Understanding EDR vs MDR vs XDR

You have one of the toughest jobs in all of tech: protecting your organization against an increasingly intense barrage of sophisticated threats. To make your job even more challenging, you have a finite budget for staff, tools, and services with which to work toward your mission.

So, you face some critical choices in the coming months, including:

How to best allocate your limited cybersecurity budget to achieve optimal results
Which existing investments to retire — or keep and optimize
What new investments will likely deliver the highest return going forward

More specifically, the decision you make regarding EDR vs. XDR. vs. MDR will likely be pivotal in your efforts to optimally mitigate your organization’s exposure to risk. That’s why it’s a good idea to review the important distinctions between these three options.

Endpoint Detection and Response (EDR)

As its name implies, EDR helps you detect and respond to threats on your organization’s endpoints. An endpoint is any device that connects to your organization’s network — whether it’s a desktop PC on your premises, a storage controller in your data center, or an employee’s laptop that they’re using from a remote location. EDR supports your cyberdefense through:

Endpoint data collection. Agents installed on your endpoints gather telemetry that can include types and volume of specific activities occurring on that endpoint, the other endpoints inside and outside your organization with which each endpoint is communicating, and data and file types transiting to and from that endpoint.

Endpoint data analysis. Endpoint data is forwarded to an EDR analysis engine that compares your endpoint telemetry to “markers” that indicate the likely presence of some known type of malicious activity. That analysis ideally includes the specific type or types of cyberattacks with which each specific detected marker can be positively correlated.

Automated Endpoint containment. To prevent any active threat from spreading across your environment, EDR automatically isolates any endpoints where it detects a potential problem. This often helps prevent an attack (such as a ransomware attempt) from succeeding — although it is not always a guarantee that no further penetration of your environment has occurred.

Endpoint response support. EDR also provides your cybersecurity team with information they can use to further investigate and respond to apparent incidents. This fact-based investigation is essential both for ensuring that the attack is stopped in its tracks before it can compromise your organization (by encrypting data for ransom, exfiltrating data, disabling critical systems, etc.) and for completely eliminating any traces of the attack from your environment, so that you can get things back to normal.

Note that EDR differs from traditional antivirus in that the latter functions primarily by identifying specific types of potentially malicious files based on their “signature” attributes, while EDR detects malicious activity on endpoints regardless of whether any files installed on those endpoints conforms to a known signature. EDR also differs from most antimalware products by gathering and analyzing a broader range of telemetry in order to determine whether an endpoint has been compromised in any way.

Extended Detection and Response (XDR)

XDR goes beyond EDR — and is thus “extended” — in several significant ways:

XDR collects data from more sources. XDR supplements the endpoint telemetry of EDR with much more diverse sources that include endpoint, cloud, networks, identity, user/entity behavior, and more. Taegis XDR, for example, has “detectors” that can match certain types of keystrokes with those of known threat actor behaviors.

XDR analytics can more fully identify active threats. Because XDR collects more data from across your environment, it can more specifically identify the nature and source of any malicious activity it detects. This more complete identification enables threat hunters to more quickly and confidently root out and neutralize all of the diverse compromises that result when threat actors get past their initial endpoint breach and start probing the rest of your ecosystem for vulnerabilities.

XDR can efficiently replace more of your current cybersecurity spending. The cost of XDR is partially offset by the fact that it can replace stand-alone EDR, since it provides a superset of EDR functionality. XDR costs can be even further offset by obviating the need for SIEM, as for many organizations it can fulfill the same purpose as a central aggregation point for security-related telemetry across the enterprise.

Note that there is an important difference between proprietary XDR and open XDR. Proprietary XDR will only be capable of aggregating cybersecurity-related data from tools developed by the XDR vendor and/or those from their certified partners.

Open XDR, on the other hand, accepts data from any source using industry-standard APIs. Organizations often turn to Open XDR to avoid vendor lock-in and have the flexibility to choose the best solutions over time. They can also leverage their existing security investments rather than having to rip and replace. So, in the case of Taegis XDR, you can freely choose between Secureworks’ native EDR capabilities, your incumbent EDR, or any other EDR available on the market today or in the future.

Managed Detection and Response (MDR)

MDR is a catch-all term that refers to any detection-and-response solution delivered on an “as a service” basis with a packaged offering delivered by a managed security service provider (MSSP) or other security partner. Typically, such a service includes 24/7 monitoring of your environment, ongoing threat hunting, and collaborative investigation and remediation (since such activities almost invariably require some participation by your in-house IT staff).

