EDR, MDR, ITDR and SIEM explained: why antivirus is no longer enough

For about twenty years, business cyber security had a settled answer: a firewall at the edge and antivirus on the machines. It was a reasonable answer, because attacks were mostly files, malicious programs trying to get through a perimeter and run, and both tools are good at stopping files.

That is not what attacks look like any more. The typical successful attack on a business today does not smash through the firewall. It logs in. A phished password, a stolen session token, an MFA prompt approved at the wrong moment, and the attacker is inside using the same legitimate tools your own staff use, often for days or weeks before doing anything visible. Antivirus scans for known-bad software and finds none, because there is none. The firewall inspects the perimeter while the attacker is already past it. Neither tool is broken. The problem they were built to solve is no longer the main problem.

That is the honest reason for the alphabet soup, EDR, MDR, ITDR, SIEM, that now fills security marketing. Each layer exists because attackers moved, and each answers a question antivirus cannot. Here is what they actually do, without the vendor pitch.

EDR: watching behaviour, not just files

Endpoint Detection and Response is the direct successor to antivirus, and the difference is in the first word of each. Antivirus asks "is this file known to be bad?" EDR asks "is this device behaving badly?" It watches what actually happens on laptops, desktops and servers: processes spawning processes, tools being used in ways staff never use them, encryption suddenly running across thousands of files. Because it watches behaviour, it catches attacks that involve no malware at all, which is now most of them.

The Response half matters as much as the Detection half. When EDR sees something wrong, it can isolate the device from the network in seconds, containing an attack to one machine instead of letting it become an organisation-wide incident. Antivirus deletes a file. EDR stops an attack in progress. That is the categorical difference.

ITDR: because attackers log in more than they break in

If EDR watches devices, Identity Threat Detection and Response watches accounts, and the case for it is one sentence long: your identity is now your perimeter. Email, files, finance systems and line-of-business apps all live in the cloud behind a login, so the login is what attackers target, and a compromised account looks superficially like a working member of staff.

ITDR looks for the tells: sign-ins from impossible locations, MFA fatigue attacks where a user is bombarded with prompts until one gets approved, session tokens being replayed from unfamiliar machines, inbox rules quietly created to hide an attacker's correspondence, privileges escalating without a change request. That last group is worth dwelling on, because a malicious inbox rule is the signature move of payment-fraud attacks, and no antivirus product on earth would ever see it. Nothing was installed. Someone just logged in.

Email security: the front door, still

Most attacks start in the inbox, which makes email filtering the least glamorous and most cost-effective layer in the whole stack. Modern email security is a long way past spam: it is scanning links and attachments in a sandbox before delivery, spotting impersonation attempts where a display name says your finance director but the address does not, and authenticating your own domain with DMARC so criminals cannot send convincing email as you to your customers and suppliers. The inbox is where the phished password that defeats everything else gets phished. Defending it well makes every other layer's job easier.

SIEM: the layer that sees the whole picture

Security Information and Event Management is the hardest one to explain and the easiest to justify. Every system you run, devices, identity platform, email, firewall, cloud apps, produces logs. A SIEM collects them in one place, keeps them, and correlates them, which matters because real attacks are only visible as patterns across systems: a suspicious sign-in here, an unusual file access there, an inbox rule created ten minutes later. Each event alone looks like noise. Together they are an intrusion, and only a system that sees all three can say so.

The unglamorous benefits are just as real. When something does happen, the logs are the difference between knowing exactly what an attacker touched and guessing. And increasingly, insurers, auditors and frameworks expect centralised logging as evidence of a monitored environment, so the SIEM quietly becomes part of your compliance and insurance story as well as your security one.

MDR: the layer that makes the others real

Here is the uncomfortable truth about everything above: tools do not watch themselves. EDR, ITDR and SIEM generate detections and alerts, and a detection nobody reads at 2am on a Saturday is worth exactly nothing, because that is precisely when attackers prefer to work. Managed Detection and Response is not another product. It is humans, a security operations capability watching the tools around the clock, triaging the noise, investigating the signals, and acting on the real ones while you are asleep.

For most small and mid-sized organisations this is the decisive layer, because the alternative is not "we'll watch it ourselves", it is "nobody is watching". Buying detection tools without a response capability is buying smoke alarms for a building with no fire brigade. The alarm will sound beautifully while everything burns. This is what we provide as managed defence: the layers above, plus the people who never stop watching them.

It is also why we stopped treating these layers as optional extras. Ryan Scott, our Central Services Team Leader and Cyber Specialist, explains the decision: "We made a strategic decision years ago that every PrimaryTech client has EDR and MDR by default. Quite simply, the risk of not having those solutions was as high for us as for the customer, and we want our clients to be safe by default. The thing most often misunderstood is the cost: EDR and MDR are low cost, and far lower than the cost of what can happen without them."

What to build first, honestly

Almost no organisation deploys all of this at once, and the sensible order is unfashionably consistent. Email security and identity protections first, because the inbox and the login are where attacks begin and these layers are cheap relative to what they prevent. EDR on every device second, because behaviour-based detection with the ability to isolate a machine is the single biggest upgrade over antivirus available. Managed response wrapped around both as early as possible, because unwatched tools are theatre. SIEM as the estate and the obligations grow, when correlation, retention and evidence start earning their cost.

If you hold or are pursuing Cyber Essentials, none of this replaces it and it does not replace this: certification proves the fundamental controls are in place, and the detection stack is what watches for the attacks that get past fundamentals. We covered what certification involves in our Cyber Essentials guide; the two are the floor and the alarm system of the same building.

Where to start

If you are not sure what your current provider or antivirus product actually covers from the list above, that is worth finding out precisely, because "we have security software" and "someone would notice an attacker inside our systems on a Saturday night" are very different claims. Ask us for a plain-English review of your current stack against these layers: what you have, what is watching it, and what the honest gaps are. No alphabet soup in the findings, just the same language as this article.

Frequently asked questions

Is antivirus enough for a business?

Not any more. Antivirus detects known malicious files, but most successful attacks on businesses now involve stolen credentials and legitimate tools rather than malware, which antivirus cannot see. It remains a sensible baseline layer, but on its own it defends against the previous decade's attacks.

What is the difference between EDR and antivirus?

Antivirus checks files against known threats. EDR monitors the behaviour of devices, detects attacks that use no malware at all, and can respond by isolating a compromised machine in seconds. The shift is from recognising bad files to recognising bad behaviour and acting on it.

What is MDR and do I need it if I have EDR?

MDR, Managed Detection and Response, is a human security operation watching your detection tools around the clock and responding to what they find. EDR without anyone watching it is an alarm nobody hears; for organisations without a 24/7 in-house security team, which is almost all of them, MDR is what turns detection tools into actual protection.

Does a small business need a SIEM?

Not usually first. Email security, identity protection, EDR and managed response deliver more protection per pound for most small organisations. A SIEM earns its place as the estate grows, or when insurers, auditors or frameworks require centralised logging and evidence of monitoring.