EDR, XDR and MDR: what the difference actually is

EDR is software that runs on each endpoint, records what happens on it, flags behaviour that looks like an attack, and lets someone respond, for example by stopping a program or cutting a machine off the network.

An endpoint is any computer a person or a process uses: a laptop, a desktop, a server, a virtual machine, or the small Linux board inside a robot or a kiosk.

Detection means the EDR agent on that endpoint keeps a record of what programs start, which files they touch and where they connect, and compares that behaviour against rules and known attack patterns, often mapped to MITRE ATT&CK, the public catalogue of attacker techniques. When something matches, it raises an alert.

Response means someone can act on that alert from a console: end the process, quarantine the file, isolate the machine, or pull the recorded history to see what else happened. Some EDR products can take some of these actions automatically.

The recorded history is also what makes threat hunting possible: searching past activity for signs of an attack that no rule has flagged yet.

What EDR does not do: it does not watch your email, your user accounts in the cloud or your firewall, and it does not, on its own, look at the alerts. Someone has to.

The term was coined in 2013 by Gartner analyst Anton Chuvakin, originally as endpoint threat detection and response.

Antivirus asks whether a file is known to be bad. EDR asks whether what is happening on the machine looks like an attack, even when nothing on it is a known bad file.

Traditional antivirus compares files against a list of known malware signatures. Next-generation antivirus (NGAV) adds behaviour and machine-learning checks to block new malware before or as it runs. Both are about stopping bad files.

Many attacks do not need a bad file. Take an attacker who logs in with a stolen password and uses the administration tools already on the machine. Antivirus sees nothing wrong: every program involved is legitimate. EDR records that the accounting PC opened a remote session to the file server at 3am and began copying the whole share, and that is what raises the alarm.

Most EDR products today include antivirus-style protection, so you rarely need both as separate products. The difference that matters is the recording and the response.

XDR extends EDR beyond the endpoint: it joins endpoint data with other sources, typically email, identity, cloud and network, so one alert can show an attack moving between them.

The extended part is the point. A phishing email, a sign-in from an unusual country, and a laptop that then starts behaving oddly are three separate alerts in three tools. XDR tries to show them as one incident.

The honest problem: XDR has no agreed definition. Palo Alto Networks coined the term in 2018, and since then most vendors have used it for whatever their platform joins together. Two products both called XDR can cover very different sources.

So if someone is selling you XDR, ask exactly which data sources are included, which of those need other products from the same vendor, and which work with tools you already own.

MDR is a service, not software. You pay a provider whose analysts watch your EDR or XDR alerts, investigate them and act or call you, usually around the clock.

With EDR, you buy software and someone on your team has to look at what it finds. With MDR, you also pay a company to do that looking. The provider either brings its own EDR or XDR, or works with the one you already have.

What you still do yourself: decide which actions the provider may take without asking, approve the bigger ones, fix the underlying problem (patch the server, reset the password), and talk to your own staff.

EDR vs MDR, in one line

EDR is the tool; MDR is people using a tool for you. If nobody on your side can look at alerts at 2am, that gap is what MDR fills.

MDR is often delivered by an MSSP (managed security service provider), sometimes together with other security services.

EDR watches endpoints and can act on them. A SIEM (security information and event management) collects logs from everything, including EDR, firewalls and applications, so they can be searched, correlated and kept for compliance.

People conflate them because both produce alerts and both sit in a security team's day. The difference: a SIEM sees widely but usually cannot stop anything on a laptop; EDR sees one kind of thing deeply and can. A SOAR (security orchestration, automation and response) tool is often added beside a SIEM to automate the response steps.

No, not as a separate product: XDR includes EDR. The endpoint is usually its main data source.

The confusion comes from vendors selling the two as separate tiers. If you have XDR, check that it really has an agent on all of your endpoints, including Linux and macOS machines if you run them, and not just on the ones its vendor supports best.

All three, sold as modules. CrowdStrike Falcon began as an EDR platform; the company now also sells XDR (Falcon Insight XDR), a SIEM (Falcon Next-Gen SIEM) and an MDR service (Falcon Complete).

So the answer depends on which modules an organisation has bought. The same is true of other large platforms: Microsoft sells Defender for Endpoint (EDR), Defender XDR and Sentinel (SIEM); SentinelOne and Palo Alto Networks also sell endpoint, XDR and SIEM products.