Antivirus vs EDR: The Real Difference, and the Question That Matters More Than Brand

The question we ask before recommending any product isn't "which brand do you want?" It's "if a critical alert fires at 3 a.m. on a Saturday, who sees it?" The answer decides what you should buy more than any feature comparison table.

Five terms

Most products in 2026 combine NGAV and EDR in a single agent. The differences lie in the licence tier and in who reads the data.

What each vendor calls it

A neutral note: since 2024 the United States has banned the sale and updating of Kaspersky products within its borders. They remain available in Laos as normal, but if your organisation has a US-linked parent company or funder, check their policy first.

Why AV on its own falls short

Many current attacks involve no malware file to scan:

• The attacker logs in with stolen credentials over VPN or RDP
• They use tools already in Windows, such as PowerShell, WMI and PsExec ("living off the land")
• They install legitimate remote-access software to control machines

AV doesn't see any of this, because nothing is a "bad file". EDR does, because it watches sequences: Outlook opens Excel, Excel launches PowerShell, PowerShell downloads something and connects to an unfamiliar IP. Each step looks normal; the chain doesn't.

EDR also catches the behavior that comes before ransomware: credential theft from memory (LSASS), deletion of volume shadow copies, security services being stopped. When it does, it can isolate the host from the network (while keeping it connected to the console), kill processes and, in some products, roll back encrypted files.

A typical incident timeline

This is a common pattern, not any particular customer's incident:

1. Friday 18:00. A staff member's VPN password, stolen through phishing, is used to log in.
2. Friday 23:00. The attacker maps the network with built-in Windows tools and pulls admin credentials from memory.
3. Saturday 02:00. Shadow copies are deleted, the backup agent is stopped, and encryption starts.

AV may see nothing until step 3. A well-configured EDR alerts at step 2. But if nobody reads that alert between 23:00 and 02:00, the outcome is the same. That's why "who sees the alert" matters more than the brand.

The real problem: alerts nobody reads

EDR produces alerts. Some matter, many don't. If nobody triages and decides, EDR becomes an expensive antivirus. Most Lao organizations have one to three IT staff who cover everything from printers to the ERP. Expecting them to watch an EDR console every day, holidays included, isn't realistic.

Options that work in practice:

Our view: for most organizations of 50–200 people, mid-tier EDR plus MDR delivers more than top-tier XDR that nobody has time to use.

Example: 80 devices, two IT staff

Say a company has 75 PCs and laptops, four Windows servers and one Linux server running the ERP. Staff already use Microsoft 365 Business Premium.

• PCs and laptops: Defender for Business, already included in the licence, so no new agent to buy
• Servers: separate server licences, including the Linux box that usually gets forgotten
• Watching alerts: an MDR service that works in the same console 24/7 and is allowed to isolate machines itself
• The two IT staff: review the weekly report, keep Windows patched, and pick up the phone when the MDR team calls

If the same company didn't have Business Premium, the alternative is another vendor's EDR with that vendor's MDR. What you shouldn't do is pay twice: the Defender you already own plus a second EDR, with nobody watching either.

Deploying without drama

1. Inventory every device, including servers, executive laptops and production-line PCs. The machine without an agent is where attackers land.
2. Remove the old AV first. Two engines on one machine tend to conflict and slow it down.
3. Pilot for 1–2 weeks in detect/audit mode with a varied group (finance, engineers, one server).
4. Keep exclusions narrow. If the ERP or database slows down, exclude only the specific processes or data folders the ERP vendor recommends. Never a whole drive.
5. Turn on prevention and tamper protection everywhere. Without tamper protection, malware with admin rights can switch the agent off.
6. Update in rings. Push new agent versions to a small group first, then everyone. A faulty security-software update has already left huge numbers of Windows machines worldwide unable to boot at the same time.
7. Write down who receives alerts and how fast they must respond.

Conditions on Lao sites

Unstable internet. Provincial branches and mines can lose connectivity for hours. Check that the agent keeps protecting and blocking offline, and uploads queued telemetry when it reconnects.

Old machines. PCs that run machinery or fingerprint scanners often run out-of-support Windows versions. Ask the vendor exactly which versions the agent supports. If it doesn't, put those machines on their own firewall-restricted VLAN.

Linux servers. Don't forget servers running web, database or CCTV software on Linux.

Language. Most MDR teams report in English. Make sure whoever takes the night-time call understands it well enough to make a decision.

Four numbers to check every month

Once it's running, a short monthly review tells you whether the money is working:

• Coverage: devices with a healthy agent ÷ devices in your asset list. Anything under 95% means machines are hiding somewhere.
• Time to acknowledge: how long critical alerts waited before a person looked at them. Ask the MDR provider for this figure.
• Out-of-date agents: machines more than one version behind, usually laptops that rarely come back to the office.
• Exclusions: the list should get shorter over time, not longer.

Questions to ask the vendor

• In which country or region are the console and telemetry hosted?
• How many days of event history does the quoted licence retain?
• How much CPU and RAM does the agent use on an older 8 GB PC?
• Are automatic isolation and rollback available, and in which licence tier?
• For MDR: who responds, within how many minutes, are they allowed to isolate hosts themselves, and who do they call, in what language?
• Can you control when and to which groups agent updates are released?

Brands we supply & install include CrowdStrike, Microsoft, Sophos, Trend Micro, ESET and Kaspersky. All have capable EDR; the choice often comes down to licences you already own and the MDR options available with each. More on our endpoint protection and EDR page and in the ransomware protection checklist.

Answer one question for us

Who sees the alert at 3 a.m. on a Saturday? Tell us that, along with how many PCs and servers you have and which Microsoft 365 licences you hold. We'll propose two options, one your team runs and one with MDR, plus a scope for a two-week pilot.