The short answer
| Antivirus | EDR | |
|---|---|---|
| Main job | Stop known malicious files | Detect, investigate and respond to suspicious behaviour |
| How it decides | Signatures, reputation, some behaviour rules | Continuous recording of process, file, network and user activity, analysed for attack patterns |
| What you get | Blocked or quarantined files | Alerts with a timeline, plus response actions |
| Response | Quarantine or delete a file | Isolate a device, stop processes, collect evidence, roll back some changes |
| Who operates it | Mostly automatic | People who triage alerts and act, in-house or through a provider |
Most products include both. The real change is the operating model: someone must review alerts and respond, including after hours.
Why antivirus alone is not enough
Many attacks use no malicious file: stolen credentials, built-in admin tools, scripts in memory. Antivirus may see nothing unusual. EDR spots behaviour chains, such as a document launching a script that calls an unfamiliar server, and records enough to reconstruct them. Microsoft Defender for Endpoint, CrowdStrike and SentinelOne are examples (Microsoft Learn).
Alongside existing antivirus? Often. Microsoft's EDR in block mode works with Defender Antivirus passive behind another product, with some protections lost and Plan 2 required (Microsoft Learn). Two full products both in active mode usually conflict; follow each vendor's guidance.
More detail: what EDR platforms include
Microsoft describes Defender for Endpoint as a platform that helps organisations "prevent, detect, investigate, and respond to advanced threats", and lists EDR alongside next-generation protection, attack surface reduction, vulnerability management and automatic attack disruption (Microsoft Learn). CrowdStrike and SentinelOne offer comparable capabilities.
What changes when you deploy EDR
Alerts need owners
Decide who triages, how fast and overnight: your team, an MDR service or a managed provider.
Response needs authority
Isolation interrupts work: agree who isolates which devices, who gets called, how devices are released.
Tuning takes time
Expect early false positives from business software and scripts; document every exclusion with a reason.
Coverage must be complete
Attackers use forgotten devices. Cover servers, Mac, Linux, virtual desktops, remote laptops; alert on silent devices.
Privacy questions
Tell staff what is collected; limit access and retention. The NDPA covers employee data too.
Connect the signals
Join EDR with identity, email and cloud data to trace phishing to compromised account to device.
The Nigeria Data Protection Act 2023 (NDPA) applies to employee personal data as well as customer data, so a lawful basis, transparency and sensible retention matter; ask your legal adviser or data protection officer if unsure.
Licensing and cost
Cost follows device count and type, product tier and whether monitoring is included. EDR often sits in higher tiers (Microsoft 365 E5 includes Defender for Endpoint Plan 2), so check existing licences first. Most endpoint licences are priced in US dollars: check the billing currency and renewal terms, as exchange rates move the naira cost over a multi-year term. Human monitoring usually costs more than the licence.
A practical rollout
- InventoryEvery endpoint, server and software needing exclusions.
- PilotIT plus heavy users of specialist software.
- Audit modeReview what would be blocked, then enforce.
- Tamper protectionUsers and malware cannot disable the agent.
- PlaybooksSuspicious sign-ins, ransomware behaviour, credential theft tools.
- Waves, test, reviewWatch performance, simulate attacks, review monthly against targets.
More detail: waves, testing and review
- Roll out in waves, watching performance and support tickets.
- Test with safe simulation tools to confirm alerts reach the right people and that isolation works.
- Review monthly: alert volumes, coverage gaps, exclusions and response times against the targets you set.
Readiness checklist
Coverage
- Full device inventory, including servers and non-Windows devices
- Alerts for devices that stop reporting
Operations
- Named alert owners, in and outside business hours
- Isolation authority agreed with management
- Playbooks for the most likely incidents
Configuration
- Pilot group and audit period planned
- Exclusions documented with reasons
- Tamper protection enabled
Governance
- Staff informed; EDR data access and retention defined
- Existing licences checked for EDR features
Limitations
EDR shortens the time to notice an attack; it does not replace patching, strong authentication, tested backups, access control and an incident response plan, which security agencies such as CISA consistently list alongside security software (CISA). For help selecting, deploying or monitoring EDR, see EDR deployment and management.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Microsoft Defender for Endpoint, Microsoft Learn
- Endpoint detection and response in block mode, Microsoft Learn
- #StopRansomware, Cybersecurity and Infrastructure Security Agency (CISA)
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.