Anti-Virus (AV) vs Endpoint Protection and Response (EDR) – What is the difference?

What is Antivirus?

An antivirus solution is a type of software that is designed to recognise threats by their file pattern or signature. Using this database of threats, it is easily able to identify malicious files that are known to the solution and preventing the threat from executing.

What is EDR?

An Endpoint Protection and Response (EDR) solution is a type of software that protects your device from known and unknown threats by looking at the behaviour on the system. Using automation and Artificial Intelligence (AI), it then assesses if the behaviour is a potential threat.

What are the differences?

• Detection

AV solutions are reactive and protect against known threats, utilising a database of known file patterns and signatures. An EDR solution is proactive and looks at the behaviour of files running on a protected endpoint and can detect and predict known and unknown threats.

• Containment

AV solutions act immediately as they know which files are malicious and blocks the execution, often automatically deleting the files or moving them to quarantine for investigation. An EDR solution uses automation and AI to block execution of known or potentially unknown threats whilst investigating takes place. In some cases, the EDR solution may disable network connections or placing the device in isolation to ensure any potential malware is not spread across the network.

• Investigation

When a threat is found by an AV solution, the malicious files are either deleted or placed into quarantine for review. With EDR being a more complex solution, some threats will require investigation to ensure the threat is malicious. This may require a security analyst to threat hunt through the traces left by the threat, ensuring that this is not a false positive before restoring processes or network activity.

What is the best option for you?

Although the 2 solutions are different, together they create a good security posture providing both reactive and proactive security measures to assist in detecting known and unknown threats.

A traditional anti-virus is often more affordable and can often provide a baseline of security sufficient for smaller companies. However, those that want or require a more robust security endpoint solution should consider also having an EDR solution to better protect against the threats in today’s world.