Antivirus vs. EDR vs. MDR

  • Antivirus blocks files it recognizes as malicious. Modern attacks mostly don’t use recognizable files — they log in with stolen passwords and use legitimate tools.
  • EDR (endpoint detection and response) watches behavior: a normal program suddenly encrypting hundreds of files, a login from an impossible location. EDR sees far more — but it’s software. Someone still has to read what it found and act.
  • MDR adds the someone. A staffed security operations center triages every alert, around the clock, with the authority to contain a threat on the spot — typically by isolating the affected machine from the network so the problem can’t spread.

The 2am question is the whole distinction. An attack detected at 2:00am and contained at 2:05am is an incident report. The same attack acted on at 9am Monday is a very bad month.

Why your insurer keeps asking about it

Cyber-insurance applications have shifted from “do you have antivirus?” to asking specifically about EDR, 24/7 monitoring, and response capability — because carriers’ loss data shows containment speed is what separates a claim from a catastrophe. Some carriers now price or decline based on the answer.

What to look for in an MDR service

  1. Humans, 24/7 — not an “AI-powered” alert forwarder that emails you at 2am.
  2. Containment authority — analysts who can isolate a machine immediately, not a recommendation queue.
  3. A warranty with numbers — providers confident in their response back it financially.
  4. Plain-English reporting — you should understand what happened without a translator.
  5. Evidence output — detections and responses documented in a form your insurer and auditor can use.

How Z1 helps

Z1’s Complete plan includes 24/7 MDR built on SentinelOne with Vigilance analysts and a $1M breach warranty — plus the everyday defenses (MFA, email protection, training) that stop most attacks before detection is ever needed.

If you’re not sure what your current tools actually cover, the free gap analysis compares your insurance application’s claims against your real configuration.