Many companies have antivirus installed on every computer and feel safe. But investigations of ransomware attacks often show that the attacker was on the network for days, working with ordinary Windows tools, and the antivirus either raised no alert or nobody saw it. That is where the difference between antivirus and EDR matters.
What Does Traditional Antivirus Do?
Antivirus compares files against a list of known malware signatures and uses simple behavioral methods to flag suspicious files as well. This layer is still necessary and stops a large share of common malware. Its weakness is that it focuses mostly on “files”: if an attacker logs in with a stolen password and uses tools such as PowerShell or legitimate remote software, there is nothing to compare against the list.
What Does EDR Add?
EDR (Endpoint Detection and Response) goes beyond checking files and continuously records and analyzes system behavior:
- Full visibility: Which process launched which other process, where it connected and which files it changed.
- Behavioral detection: Patterns such as rapid encryption of many files, attempts to steal passwords from memory or deleting Shadow Copies.
- Response: Isolating an infected computer from the network through the console, stopping a process and, in some products, rolling back changes.
- Post-incident investigation: The ability to see where an attack started and how far it reached.
What About Microsoft Defender?
Current versions of Windows include Microsoft Defender Antivirus built in, which is a good baseline if it is enabled, up to date and centrally managed. Microsoft’s EDR capabilities come in a separate product with its own license. Other vendors also offer EDR products; their features and licensing models differ and should be weighed against the company’s needs and budget before choosing.
What to Look For When Choosing
- Central management console: See the status of all devices, alerts and update status in one place.
- Server coverage: Support for Windows Server and, if needed, Linux.
- Tamper Protection: An attacker or user should not be able to disable it easily.
- Acceptable overhead: It should not hurt performance on database servers and busy systems.
- Someone to watch the alerts: EDR loses much of its value without a person reviewing the alerts. If you have no in-house team, use a managed monitoring service.
Common Deployment Mistakes
- Not installing it on servers on the grounds that “servers don’t have internet access”
- Running two antivirus products on the same system, causing slowdowns and conflicts
- Broad exclusions, such as excluding the whole
D:drive; exclusions should only follow the official recommendations of the vendors of software such as SQL Server or backup software - Devices that have not reported to the console for months without anyone noticing
Antivirus or EDR is the last layer of defense, not the only one. Closing RDP, regular updates, two-factor authentication and secure backups remain the foundation of security.
Checklist
- All computers and servers have active, up-to-date protection.
- Central management and device status reporting are in place.
- Tamper Protection is enabled.
- Exclusions are limited and documented.
- Alerts are reviewed every day by a designated person.
- Detection and response (EDR) capability is planned for critical systems.
ITPlus724 engineers can review the current protection on your computers and servers and implement a solution that fits your company’s size and budget.