--- title: 'MDR vs EDR vs XDR: What Does a Small Business Need?' url: 'https://triplepoint.org.uk/guides/mdr-vs-edr-vs-xdr' markdown: 'https://triplepoint.org.uk/guides/mdr-vs-edr-vs-xdr.md' date: '2026-10-28' description: 'MDR vs EDR vs XDR explained for UK small businesses: what each does, who it suits, what it costs, and the one question that decides which you need.' --- # MDR vs EDR vs XDR: What Does a Small Business Need? ![](https://triplepoint.org.uk/user/pages/guides/mdr-vs-edr-vs-xdr/mdr-vs-edr-vs-xdr.jpg) **Most small businesses without their own security team need MDR (managed detection and response): a team of analysts who watch your systems around the clock and act on threats for you.** EDR and XDR are tools for investigating attacks, and they are only worth having if someone in your business has the time and skills to use them. If you do have that person, EDR covers your devices and XDR extends the same view to your firewall, email, cloud and identity systems. That's the short answer. The rest of this guide explains what each one does in practice, so you can check it against your own business. ## The short version | | What it covers | Who does the work | Best for | |---|---|---|---| | **Antivirus** | Blocks known and suspicious malware on each device | The software, automatically | A baseline every business needs | | **EDR** | A detailed record of what happened on each device, and tools to investigate | You or your IT provider | Businesses with an IT person who wants to investigate | | **XDR** | Everything in EDR, joined up with firewall, email, cloud and identity | You or your IT provider | IT teams running several security tools | | **MDR** | Everything in XDR, watched 24/7 by security analysts | A specialist team, for you | Businesses without their own security team | ## Start with the basics: antivirus Modern antivirus does far more than it used to. It blocks malware and ransomware as they try to run, and cleans up after itself. For many attacks, that's the end of the story: the threat is stopped and nobody needs to do anything. What antivirus can't tell you is what happened before it stepped in. If something got close, you don't know how it arrived, whether it touched anything else, or whether the attacker is still there. That's the gap the next three fill. ## EDR: the tools to investigate EDR stands for **endpoint detection and response**. An endpoint is any device: a laptop, a desktop or a [server](https://triplepoint.org.uk/security/devices/server-protection). EDR keeps a searchable history of what each device did: which programs ran, which files changed and which network connections were made. When something suspicious turns up, you can trace it back. How did it get in? What did it touch? Is it on any other device? It also gives you ways to respond, such as cutting a device off from the network while you investigate, or connecting to it remotely to fix it. The important word is **you**. EDR is a toolkit. It's very good at answering questions, but someone has to ask them. If nobody in your business has the time, or an alert lands on a Friday night and waits until Monday, you have the information but not the response. **EDR suits you if** you have an in-house IT person, or an IT provider, who wants to investigate incidents directly. ## XDR: seeing across your systems XDR stands for **extended detection and response**. It does everything EDR does, and adds what your other systems can see: your firewall, your email, your cloud services and your user accounts. That matters because attacks rarely stay in one place. A typical one might start with a phishing email, move on to a stolen password and a sign-in from somewhere unusual, and only then reach a laptop. Each of those steps on its own might not look worth an alert. XDR puts them side by side, so they read as one attack rather than four unrelated events. Like EDR, XDR is a set of tools. It shows you more, but someone on your side still has to look. **XDR suits you if** your IT team looks after several security products, possibly from different vendors, and wants to investigate across all of them in one place. ## MDR: someone else doing the watching MDR stands for **managed detection and response**. It isn't a different kind of software. It's the same visibility as XDR, with a team of security analysts watching it for you, 24 hours a day, every day of the year. When something suspicious happens, they investigate it. If it's a real threat, they contain it, for example by isolating the affected device so the attack can't spread. You get a call or a report, not a raw alert to work out for yourself. They also go looking for attackers who haven't set off an alert yet, which is known as threat hunting. Some MDR services, including the MDR Plus tier we offer, go further and carry out the full incident response: removing the threat completely and finding the root cause. **MDR suits you if** you don't have a security team, which is most small businesses. ## The deciding factor Attackers know when offices are empty. Sophos's [2026 Active Adversary Report](https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report), drawn from 661 real incidents its response teams handled, found that **88% of ransomware was launched outside the victim's business hours**. The busiest four hours were between 11pm and 3am. They don't need long, either. In the same report, attackers who got in reached the system that controls every user account in a median of **just 3.4 hours**. An alert that waits until morning, let alone until Monday, has given them far more time than they need. Ignore the acronyms for a moment and ask one question: **if an alert went off at 2am on a Saturday, who would deal with it?** - **If the honest answer is "nobody"**, you need MDR. EDR or XDR would collect the evidence, but nothing would stop the attack. - **If you have an IT person or provider who responds during working hours**, EDR or XDR gives them good tools. Think about what happens outside those hours, though. - **If you have your own security team on call**, EDR or XDR may be all you need. Many teams still add MDR for nights and holidays. ## What it costs Prices vary by provider and by how many people you protect. We publish ours. At TriplePoint, per user per month, excluding VAT: - **AV-only:** from £6 - **EDR:** from £9 - **XDR:** from £10 - **MDR:** from £13 - **MDR Plus** (with full incident response): from £23 Each level includes everything in the one below it, all on the same platform and the same monthly invoice. You can [work out a monthly price](https://triplepoint.org.uk/security) for your own numbers with our calculator. The gap between EDR and MDR is a few pounds per user. The gap between having someone watching and not having anyone is much bigger, which is why we recommend MDR for most small businesses. ## How to choose, in three questions 1. **Who would respond to an alert out of hours?** If nobody, choose MDR. 2. **Does someone in your business want to investigate incidents themselves?** If yes, and they have the time, EDR is a good fit. 3. **Do you run several security tools, such as a firewall and email filtering, and want one view across them?** If yes, look at XDR, or MDR if you'd rather someone else did the looking. Still not sure? [Tell us a bit about your business](https://triplepoint.org.uk/contact?about=MDR%20vs%20EDR%20vs%20XDR) and we'll recommend a level. If you'd rather start small, you can begin with one tier and move up later without reinstalling anything. ## Questions Can we start with EDR and move to MDR later?+Yes. With us, every level runs on the same platform, so moving up is a change to your account rather than a new installation. You can start with the tools and add the 24/7 team when you need it. Is MDR overkill for a business with ten people?+Not usually. Attackers don't pick targets by size, and a small business is less likely to have anyone watching out of hours. MDR is priced per user, so a ten-person business pays for ten users, not for a security team. Do we still need our IT provider if we have MDR?+Yes, for everything that isn't security monitoring: setting up users, fixing printers, installing updates. MDR covers watching for attacks and responding to them. Does Microsoft Defender count as EDR?+Some Microsoft business plans include EDR features, so you may already have the tools. The question is still who looks at the alerts. Sophos MDR can work with Microsoft Defender if it's already on your devices. Where to go next- [Endpoint detection & response (EDR)](https://triplepoint.org.uk/security/detect-and-respond/edr) - [Extended detection & response (XDR)](https://triplepoint.org.uk/security/detect-and-respond/xdr) - [24/7 managed detection & response (MDR)](https://triplepoint.org.uk/security/detect-and-respond/mdr) - [Compare our five protection tiers and prices](https://triplepoint.org.uk/security#protection-tiers) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [How Much Does Cyber Security Cost a UK Business?](https://triplepoint.org.uk/guides/managed-cyber-security-cost-uk.md) - Next: [Microsoft 365 Account Hacked? What to Do Next](https://triplepoint.org.uk/guides/microsoft-365-account-hacked.md)