What is the difference between MDR and EDR?

EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. is software, MDRMDR: managed detection and response. A service in which an outside team watches your alerts and responds for you. is a service run by people. EDR (endpoint detection and response) is installed on your computers and servers; it watches processes and files, raises alerts and lets an administrator isolate a machine. Someone still has to read those alerts and decide. MDR (managed detection and response) is a provider whose analysts read the alerts for you, around the clock, and respond within an agreed time. Most MDR services bring or require their own EDR, and some also take network or cloud data. So the real question is not EDR or MDR, but who reads the alerts at night. If you have staff or an IT provider on call, EDR plus network detection may be enough. If nobody can react outside office hours, a managed service fills that gap. NetSenX is detection software, not an MDR: it explains each alert so that your team or provider can act on it.

This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics