EDR vs MDR: What Does a Small Business Actually Need?
EDR supplies endpoint telemetry and response tools; MDR supplies people to investigate and act. Without a security operator, buy the managed outcome.
- EDR is a tool; MDR is an operating team. A small business without a security operator should buy MDR.
- EDR alerts do not investigate themselves at 2 a.m.
- Confirm who can isolate a device, reset an account and contact the business during an incident.
Endpoint detection and response records what happens on laptops and servers, detects suspicious behavior and provides containment actions. Managed detection and response adds analysts who monitor, investigate and respond. The names sound adjacent, but the staffing model is the decision.
The responsibility split
| Work | EDR license | MDR service |
|---|---|---|
| Collect endpoint telemetry | Yes | Yes |
| Generate detections | Yes | Yes |
| Tune noisy rules | Customer | Provider |
| Investigate alerts | Customer | Provider |
| 24/7 monitoring | Customer | Included by contract |
| Contain and remediate | Customer | Varies; verify authority |
Cheap EDR can become expensive shelfware
Microsoft Defender for Business is $3 per user monthly with annual payment. CrowdStrike Falcon Go is $59.99 per device annually or $7.99 monthly. Both can be reasonable endpoint products. Neither price creates a person who owns every alert, investigates identity activity and coordinates recovery.
MDR prices the missing labor
Huntress publishes example managed EDR pricing of $8.99 per endpoint at 50 endpoints and $7.99 at 100, including a 24/7 SOC. Minimums and direct-purchase rules matter. Compare that bill with the cost of an internal responder, an MSP retainer and the delay created when nobody sees an overnight alert.
Ask what “response” permits
- Can the provider isolate a host without waiting?
- Does coverage include Windows, macOS and Linux actually deployed?
- Are identity and Microsoft 365 incidents included?
- Who resets credentials and rebuilds the endpoint?
- How is an owner reached after hours?
- Are monthly reports usable for insurance and customer reviews?
The decision
Buy EDR alone only when a named person monitors and operates it. Otherwise buy MDR, normally through a capable MSP for a very small fleet. The correct comparison is not $3 versus $9. It is software plus response labor versus a managed response outcome.