The five terms at a glance
| Term | Stands for | What it is | Who runs it | Best for |
|---|---|---|---|---|
| Antivirus | (none) | Malware prevention using signatures and, in many products, behaviour analysis | The software, automatically | An important prevention layer |
| EDR | Endpoint Detection and Response | Records and detects suspicious activity on laptops and servers | Your team, or a provider | Businesses with someone to act on alerts |
| XDR | Extended Detection and Response | EDR plus email, cloud, identity and network signals in one view | Your team, or a provider | Larger estates with mixed systems |
| SOC | Security Operations Centre | A security operations function that monitors, investigates and coordinates response | In-house or outsourced | Organisations needing a dedicated security function |
| MDR | Managed Detection and Response | A service that runs the tooling and responds on your behalf | An external provider | Businesses without a security team |
| MSSP | Managed Security Service Provider | A broader outsourced security function, often including MDR | An external provider | Organisations outsourcing security wholesale |
MDR vs EDR: what is the difference?
EDR records endpoint activity and provides detection and response functions. MDR adds people and processes to operate agreed tooling and investigate alerts. Ask which systems are covered, the staffed response hours, and whether the service can isolate a device or disable an account without waiting for your approval. An unattended alert queue leaves a gap even when the technology is capable.
EDR vs XDR
EDR watches endpoints: your laptops and servers. XDR takes the same idea and pulls in signals from email, cloud services, identity and the network, then correlates them so one attack across several systems shows up as one story rather than five disconnected alerts. XDR suits larger, mixed estates. The actual coverage depends on the connected products and telemetry. Compare supported data sources and response actions rather than assuming that two packages with different labels cover the same threats.
MDR vs SOC
A SOC is a security operations function; its staff may work in one location or remotely. MDR is one way to obtain managed investigation and response without building the entire capability yourself. A SOC is not automatically staffed 24/7, and an MDR subscription does not automatically include every incident response activity. Coverage, escalation and response authority belong in the service agreement.
MDR vs MSSP
The terms overlap, and providers use them loosely. In practice MDR is focused: detect threats and respond to them. An MSSP is broader and may also manage firewalls, patching, email security and compliance. MDR is often one service inside a wider managed security relationship. The question to ask a provider is not which label they use, but exactly what they monitor and what they will do when something fires.
EDR vs antivirus: is antivirus enough?
Modern antivirus can combine signatures, reputation and behaviour-based protection. EDR adds investigation telemetry and response capabilities. Neither guarantees that attacks using stolen identities or legitimate administration tools will be prevented. Review endpoint protection alongside identity, email, patching and the people handling alerts. The NCSC’s logging and monitoring guidance (opens in new tab) explains the operational work behind detection.
For the wider baseline, see the NCSC’s 10 Steps to Cyber Security (opens in new tab) and our cyber security services. Detection is one part of the protection and recovery plan.
Which does your business need?
- No security team, and you want threats handled: MDR.
- A capable IT team who can act on alerts: EDR, or XDR for a larger estate.
- A regulated or high-stakes environment needing 24/7 cover: MDR or an outsourced SOC.
- You are outsourcing security wholesale: an MSSP that includes MDR.
Our published fully managed managed IT plan includes endpoint and identity MDR. Co-managed and separately scoped services follow their agreed schedule. Check the pricing and inclusions, including the distinction between continuous monitoring and contracted human response hours.
Common questions
What is MDR in cyber security?
Managed Detection and Response is a service in which a provider operates agreed detection tooling, investigates alerts and takes or coordinates response actions. The contract defines systems covered, staffed hours, escalation and authority to act.
Is MDR better than EDR?
They serve different roles. EDR provides endpoint detection, investigation and response capabilities; MDR supplies an operating service around agreed tooling. The right choice depends on whether your own team can investigate and respond within the hours you need.
Do I still need a SOC if I have MDR?
You may not need to build a separate in-house SOC if the MDR service covers your requirements. You still need someone in your organisation to own security decisions and coordinate business response. Larger organisations may use MDR alongside their own SOC.
Is antivirus enough on its own?
Antivirus is one part of protection. Modern products can detect behaviour as well as known malware, but endpoint software alone does not cover every identity, email or cloud risk. Pair the tools with appropriate configuration, monitoring and response.