EDR or antivirus: why classic antivirus is no longer enough for an SMB

All our new clients have an antivirus. Almost all of them have already had an incident despite it. Not because antivirus is bad: because it answers a threat from fifteen years ago. Here is the concrete difference with an EDR, and why we no longer sign a managed services contract without one.

What an antivirus does

It compares files against a database of known malicious programs, with a few heuristics on top. It blocks what has already been seen elsewhere very well. It does not see an unknown program, a PowerShell script launched by a legitimate user, or an attacker using Windows’ own tools, which is what most modern ransomware does.

What an EDR adds

An EDR, Endpoint Detection and Response, watches the behaviour of each device continuously: processes launched, network connections, file changes, privilege escalations. It spots an abnormal chain of actions, a Word file launching PowerShell that encrypts documents, even when none of the components is known.

Above all, it acts:

• Isolation of the device from the network in one click, or automatically, to stop spread to the servers.
• Rollback: some EDRs undo a ransomware’s changes and restore encrypted files from shadow copies.
• Investigation: full timeline of the attack, originating device, triggering email, accounts used. Without it, you clean up without understanding, and the attacker comes back.
• Monitoring: alerts land in a console our team watches around the clock, with a response within minutes, not on Monday morning.

The typical case

Friday, 10 pm, a salesperson opens an attachment received that afternoon on their laptop. The antivirus does not react, the file is new. The EDR detects encryption in progress at the third file, isolates the laptop, alerts our on-call engineer. On Monday, the salesperson gets a restored machine. The servers were never touched. Without EDR, the same scenario ends with 200 encrypted endpoints and two weeks of downtime, as in the cases described in our ransomware article.

MDR: EDR with humans behind it

An EDR with nobody reading the alerts is an expensive antivirus. MDR, Managed Detection and Response, adds a team that triages, investigates and responds. That is the form we offer: the tool, plus our monitoring, plus a response-time commitment written into the contract.

What it costs

Count 40 to 90 dirhams per endpoint per month depending on vendor and service level, monitoring included. A 30-seat SMB protects its whole fleet for less than the cost of a single day of downtime. Details are in our pricing guide.

Where to start

1. Inventory of endpoints and servers, including leadership laptops, often forgotten.
2. Deploy the EDR agent, silent for the user, replacing the antivirus.
3. Two weeks of learning, then enable automated responses.
4. Integrate with the FortiGate or WatchGuard firewall to block at network level what the endpoint detected.

All of it fits in a month, with no interruption, as part of our business cybersecurity offer.