# EDR or NDR: which should a small company buy first?

Usually EDR first, because protecting each computer against malware is the more basic need. EDR (endpoint detection and response) or good modern antivirus stops much common malware on laptops and servers, and together with multi-factor authentication, prompt updates and tested offline backups it covers the attacks small companies see most. NDR (network detection and response) comes next, and it moves up the list when you have a local network with servers, printers, cameras or production machines that cannot run an agent, when a customer contract or NIS2 asks you to detect and report incidents, or when you want an independent check that the endpoint tool is not the only witness. You do not have to choose on faith: the NetSenX Free plan covers 3 devices with no time limit, so you can put one agent on a mirror port and see what the network shows before spending money.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/edr-or-ndr-which-should-a-small-company-buy-first

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Is antivirus enough for a small business?](https://netsenx.com/en/faq/is-antivirus-enough-for-a-small-business)
- [What does network detection catch that antivirus misses?](https://netsenx.com/en/faq/what-does-network-detection-catch-that-antivirus-misses)
- [What gaps does EDR leave that only the network shows?](https://netsenx.com/en/faq/what-does-the-network-show-that-edr-misses)
- [What happens if attackers disable our EDR?](https://netsenx.com/en/faq/what-happens-if-attackers-disable-our-edr)
- [How do we notice when a server's endpoint protection goes silent?](https://netsenx.com/en/faq/how-to-notice-when-endpoint-protection-goes-silent)