Since MDR refers to any managed detection and response service, it’s incumbent upon you to determine whether an MDR provider is using EDR, XDR, user and entity behavior analytics (UEBA), SIEM, and/or any other specific technologies in their effort to keep your organization safe.

Also, use of MDR does not inherently eliminate your need for any in-house cybersecurity capabilities whatsoever. For example, your MDR provider may not offer vulnerability management like the identification and patching of common vulnerability and exposures (CVEs) as part of their service. You may also need a CISO or other cybersecurity leader to supervise your MDR, advocate internally for cybersecurity best practices such as multi-factor authentication and zero trust, implement a program for adversarial testing, work with your CFO to contract for appropriate cyber insurance coverage, etc.

EDR vs. XDR vs. MDR: Which One is Right for You?

No two organizations are precisely alike when it comes to cybersecurity. Your organization has its own unique infrastructure and its unique business risks. Healthcare organizations, for example, are more commonly targeted by ransomware attacks — and tend to have much larger threat surfaces per dollar of revenue — than industrial manufacturers. Large financial services firms, on the other hand, tend to have much higher cybersecurity budgets as a percentage of revenue than casual dining restaurant chains.

Your choice of EDR vs. XDR vs. MDR will thus depend on a lot of particulars, including:

Revenue and profitability
Size and complexity of your IT infrastructure
Types of data you work with (PII, PHI, digital IP, etc.)
Regulatory mandates and consequences for non-compliance in your industry
Projected rate of growth and ongoing digital transformation
Use of contractors and subcontractors
Ability to attract and retain skilled cybersecurity professionals
Ability to obtain cyber insurance
Institutional risk tolerance

Given these individual characteristics, the following chart offers useful generalized guidance about EDR vs. XDR vs. MDR.

	You probably should if you…	You probably shouldn’t if you…
EDR	Still depend on antivirus and/or antimalware alone for endpoint protection Have an acceptable ratio of SOC staff to IT environment size and complexity	Make extensive use of cloud in the form of SaaS, PaaS, or IaaS Don’t have the in-house staff necessary to perform threat hunting and remediation
XDR	Make extensive use of the cloud both as a platform (IaaS) and SaaS application (like O365) Face significant business risks from cybercrime Have substantial in-house cybersecurity skills	Don’t use any cloud or SaaS application Don’t face significant business risks from ransomware or data theft Don’t have the in-house staff necessary to perform threat hunting and remediation
MDR	Make extensive use of the cloud Face significant business risks from ransomware or data theft Don’t have the in-house staff necessary to perform threat hunting and remediation	Have sufficient in-house staff to perform threat hunting and remediation across your endpoints, network, and cloud/SaaS implementations

Here are some additional points you should consider when making any decision to go ahead with EDR, XDR, or MDR:

Threat intelligence matters. The effectiveness of any EDR, XDR, or MDR solution is highly contingent upon the breadth, depth, and freshness of threat intelligence it uses to detect potential markers of malicious activity. Your evaluation of any vendor’s solution should therefore include a rigorous assessment of that vendor’s threat intelligence.

The false positive problem. Cybersecurity success isn’t just about detecting any threat that might put your organization in jeopardy. It’s also about not generating a lot of false positives that waste time and — perhaps even worse — result in alert fatigue that inhibits your ability to respond to real attacks. Accuracy is thus as important as sensitivity.

Responsive personal service. Regardless of which course you choose, responsive service is a must for cybersecurity. After all, when an indication of an attack occurs, you’ll likely need some expert guidance. And you’ll need it immediately, because every minute counts when you’re trying to stop an active invader. So make sure you look into any prospective vendor’s service-level assurances. Protip: You may want to pass on any vendor that doesn’t offer live chat with expert cybersecurity support on-demand.

The bottom line. Don't assume one solution is more expensive than another. Costs can vary widely among EDR, XDR, and MDR solutions. Focus on your specific needs and consider your current staffing and existing investments, including potential tradeoffs between technologies and cost of in-house vs. outsourced resources. A simple cost analysis may challenge your assumptions.

One more key point: No decision is also a decision. Given how much is riding on your choice of EDR, XDR, or MDR, a natural tendency is to postpone taking action for another month or another quarter. It’s also prudent to not make a decision until you believe you’ve assembled enough information to make the right call.

What’s not prudent is to delay too long. Cybercriminals are acting now. Your organization is expanding its digital footprint now. Your employees, contractors, and supply-chain partners are all exposing you to new dangers now. So undue hesitation is not a viable risk-mitigation strategy.

You have to act decisively — and soon — to counter the relentless evolution of cyber criminality. That’s what cybersecurity leadership is ultimately all about.