A client asked me last year why they got hit with ransomware when they were "fully protected." They had antivirus on every machine, licenses current, dashboard green. The attacker never dropped a file it could scan. They logged in with a stolen password and used the company's own admin tools to do the rest.
That's the gap worth understanding, and it's not really antivirus versus MDR. It's detecting known bad files versus noticing when something normal is being used abnormally.
Classic antivirus works on signatures. Someone analyzes a piece of malware, pulls a fingerprint from it, and pushes that fingerprint to every installed product. Your machine sees a file, checks it against the list, blocks it if there's a match.
This still works, and people who dismiss it are wrong. There's an enormous volume of commodity malware circulating at any moment, and signature matching swats it cheaply and fast. Don't turn it off.
But look at what the design assumes: that the bad thing is a file, and that someone has already seen it. Break either assumption and the scanner has nothing to compare against. Attackers figured this out a long time ago and have been building around it ever since.
Almost nothing I see in incident response looks like a suspicious .exe sitting in a downloads folder.
Fileless attacks run in memory, using PowerShell or WMI, so nothing is ever written to disk to scan.
Living off the land means the attacker uses tools already on your machine. PsExec, RDP, the same admin utilities your own team uses. There's no malware to find because they didn't bring any.
Ransomware that recompiles itself for every victim, so the fingerprint is new every time.
Stolen credentials, which is the most common one and the least dramatic. Someone buys a valid password, logs in, and looks exactly like an employee. No product treats a successful login as an attack.
Notice the pattern. In every case there's no known-bad file to catch. What's suspicious is the behavior: a finance workstation reaching for a domain controller at 2am, an account authenticating from two countries in ten minutes, a script spawning from a Word document. Signatures were never built to read that.
Two things get conflated here, so let me separate them.
EDR is the technology. It records what's happening on your endpoints, processes, connections, logins, and flags patterns that look wrong. It gives you the telemetry a scanner never collected.
MDR is the people. It's an actual team watching that telemetry around the clock, deciding what's real, and doing something about it at 3am on a Sunday.
That distinction matters more than any feature comparison, because I've watched companies buy excellent EDR and get breached anyway. The tool generated the alert. It sat in a console nobody was reading until Monday. Detection without response is just a very well-documented breach.
The honest question isn't which product is better. It's whether anyone will act on an alert at 3am.
If you have a security team with 24/7 coverage, buy EDR and run it yourself. If you don't, and most businesses under a few hundred people don't, MDR is buying the thing you're actually missing, which is people, not software.
What I'd ask any MDR provider before signing:
Who is watching at 3am on a holiday weekend, and are they employees or a subcontracted overflow desk? What are you authorized to do without calling me first, can you isolate a machine or only send an email? What's the real median time from detection to containment, not the marketing number? And when this is over, do I get the telemetry, or does it stay locked in your platform?
That last one catches people. Some providers keep the data, and switching later means starting your visibility from zero.
Keep antivirus. It's cheap and it handles the commodity noise. But understand what it was designed for, and that most breaches now arrive through a valid login rather than a malicious file.
If you want to talk through what makes sense for your environment specifically, get in touch. Happy to give you a straight answer even if it's that you don't need us.
Ready when you are
One partner for cybersecurity, managed IT, cloud, AI, ERP & finance, compliance, and networking.