For years, "we have antivirus" was a reasonable answer to "how do you protect your computers?" Not anymore. The threats have evolved, and so has the technology to stop them. If you've heard the term EDR and wondered how it differs from the antivirus you already have, here's a clear, jargon-free explanation.
What traditional antivirus does
Antivirus works mainly by recognizing known threats. It keeps a list (signatures) of known malware and checks files against it — if something matches a known virus, it blocks it. This works well against established, recognizable threats.
The limitation: attackers constantly create new malware that isn't on any list yet, and they use techniques that don't involve a traditional "file" at all. Signature-based antivirus can miss these, because it's looking for things it already knows about.
What EDR does
EDR — endpoint detection and response — takes a different, more modern approach. Instead of only matching known signatures, it watches the behaviour of your devices in real time and looks for anything suspicious, even if it's never been seen before.
For example: a program suddenly trying to encrypt thousands of files (a ransomware signature-behaviour), or a process behaving in ways legitimate software wouldn't. EDR can detect that behaviour, stop it, and — the "response" part — help contain and clean it up. It also gives visibility into what happened, which is invaluable after an incident.
The key difference, simply put
- Antivirus asks: "Do I recognize this specific threat?"
- EDR asks: "Is anything on this device behaving like a threat, known or not?"
EDR catches the new, evasive attacks that slip past signature-based antivirus — which is exactly the kind of attack businesses face today.
What does your business need?
For a modern business, EDR is the standard — and increasingly, it's expected. Notably, many cyber insurers now require EDR (not just antivirus) to qualify for coverage. See our post on cyber insurance requirements.
That said, EDR is one layer, not a silver bullet. It works best alongside the other fundamentals — email filtering, MFA, tested backups, and patching. Together they form the layered defence that stops the overwhelming majority of attacks. (See our 7 cybersecurity essentials.)
The bottom line
Traditional antivirus recognizes known threats; EDR watches for suspicious behaviour and catches new, evasive attacks that antivirus misses. For today's threat landscape — and to meet insurers' expectations — EDR is the modern standard, best deployed as part of a layered security approach.
We deploy and manage EDR and layered security for Alberta businesses. Learn more about our cybersecurity services, or book a free evaluation to review your current protection.