Antivirus Isn’t Enough Anymore. Here’s What EDR Actually Changes.

Nearly every cyber insurance questionnaire asks the same question: do you have EDR on every endpoint? A lot of business owners check yes because they have antivirus. Those aren’t the same thing, and the difference matters more than the checkbox.

What antivirus does

Traditional antivirus compares files against a list of known bad ones. If something matches, it gets quarantined. That worked fine when most threats were files someone emailed you. It doesn’t work well when an attacker logs in with a stolen password and uses tools that are already on the computer. Nothing on that list matches, so nothing gets flagged.

What EDR does differently

Endpoint detection and response watches behavior instead of just files. It notices when a process starts encrypting hundreds of documents, when PowerShell reaches out to a strange server at 2 a.m., or when an account that normally opens QuickBooks suddenly starts dumping credentials. Then it can act on its own:

• Kill the process
• Isolate the machine from the network so it can’t spread anything
• Roll files back to a clean state on platforms that support it
• Keep a record of what happened so you can see how it got in

That last one gets overlooked. When something goes wrong, the first questions are how they got in, what they touched, and whether they’re still there. Antivirus usually can’t answer any of that. EDR can.

What EDR still won’t do

EDR is a tool, not a team. It raises alerts, and some of those alerts need a person to look at them and decide. If nobody’s watching, a serious alert can sit in a console over a long weekend. That’s why most of our clients pair EDR with a security operations center that’s watching around the clock. We run SentinelOne for our clients, and the value comes from the software plus the people responding to it.

It also doesn’t protect accounts. If someone steals a Microsoft 365 login and works entirely in the cloud, there’s no laptop for EDR to catch them on. That’s a separate layer, and it’s one we cover with identity threat detection.

What to check if you think you already have it

• Is it on every machine? Servers, the old PC at the front desk, the laptop the owner takes home. Insurers mean every one.
• Who gets the alert? If the answer is an inbox nobody reads on Saturday, you have a gap.
• Can it isolate a machine automatically? Minutes matter with ransomware.
• Does it cover Macs? Plenty of offices have a few, and they’re often missed.

If you’re not sure what you have, that’s worth finding out before your next renewal, not after an incident. We’ll check it as part of a cybersecurity review, and if you’re a contractor, read what your insurer expects from your subs too.