EDR stands for endpoint detection and response. It is software that runs on your laptops, desktops and servers (the "endpoints"), watches what happens on them, spots behaviour that looks like an attack, and gives someone the tools to investigate and stop it.
If that sounds like antivirus, it overlaps, but the difference matters. This guide explains what EDR actually does, how it fits with antivirus and managed services, and how to decide whether your business needs it. It is written for owners and office managers of UK businesses with roughly 10 to 250 people, not security specialists.
Why antivirus on its own is no longer enough
Traditional antivirus is built to stop malicious files: it checks what is about to run against known bad software and blocks it. Modern antivirus (often called next-generation antivirus, or NGAV) adds machine learning so it can catch new malware that has never been seen before. That is still essential, and it is what Cyber Essentials asks for.1
The problem is that many attacks do not use malware. An attacker who has phished a password, or bought one, can log in as a real user and use tools already built into Windows, such as PowerShell or remote desktop. The NCSC calls this "living off the land", and notes it lets attackers operate discreetly, with malicious activity blending in with legitimate system and network behaviour.2 CrowdStrike reports that 82% of the detections it saw in 2025 were malware-free.3 That figure comes from one vendor's own data, but the direction is widely recognised.
Antivirus has nothing to block in those cases, because nothing it would recognise as malicious is being run. EDR is designed for exactly this gap.
What EDR actually does
An EDR product has three jobs.
1. Record
A small agent on each device records activity: which processes started, what launched them, which files they touched, which network connections they made, which accounts logged in. This telemetry is sent to a cloud console and kept for a period, so there is a history to look back through.
2. Detect
The EDR looks across that activity for patterns that suggest an attack, rather than just known bad files. Examples:
- Microsoft Word starting PowerShell, which then downloads something from the internet.
- A user account suddenly querying every machine on the network.
- A process trying to delete Windows backup copies (shadow copies), a common step before ransomware.
- A tool reading saved passwords from memory.
When it sees something like this, it raises an alert, often with a severity rating and a visual "process tree" showing how the activity unfolded.
3. Respond
This is the part antivirus lacks. From the console, someone can:
- Contain (isolate) a device, cutting it off from the network while keeping it connected to the console so it can be investigated.
- Kill a process or quarantine a file.
- Look back through the recorded activity to see where an attack started and which other devices it touched.
- In many products, open a remote shell to examine or fix a machine without visiting it.
Speed is the reason this matters. CrowdStrike measures "breakout time", the time from an attacker's initial access to moving onto another system, and reports an average of 29 minutes for criminal intrusions in 2025.3 Being able to isolate a laptop in minutes, from anywhere, is very different from waiting for someone to walk over and pull the network cable.
EDR, NGAV, MDR and XDR: the jargon decoded
| Term | What it means | Who acts on it |
|---|---|---|
| Antivirus / NGAV | Blocks malicious files and code from running | Mostly automatic |
| EDR | Records device activity, detects suspicious behaviour, provides tools to investigate and contain | You or your IT provider |
| Threat hunting | People proactively searching your EDR data for signs of attack that did not trigger an alert | The hunting team finds it, you act |
| MDR (managed detection and response) | A 24/7 security team monitors your EDR, investigates alerts and takes response actions for you | The provider |
| XDR (extended detection and response) | EDR plus data from other sources, such as email, identity and cloud apps, correlated in one place | Varies |
Most good endpoint products today combine NGAV and EDR in one agent, so you rarely have to choose between them. The real decision is about who watches the alerts. Our MDR explained guide goes into that side.
The catch: someone has to act on the alerts
EDR is a tool, not a service. It will tell you that something suspicious happened at 2am on Saturday. It will not, on its own, decide whether that was your IT provider running a script or an attacker, and it will not ring anyone.
Before buying EDR, answer honestly:
- Who receives the alerts? You, your office manager, your IT provider? Is it in their contract?
- What happens out of hours? Attackers do not keep office hours.
- Does that person know what a process tree is? EDR consoles are powerful but assume some security knowledge.
- Who is allowed to isolate a device? Agree this in advance so nobody hesitates.
If the answers are uncomfortable, that does not mean EDR is pointless. It means you should pair it with someone who watches it: your IT provider if they offer security monitoring, or an MDR service. Only 25% of UK businesses have a formal incident response plan,4 so working this out before an incident puts you ahead of most.
Does a small business need EDR?
There is no legal rule that says you must have EDR. Cyber Essentials does not require it.1 So the question is about risk and about who is asking.
Signs you should have it
- You hold sensitive or valuable data: client files, personal data, financial records, designs.
- You move money, or your staff can approve payments. Attackers target these businesses directly.
- Your insurer, a large customer or a framework asks for it. In a government-backed study, 65% of insured SMEs said they had to meet specific security requirements to get cover, and endpoint protection was among the measures businesses put in place.5 See what UK cyber insurers ask about EDR, MFA and backups.
- You could not work for a week without your systems. Most businesses that rely on computers fall in this group.
- You have remote or hybrid staff, so devices spend time outside any office network protection.
