Antivirus vs EDR: what's the real difference, and do you need both

Every antivirus program sold today still does the one job it was built for: matching a file against a list of malware it already knows. That job hasn't gone away. What's changed is how much of it that job now covers. CrowdStrike's own telemetry put the number at 79% of attacks in 2024 that used no malware file at all, just stolen logins and legitimate admin tools turned against the business that owns them. A signature scanner has nothing to match against there, because there's no signature.

That's the gap endpoint detection and response is built to close, and it's also the reason the term keeps showing up in service tiers and cyber insurance renewal forms that never used to mention it. This isn't a case for ripping out your antivirus. It's a case for understanding what it was never going to catch, and deciding, with real numbers rather than a sales pitch, whether you need something watching for the rest.

What antivirus actually does

Signature-based antivirus, still most of what ships free with a new PC or gets bundled into a basic support contract, works by comparison. Somewhere there's a database of known malware, fingerprints of files that have already been caught in the wild, and every file touching the machine gets checked against it. Match found, file blocked. No match, file runs.

It's fast, it's cheap, and it genuinely stops a huge amount of low-effort malware: the mass-blasted ransomware variant, the pirated-software trojan, the email attachment that's been doing the rounds since March. None of that is going away, and none of it needs anything fancier than a good signature scanner to catch.

The problem is what it was never designed to see. A file that's never been caught before has no signature yet.

Neither does an attacker who logs in with a password bought on a criminal marketplace and never drops a file at all.

The malware-free problem

CrowdStrike's 2025 Global Threat Report, built from its own detection telemetry across the businesses it protects, put a hard number on that gap: 79% of the attacks it saw gaining initial access in 2024 involved no malware whatsoever. Stolen credentials, remote access tools already installed on the machine, admin commands typed by hand. To a signature scanner, all of that looks like a normal Tuesday.

The same report measured how fast attackers move once they're in: 48 minutes on average between the first foothold and lateral movement to a second system, with the fastest recorded case at 51 seconds. A security team that only finds out once a signature match fires, days or weeks later when the file finally gets flagged in an update, is finding out too late to matter.

What EDR actually watches for

Endpoint detection and response doesn't ask whether it has seen this file before. It asks whether this behaviour is normal for this machine. A process suddenly encrypting hundreds of files in a few seconds. A login from a country the business has never traded with. Word spawning a PowerShell window, something a document editor has no legitimate reason to do. None of those need a matching signature, because EDR isn't matching files. It's watching what they do.

That's a genuinely different technology, not a marketing rename of antivirus. It sits on the device, logs behaviour continuously, and can isolate a machine from the network the moment something looks wrong rather than waiting for a human to notice. The trade-off is that it needs tuning, and in most small setups, someone actually watching the alerts it raises. An EDR tool nobody looks at is an expensive antivirus.

What NCSC actually says

It's worth being honest about what the UK's National Cyber Security Centre actually recommends here, because it's more measured than most of the vendor marketing around this topic. Its guidance on mitigating malware and ransomware attacks asks organisations to consider whether enterprise antivirus or anti-malware products are necessary, treating it as one layer among several rather than a fixed requirement. Patching, restricting admin rights, disabling macros and autorun, and application control all sit alongside it in the same guidance, and none of them get singled out as the one thing that matters most.

NCSC doesn't tell every small business it must run EDR. What it does say, consistently, is defence in depth: no single control, antivirus or otherwise, should be the only thing standing between an attacker and your data. That's a more useful frame than "AV is dead," a claim sold harder by EDR vendors than by anyone actually writing UK government guidance.

Where UK small businesses actually stand

The government's own Cyber Security Breaches Survey for 2025/2026 gives a reasonable picture of where things sit in practice. 43% of UK businesses reported some kind of breach or attack in the past year, and for small businesses specifically the figure was 46%, higher than the overall average, not lower. Most of the basic ground is already covered, with 81% of businesses running some form of updated malware protection, but what's much less common is anything that actually watches behaviour once that point is passed: only 33% of businesses monitor user activity in any form, EDR included.

That's the real gap in most small business setups. Not that antivirus is missing. That almost nothing is looking at what happens after a login succeeds.

EDR isn't a switch you flip and forget

Buying an EDR licence and installing the agent is the easy part. The alerts it generates need a response, and a tool that fires a warning nobody reads by Friday afternoon isn't protecting anything. That's the real reason EDR tends to arrive bundled with a managed service rather than sold as standalone software to a business with no security team. Someone has to be on the other end of the alert at 2am on a bank holiday, not just at 9am on a Tuesday.

This is also where managed detection and response, MDR, differs from EDR itself. EDR is the sensor and the tooling. MDR is a team watching what it reports and acting on it. A five-person office running EDR with nobody triaging the alerts could easily be worse off than one running plain antivirus that just gets out of the way and blocks what it can.

What this actually costs

Numbers help more than a general recommendation, so here's what it looks like on our own current pricing. Essential, at £50 per user a month, includes endpoint antivirus and patch management, no more, no less. Professional, at £77, adds EDR along with email security and staff phishing training. Complete, at £108, layers on managed detection and response with SIEM and log retention on top of that.

The jump from Essential to Professional is where EDR actually gets added, and it's the point most small businesses land on once they've decided plain antivirus isn't covering enough of the risk they're carrying. Complete's MDR tier is usually the right call once there's client data, a compliance requirement, or a board that's asked the question directly, rather than a default for every five-seat office.

What to check before you decide anything

Start with what you're actually running now, not what the renewal invoice says the product is called. A lot of "antivirus" bundled into old support contracts is exactly that: signature-based, no behavioural layer, doing the one job it was built for and nothing else. Ask your current provider directly whether what's installed does behavioural detection or file matching, because the product name alone won't tell you.

Then look at what you're actually exposed to. A five-person office with no remote access and no client data carries a different risk than a twenty-person firm handling other people's financial records over VPN. The second one probably needs EDR at minimum. The first might genuinely be fine on well-maintained antivirus and decent patching, and there's no shame in saying so rather than buying tooling that sits unused.

Where Alpha IT fits in

We run all three tiers as part of our managed cybersecurity service on real client devices, not as separate products bolted together, and we monitor what they flag rather than shipping software and leaving you to read the dashboard yourself. If you're not sure which side of the antivirus-versus-EDR line your business actually sits on, our free IT health check is a reasonable place to find out, or get in touch directly and we'll walk through what's already installed.