MDR vs EDR vs XDR: what does a small business actually need?

Most small businesses without their own security team need MDR (managed detection and response): a team of analysts who watch your systems around the clock and act on threats for you. EDR and XDR are tools for investigating attacks, and they are only worth having if someone in your business has the time and skills to use them. If you do have that person, EDR covers your devices and XDR extends the same view to your firewall, email, cloud and identity systems.

That's the short answer. The rest of this guide explains what each one does in practice, so you can check it against your own business.

The short version

Start with the basics: antivirus

Modern antivirus does far more than it used to. It blocks malware and ransomware as they try to run, and cleans up after itself. For many attacks, that's the end of the story: the threat is stopped and nobody needs to do anything.

What antivirus can't tell you is what happened before it stepped in. If something got close, you don't know how it arrived, whether it touched anything else, or whether the attacker is still there. That's the gap the next three fill.

EDR: the tools to investigate

EDR stands for endpoint detection and response. An endpoint is any device: a laptop, a desktop or a server.

EDR keeps a searchable history of what each device did: which programs ran, which files changed and which network connections were made. When something suspicious turns up, you can trace it back. How did it get in? What did it touch? Is it on any other device?

It also gives you ways to respond, such as cutting a device off from the network while you investigate, or connecting to it remotely to fix it.

The important word is you. EDR is a toolkit. It's very good at answering questions, but someone has to ask them. If nobody in your business has the time, or an alert lands on a Friday night and waits until Monday, you have the information but not the response.

EDR suits you if you have an in-house IT person, or an IT provider, who wants to investigate incidents directly.

XDR: seeing across your systems

XDR stands for extended detection and response. It does everything EDR does, and adds what your other systems can see: your firewall, your email, your cloud services and your user accounts.

That matters because attacks rarely stay in one place. A typical one might start with a phishing email, move on to a stolen password and a sign-in from somewhere unusual, and only then reach a laptop. Each of those steps on its own might not look worth an alert. XDR puts them side by side, so they read as one attack rather than four unrelated events.

Like EDR, XDR is a set of tools. It shows you more, but someone on your side still has to look.

XDR suits you if your IT team looks after several security products, possibly from different vendors, and wants to investigate across all of them in one place.

MDR: someone else doing the watching

MDR stands for managed detection and response. It isn't a different kind of software. It's the same visibility as XDR, with a team of security analysts watching it for you, 24 hours a day, every day of the year.

When something suspicious happens, they investigate it. If it's a real threat, they contain it, for example by isolating the affected device so the attack can't spread. You get a call or a report, not a raw alert to work out for yourself. They also go looking for attackers who haven't set off an alert yet, which is known as threat hunting.

Some MDR services, including the MDR Plus tier we offer, go further and carry out the full incident response: removing the threat completely and finding the root cause.

MDR suits you if you don't have a security team, which is most small businesses.

The deciding factor

Attackers know when offices are empty. Sophos's 2026 Active Adversary Report, drawn from 661 real incidents its response teams handled, found that 88% of ransomware was launched outside the victim's business hours. The busiest four hours were between 11pm and 3am.

They don't need long, either. In the same report, attackers who got in reached the system that controls every user account in a median of just 3.4 hours. An alert that waits until morning, let alone until Monday, has given them far more time than they need.

Ignore the acronyms for a moment and ask one question: if an alert went off at 2am on a Saturday, who would deal with it?

• If the honest answer is "nobody", you need MDR. EDR or XDR would collect the evidence, but nothing would stop the attack.
• If you have an IT person or provider who responds during working hours, EDR or XDR gives them good tools. Think about what happens outside those hours, though.
• If you have your own security team on call, EDR or XDR may be all you need. Many teams still add MDR for nights and holidays.

What it costs

Prices vary by provider and by how many people you protect. We publish ours. At TriplePoint, per user per month, excluding VAT:

• AV-only: from £6
• EDR: from £9
• XDR: from £10
• MDR: from £13
• MDR Plus (with full incident response): from £23

Each level includes everything in the one below it, all on the same platform and the same monthly invoice. You can work out a monthly price for your own numbers with our calculator.

The gap between EDR and MDR is a few pounds per user. The gap between having someone watching and not having anyone is much bigger, which is why we recommend MDR for most small businesses.

How to choose, in three questions

1. Who would respond to an alert out of hours? If nobody, choose MDR.
2. Does someone in your business want to investigate incidents themselves? If yes, and they have the time, EDR is a good fit.
3. Do you run several security tools, such as a firewall and email filtering, and want one view across them? If yes, look at XDR, or MDR if you'd rather someone else did the looking.

Still not sure? Tell us a bit about your business and we'll recommend a level. If you'd rather start small, you can begin with one tier and move up later without reinstalling anything.

< Back to Guides