EDR or antivirus: why classic antivirus is no longer enough for an SMB

Most SMBs we audit have antivirus on their devices, and many have still suffered an incident: a hijacked mailbox, an infected laptop, encrypted files. Not because antivirus is bad, but because it was designed for an older threat: known, catalogued malicious programs. Today’s attackers work around that logic. Here is the concrete difference between antivirus and EDR, how to choose, how to roll it out, and why we no longer sign a managed services contract without one.

What an antivirus does

It compares files against a database of known malicious programs, with a few heuristics on top. It blocks what has already been seen elsewhere very well. It struggles with a brand-new program, a PowerShell script launched by a legitimate user, or an attacker using Windows’ own administration tools, a common technique in modern ransomware. In those cases no single file is “malicious” in the signature sense: it is the sequence of actions that is.

Antivirus still has a role as a useful first barrier. But it is no longer enough as the only protection for devices and servers.

What an EDR adds

An EDR, Endpoint Detection and Response, watches the behaviour of each device continuously: processes launched, network connections, file changes, privilege escalations. It spots an abnormal chain of actions, a Word file launching PowerShell that encrypts documents, even when none of the components is known.

Above all, it acts:

• Isolation of the device from the network in one click, or automatically, to stop spread to the servers.
• Blocking and remediation: killing the malicious process, removing dropped files; some EDRs can also undo a ransomware’s changes on the device.
• Investigation: full timeline of the attack, originating device, triggering email, accounts used. Without it, you clean up without understanding, and the attacker comes back.
• Monitoring: alerts land in a console our team watches around the clock, with critical incidents handled in under 15 minutes, not on Monday morning.

Antivirus, EDR, MDR compared

Criterion	Classic antivirus	EDR	MDR (monitored EDR)
Detection method	Signatures and heuristics	Behaviour analysis	Behaviour analysis plus human review
Brand-new threats	Often missed	Detected by their actions	Detected and qualified
Response	File quarantine	Isolation, blocking, remediation	Same, triggered and followed up by a team
Post-incident investigation	Almost none	Full timeline	Timeline analysed, written report
Who reads the alerts	The user, sometimes	Your team, if it has time	A dedicated team, 24/7
For whom	A complement, never alone	SMBs with an available IT team	Most SMBs

The typical scenario

On a Friday evening, a salesperson opens an attachment received that afternoon on their laptop. The antivirus does not react, the file is new. The EDR detects encryption from the very first files, isolates the laptop and alerts our on-call engineer. On Monday, the salesperson gets a rebuilt machine, with documents restored from backup. The servers were never touched. Without EDR, the same scenario can end with encrypted servers and several days of downtime, as in the cases described in our ransomware article.

The scenario also shows that EDR does not replace backup: it limits the damage, backup lets you recover. The two go together, with an immutable copy out of attackers’ reach, as we explain in why your backups must be immutable.

MDR: EDR with humans behind it

An EDR with nobody reading the alerts is an expensive antivirus. An alert at night or over the weekend that nobody handles gives the attacker all the time they need. MDR, Managed Detection and Response, adds a team that triages, investigates and responds. That is the form we offer: the tool, plus our 24/7 monitoring, plus a response-time commitment written into the contract.

How to choose a solution

Several criteria matter more than the brand:

• Coverage: Windows and macOS devices, servers, and ideally laptops that roam outside the company network.
• Available responses: isolation, process termination, remediation, and whether they can be triggered automatically or manually.
• Firewall integration: a compromised device should also be blockable at network level. With WatchGuard, ThreatSync correlates detections from the EDR and the Firebox; with Fortinet, FortiEDR and FortiClient integrate with the FortiGate in the Security Fabric.
• The console: readable, with reports leadership can understand.
• The service around it: who monitors, at what hours, with what written response time.

On cost, compare offers on an equal scope, monitoring included: a bare EDR licence and a 24/7 MDR service are not comparable. The factors that drive the price of managed IT are covered in our pricing guide.

EDR, XDR: should you go further?

You will also come across XDR, Extended Detection and Response. The idea is to correlate signals from several sources, devices, firewall, email, identities, to reconstruct an attack that moves from one to another. For an SMB, the order of priorities stays simple: first an EDR on every device and server, monitored 24/7; then correlation with the firewall, often available from the same vendor; finally, depending on your exposure, adding email and Microsoft 365 or Google Workspace accounts. A well-tuned EDR that is genuinely monitored beats a full XDR platform whose alerts nobody works on.

Where to start

1. Inventory endpoints and servers, including leadership laptops, often forgotten, and machines that never come into the office.
2. Deploy the EDR agent remotely, silent for the user, replacing the antivirus.
3. Observation period to learn normal usage and avoid false alerts on business software.
4. Enable automated responses, one group of devices at a time.
5. Integrate with the firewall, FortiGate or WatchGuard, to block at network level what the endpoint detected.
6. Write the procedure: who is alerted, who decides to isolate a server, how restoration works.

The mistakes we fix most often

1. An EDR bought, installed, and whose alerts nobody reads.
2. Forgotten devices: leadership laptops, shop-floor machines, old servers, which become the way in.
3. Overly broad exclusions added to “make” a business application work, blinding the EDR on entire folders.
4. Automated responses never enabled, for fear of blocking a device.
5. Users with local admin rights, able to disable the agent.
6. No link with MFA: EDR protects devices, but a stolen Microsoft 365 account signs in from elsewhere. See rolling out MFA in an SMB.

Checklist before choosing an EDR

• Complete inventory of devices, laptops and servers to cover.
• Operating systems supported by the solution.
• Available responses and whether they can be automated.
• Integration with your firewall and email.
• 24/7 monitoring included, with a response time written into the contract.
• Incident procedure written down and known to leadership.
• Immutable, tested backup alongside it.
• Admin rights removed from users.

How we deploy it

We start with a free audit of your fleet and current protection, then deploy EDR in place of the antivirus, with no interruption to work. Alerts feed into our 24/7 monitoring, with critical incidents handled in under 15 minutes and a monthly report leadership can read. Examples of security projects, without client names, are in our case studies.

If you are still choosing an antivirus for your devices, our guide business antivirus in Morocco: how to choose compares the options and explains when to move to EDR.

All of it is part of our business cybersecurity offer. To review how your devices are protected, contact us: we reply within 24 business hours.