Best antivirus and endpoint protection for small business: antivirus vs EDR vs MDR

Vendors use a lot of acronyms for what is, underneath, three levels of the same idea.

• Antivirus (often sold as "next-generation antivirus" or NGAV) checks files and programs as they arrive and run, and blocks the ones that look malicious. Modern versions use behavior and machine-learning models as well as lists of known malware. It is the smoke detector.
• EDR (endpoint detection and response) keeps a running record of what happens on each computer: which programs started, what they touched, which network connections they made. When something suspicious happens, it raises an alert, shows the chain of events, and lets someone isolate the machine from the network or roll back changes. Ransomware groups often use legitimate admin tools rather than obvious malware, and EDR is how you catch that. It is the security camera.
• MDR (managed detection and response) is EDR plus a team of analysts, run by the vendor or a partner, who watch your alerts around the clock and act on them. It is the monitoring company that calls you, or calls the police, when the camera sees something.

You may also see XDR (extended detection and response), which pulls in signals from email, identity and cloud apps as well as devices. For a business of ten people, the important question is simpler: when an alert fires at 2 a.m. on a Saturday, who sees it?

A sole trader or two-person office on Windows can do reasonably well with the built-in Microsoft Defender Antivirus, kept up to date, plus the basics in our small business security checklist. Our guide to whether free antivirus is enough covers that case.

Once you have employees, the needs change:

• Central management. One web console showing every device, whether it is protected, and what was blocked.
• EDR, because the attacks that hurt small firms often look like normal admin activity until it is too late.
• Coverage for everything you use: Windows, Macs, and ideally phones and any servers.
• Someone on the alerts. Either a person in the business, your IT provider, or an MDR service.

Many small businesses buy these products through a managed service provider (MSP) who installs, watches and supports them. If you already have an IT provider, ask what they use and who responds to alerts before you buy anything yourself.

All of the products below are established business security vendors with cloud consoles, and all appear in independent lab tests from groups such as AV-TEST and AV-Comparatives, along with MITRE's ATT&CK evaluations for EDR. Results move from one round to the next, so check the latest reports rather than relying on a ranking. The table is a qualitative guide based on each vendor's published product information. Tiers and bundles change often; confirm what each tier includes on the vendor's site.

Note that our Bitdefender link goes to Bitdefender's site, where you can find the GravityZone business products as well as the consumer line.

Check your licenses first. Defender for Business is included in Microsoft 365 Business Premium and is also sold on its own. According to Microsoft, it covers Windows, Mac, iOS and Android devices, and it includes EDR and automated investigation of alerts. It shares a console and identity system with the rest of your 365 setup, so you can manage devices, MFA and email security in one place.

For many small businesses on Business Premium, that makes it the obvious first choice. Paying for a second product on top only makes sense if you want a particular vendor's MDR service, your IT provider standardizes on something else, or you have tried Defender and found its console hard going. Many people do find the Microsoft security portals sprawling, and that is a fair reason to pay for something simpler.

Any honest guide to CrowdStrike has to mention July 2024. A faulty content update for CrowdStrike's Falcon sensor caused Windows computers running it to crash and fail to restart, taking down millions of machines at airlines, hospitals, banks and other businesses. It was not a cyberattack, and Macs and Linux machines were not affected. Many affected Windows PCs had to be fixed by hand.

Afterwards, CrowdStrike said it had changed how it releases these updates: rolling them out in stages, starting with a small group of machines, adding more testing, and giving customers more control over when content updates reach their devices. If you choose CrowdStrike, use those controls. Put a test machine or two on the earliest update group and the rest of the business a step behind.

The lesson applies to every vendor in the table: security software runs with deep access to the operating system, so a bad update from any of them can cause trouble. Choose a vendor that lets you stage updates, and keep a plan for getting machines back up.

The product matters less than how it is set up. These are the things to check in the first week, whatever you buy:

• Every device is covered. Compare the console's device list against your own list of laptops, desktops and servers. The machine that was never enrolled is the one that gets hit. Include the owner's laptop and the PC in the warehouse.
• Tamper protection is on. Attackers try to switch security software off before running ransomware. Tamper protection stops local users, and malware, from disabling or uninstalling it without admin approval.
• Alerts go to someone who reads them. Send them to a monitored inbox or a phone, not to the person who set up the trial and left. Decide who acts on a high-severity alert out of hours. If the answer is nobody, budget for MDR.
• Response actions are allowed. Check that the policy permits isolating a device and quarantining files automatically, rather than only reporting them.
• Admin access is locked down. Protect the security console with MFA, ideally a security key. Whoever gets into that console can turn off protection everywhere.
• Only one product is running. Two full security products on one machine tend to slow it down and interfere with each other. Remove the old one when you switch.

• Consumer antivirus licenses on business machines. They lack central management, and some are licensed for personal use only.
• Paying for XDR or a SIEM before anyone is reading the endpoint alerts you already have.
• Free "PC cleaner" tools and anything that arrives through a pop-up warning.
• Chasing the top score in a single lab report. The leading products trade places between rounds.

Phones count too. Keep them updated and enrolled in your device management if you have it; our guide on whether a phone is hacked covers warning signs, and Mac users should read do Macs need antivirus.