EDR, MDR, XDR, SOC and MSSP: what they are and which you need

The five terms at a glance

Term	Stands for	What it is	Who runs it	Best for
Antivirus	(none)	Signature-based malware blocking	The software, automatically	Baseline hygiene only
EDR	Endpoint Detection and Response	Records and detects suspicious activity on laptops and servers	Your team, or a provider	Businesses with someone to act on alerts
XDR	Extended Detection and Response	EDR plus email, cloud, identity and network signals in one view	Your team, or a provider	Larger estates with mixed systems
SOC	Security Operations Centre	A team and facility that monitors and responds around the clock	In-house or outsourced	Organisations needing 24/7 eyes
MDR	Managed Detection and Response	A service that runs the tooling and responds on your behalf	An external provider	Businesses without a security team
MSSP	Managed Security Service Provider	A broader outsourced security function, often including MDR	An external provider	Organisations outsourcing security wholesale

MDR vs EDR: what is the difference?

EDR is a tool. MDR is a service. EDR gives you the sensor and the alerts on your devices, but someone still has to read those alerts, decide what matters, and act at two in the morning. MDR is that someone. If you buy EDR without the people to run it, the alerts pile up unread, which is the most common way good tooling still ends in a breach.

EDR vs XDR

EDR watches endpoints: your laptops and servers. XDR takes the same idea and pulls in signals from email, cloud services, identity and the network, then correlates them so one attack across several systems shows up as one story rather than five disconnected alerts. XDR suits larger, mixed estates. For many smaller businesses, well-run EDR plus email and identity monitoring covers the same ground.

MDR vs SOC

A SOC is a team and a facility. MDR is a way to buy the outcome of a SOC without building one. Running your own SOC means hiring analysts, licensing tooling, and staffing a rota every hour of the year, which is realistic only at a certain size. MDR gives you the monitoring and response of a SOC as a service, which is why most SMEs choose it.

MDR vs MSSP

The terms overlap, and providers use them loosely. In practice MDR is focused: detect threats and respond to them. An MSSP is broader and may also manage firewalls, patching, email security and compliance. MDR is often one service inside a wider managed security relationship. The question to ask a provider is not which label they use, but exactly what they monitor and what they will do when something fires.

EDR vs antivirus: is antivirus enough?

Antivirus blocks known malware by matching it against a list of signatures. It is necessary and no longer sufficient. Modern attacks use stolen logins, legitimate tools and techniques that leave no file to scan, so nothing triggers the antivirus. EDR exists to catch the behaviour that antivirus misses, and to give you a record of what happened. Treat antivirus as the floor, not the ceiling.

Which does your business need?

• No security team, and you want threats handled: MDR.
• A capable IT team who can act on alerts: EDR, or XDR for a larger estate.
• A regulated or high-stakes environment needing 24/7 cover: MDR or an outsourced SOC.
• You are outsourcing security wholesale: an MSSP that includes MDR.

On our managed plans, MDR is included as standard rather than sold as an upsell, because detection without response is not security. If you are not sure what you already have, a short audit will tell you where the gaps are.