EDR vs MDR: What Each Is, What Each Costs, Which You Need

What is EDR?

EDR (endpoint detection and response) is software that records what happens on each laptop, desktop and server and responds when something looks like an attack, for example by isolating the device. The White House budget office’s memo M-22-01 describes EDR as real-time continuous monitoring of endpoint data combined with rules-based automated response and analysis. Examples include Microsoft Defender for Business, CrowdStrike Falcon Enterprise, ThreatDown Advanced EDR and SentinelOne Singularity.

What is MDR?

MDR (managed detection and response) is a 24/7 service in which an outside security team watches your EDR alerts, investigates them and contains real threats for you. Gartner defines MDR services as providing “remotely delivered security operations center (SOC) functions” for detection, investigation and response, usually on a predefined technology stack. Most MDR services run on EDR, either the provider’s own agent or one you already own.

How much do EDR and MDR cost?

MDR costs more than EDR per device: ThreatDown’s Elite MDR bundle costs $20 more per device per year than its Advanced EDR. The table converts each published price to a year per device (our arithmetic), sorted low to high; quote-only services come last.

Huntress calls its product Managed EDR, but Huntress says it pairs its agent with a “24/7 AI-centric, human-led SOC” that investigates and contains threats, so it works as an MDR service. ThreatDown’s Elite MDR price includes its EDR agent.

Monthly cost for 25 and 100 endpoints

Monthly bills at list price, our arithmetic before tax:

Huntress is channel-first: MSPs buy with no Huntress minimum, while resellers and direct buyers commit to 50 seats per product for 12 months. An MSP adds its own fee on top of MSRP. Full price lists: CrowdStrike Falcon bundles, SentinelOne Singularity packages and Huntress’s five managed products.

Which do you need: EDR or MDR?

Pick MDR if nobody on your team can act on an alert at 2 a.m.; pick EDR alone if someone can, every day. Three questions decide it:

1. Who answers a night or weekend alert? If the honest answer is “nobody”, buy MDR.
2. Does anyone triage alerts daily? EDR only helps when someone reads and acts on its alerts. If IT is one generalist, MDR or an MSP that runs EDR for you fills that gap.
3. What does your insurer ask? Coalition, a cyber insurer, tells brokers that clients should install “antivirus or EDR software on all user devices”; see what insurers check before they cover a small business.

For a handful of PCs with no sensitive data, small-business antivirus may be enough to start.

Can you use your own EDR with an MDR service?

Yes, many MDR services run on EDR you already own. Sophos says its MDR is “vendor-agnostic by design” and works with customers running Microsoft, CrowdStrike and SentinelOne, including Microsoft Defender for Endpoint and Defender for Business. ThreatDown runs its MDR on its own agent, and Huntress uses its own agent while running alongside Microsoft Defender Antivirus, which it says it manages at no extra cost.

Where XDR fits (EDR vs MDR vs XDR)

XDR (extended detection and response) is software, like EDR, that adds email, identity and cloud data to endpoint detections; MDR is still the service layer on top. SentinelOne’s cheapest package with XDR lists at $179.99 per endpoint per year, and its MDR is an add-on to the Commercial and Enterprise packages. You can buy EDR plus MDR, or XDR plus MDR; EDR vs XDR covers the software side.

MDR vs MSSP

An MSSP (managed security service provider) can run a wider set of security services than MDR, such as managed firewalls, SIEM log monitoring and vulnerability scanning, while MDR focuses on detecting and containing attacks. Many MSSPs sell MDR as one of those services; our comparison of 15 managed security providers lists which ones publish prices.