The scale of the threat is not theoretical: 43% of UK businesses reported a breach or attack in the previous 12 months, rising to 65% of medium businesses.4
When basic protection may be enough
A very small business with a handful of devices, little sensitive data, everything in well-secured cloud services, good backups and multi-factor authentication everywhere may decide that well-configured antivirus is a reasonable level for now. That is a legitimate decision, as long as it is a decision rather than something nobody thought about.
You may already have EDR
Check what you already pay for before buying anything.
- Microsoft 365 Business Premium includes Microsoft Defender for Business, which includes next-generation protection, attack surface reduction, EDR and automated investigation and remediation, for organisations up to 300 users.6 It is a good product. If you have it, make sure every device is actually onboarded and that someone is looking at the alerts.
- Microsoft 365 E3 includes Defender for Endpoint Plan 1, which has next-generation protection but not EDR. EDR is in Plan 2.6
- Your IT provider may already deploy an EDR product as part of their managed service. Ask them which product, who monitors it and what hours.
If you are comparing options, our CrowdStrike vs Microsoft Defender for Business guide sets out the differences fairly.
What to look for when choosing EDR
- Protection and detection together: NGAV and EDR in one agent, so you do not run two products that fight each other.
- Platform coverage: Windows, Mac and, if you have them, Linux servers.
- Independent assessment: industry evaluations are a reasonable signal, read with care. For example, CrowdStrike and Microsoft were both named Leaders in Gartner's Magic Quadrant for Endpoint Protection Platforms (Microsoft in 2025, CrowdStrike in 2026).78
- Remote isolation and response that works wherever the laptop is.
- Clear alerting to email or your IT provider's ticket system, not just a console nobody opens.
- A route to 24/7 cover, either built in or as an upgrade, for when you need it.
- Deployment and update control. After the July 2024 CrowdStrike outage, which Microsoft said affected about 8.5 million Windows devices,9 it is reasonable to ask any vendor how updates are tested and staged. CrowdStrike published a root cause analysis and the changes it made.10
Where Coffee Cyber fits
Coffee Cyber sells CrowdStrike Falcon to UK SMEs on a monthly, per-device basis. Every plan includes NGAV and EDR. On the Defend plan, alerts go to you or your IT provider to act on; Defend Plus adds CrowdStrike's 24/7 threat hunting; Complete adds CrowdStrike's own managed response team, who investigate, contain and remove threats for you. See plans and managed response for details.
Whichever product you choose, the principle is the same: EDR is worth having when someone will act on what it finds.
NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf ↩ ↩
NCSC, NCSC and partners issue warning about state-sponsored cyber attackers hiding on critical infrastructure networks (February 2024). https://www.ncsc.gov.uk/news/ncsc-and-partners-issue-warning-about-state-sponsored-cyber-attackers-hiding-on-critical-infrastructure-networks ↩
CrowdStrike, 2026 Global Threat Report findings (February 2026). https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/ ↩ ↩
DSIT, Cyber Security Breaches Survey 2025/2026 (April 2026). https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 ↩ ↩
DSIT and Grant Thornton, Insuring Resilience: the state of SME cyber insurance (2025). https://assets.publishing.service.gov.uk/media/6891e704f15b237bf6610956/Insuring_Resilience_-_The_state_of_SME_cyber_insurance.pdf ↩
Microsoft Learn, Microsoft Defender for Business frequently asked questions. https://learn.microsoft.com/defender-business/mdb-faq ↩ ↩
Microsoft, Microsoft is named a Leader in the 2025 Gartner Magic Quadrant for Endpoint Protection Platforms (July 2025). https://www.microsoft.com/en-us/security/blog/2025/07/16/microsoft-is-named-a-leader-in-the-2025-gartner-magic-quadrant-for-endpoint-protection-platforms/ ↩
CrowdStrike, CrowdStrike named a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms. https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-named-leader-2026-gartnerr-magic-quadranttm-endpoint ↩
TechCrunch, Microsoft says 8.5M Windows devices were affected by CrowdStrike outage (July 2024). https://techcrunch.com/2024/07/20/microsoft-says-8.5m-windows-devices-were-affected-by-crowdstrike-outage/ ↩
CrowdStrike, Channel File 291 root cause analysis. https://www.crowdstrike.com/en-us/blog/channel-file-291-rca-available/ ↩
Common questions
Is EDR the same as antivirus?
No. Antivirus tries to stop malicious files from running. EDR also records what happens on each device and looks for suspicious behaviour, so it can spot attacks that do not use malware at all and lets someone investigate and contain them.
Do I already have EDR with Microsoft 365?
If you have Microsoft 365 Business Premium, yes: it includes Defender for Business, which has EDR. Microsoft Defender for Endpoint Plan 1, included in Microsoft 365 E3, does not include EDR.
Who looks at the EDR alerts?
That depends on the service. With plain EDR, alerts go to you or your IT provider to act on. With MDR, a security team watches and responds around the clock for you.
Is EDR required for Cyber Essentials?
No. Cyber Essentials requires malware protection, which standard anti-malware software can meet. EDR goes further than the baseline.
Protect every device from £6.50 a month
CrowdStrike Falcon for UK businesses. Sign up online, no contract, no sales calls. Your Falcon console is created for you and the installer is ready as soon as it is.