Question 1

Is EDR the same as antivirus?

Accepted Answer

EDR differs from antivirus. Antivirus primarily uses signatures and patterns, while EDR detects behaviour and can execute response actions on the host.

Question 2

Does EDR replace a SIEM?

Accepted Answer

EDR does not replace a SIEM. EDR sees the endpoint, while a SIEM correlates sources across the environment. See [SIEM](/en/glossary/siem) for details.

Question 3

Does an SME need EDR, or should it start with MDR?

Accepted Answer

EDR delivers telemetry and response capability on the endpoint. Without 24/7 operations, alerts sit overnight. For most Swiss SMEs, MDR on top of EDR is therefore the practical entry point. See [EDR vs. MDR](/en/soc/soc-siem-edr-xdr-mdr-terms).

Question 4

Does EDR need to run on every server?

Accepted Answer

Yes, otherwise blind spots emerge. Network sensors or passive monitoring compensate for exceptions such as legacy operating systems and OT.

Question 5

How does EDR differ from XDR?

Accepted Answer

EDR sees endpoints, while XDR correlates endpoint telemetry with identity, mail and cloud telemetry. See [What is XDR](/en/soc/what-is-xdr) for details.

Context