to be bad. EDR asks what is happening on the machine, keeps the answer, and lets you cut the machine off from anywhere. That second job is the one that turns a ransomware attempt into an isolated laptop instead of an encrypted network, but only if the product is configured tightly and someone is watching it.