In this guide · 8 sections
Short answer
Antivirus blocks known threats. EDR adds behaviour detection, investigation and remote isolation. MDR is EDR plus a team that watches and responds to alerts 24/7. Most small firms should run EDR, with alerts going to someone who reads them; MDR suits firms holding sensitive data with no IT staff.
Antivirus vs EDR vs MDR at a glance
All three protect endpoints: laptops, desktops, servers and sometimes phones. They differ in how much they see and who does something about it.
Antivirus (next-generation AV)
Often free or bundled
- Blocks known malware and suspicious files
- Built into Windows as Microsoft Defender Antivirus
- Little history to investigate after an incident
- You respond to any warning yourself
Best for: Home use, or a one-person business with good backups.
EDR
Most SMEsFrom US$3/user/mo (Defender for Business)
- Antivirus plus behaviour monitoring
- Timeline of what happened on each device
- Isolate a device or undo changes remotely
- Someone must read and act on alerts
Best for: Small firms with client data, with an IT helper or provider on call.
MDR
Quoted per endpoint
- EDR plus a security team watching 24/7
- Team investigates and contains threats
- Monthly reporting
- Provider needs a CSRO licence in Singapore
Best for: Firms with sensitive data or uptime needs and no security staff.
Prices from Microsoft's Defender for Business page, checked October 2026, excluding GST. MDR prices are usually quoted after a scoping call.
What antivirus does, and where it stops
Modern antivirus, sometimes called next-generation protection, does more than match virus signatures. It uses cloud lookups and behaviour rules to block malicious files and scripts. Every Windows PC ships with Microsoft Defender Antivirus, which Microsoft describes as next-generation protection built into Windows.
The gap is what happens after something gets through. Many attacks on small businesses do not drop an obvious virus: an attacker signs in with a stolen password, uses built-in Windows tools, or runs a script that antivirus does not flag. Antivirus gives you little record of what happened, so you cannot tell which files were touched or where the attacker went next.
What EDR adds
EDR keeps recording activity on each device: processes started, network connections, file changes. It looks for patterns that match attacks, raises an alert, and gives you tools to respond. Microsoft's Defender for Business overview lists EDR, next-generation protection, automated investigation and vulnerability management, for businesses with up to 300 users.
- Detection of behaviour, not just files, such as a Word document launching PowerShell
- Investigation: a timeline of what ran, when and from where
- Isolation: cut a laptop off the network from the console while keeping it reachable for investigation
- Remediation: stop processes, quarantine files, and on some products roll back ransomware changes
- Device health signals that can feed sign-in rules in Microsoft 365
What MDR adds, and the Singapore licensing point
MDR is a service built on an EDR tool. A provider's security operations centre (SOC) watches your alerts around the clock, investigates them, and can isolate a device or kill a process on your behalf. Some MDR services bring their own EDR agent; others manage Microsoft Defender or another tool you already own.
In Singapore, managed SOC monitoring is one of the two cybersecurity services that need a licence from the Cybersecurity Services Regulation Office (CSRO). Before signing an MDR contract, check the provider on CSRO's list of licensed service providers. Our guide on CSA cybersecurity service licences explains what the licence covers.
Before you sign an MDR contract
Who responds to alerts: the question that decides
The best way to choose is to answer one question honestly: when an alert fires at 11pm on a Saturday, who sees it, and what do they do?
| Your situation | Sensible level | Who responds |
|---|---|---|
| 1 to 5 people, no client data on devices, good cloud backups | Antivirus or EDR | Owner or IT helper during business hours |
| 5 to 50 people, client or patient data, IT provider on call | EDR | IT provider during business hours; alerts by email or app |
| Regulated or high-risk data, no in-house IT, can't afford downtime | MDR | Licensed provider's SOC, 24/7 |
| Any size after a recent incident | EDR now, consider MDR | Incident responder first, then a monitoring plan |
Our Defender for Business vs antivirus guide goes deeper on the Microsoft option, and choosing an endpoint protection provider covers Bitdefender, ESET and SentinelOne.
What CSA Cyber Essentials needs
CSA's Cyber Essentials mark covers five measure areas: Assets, Secure/Protect, Update, Backup and Respond. Malware protection on devices falls under Secure/Protect, and having a way to detect and respond to incidents falls under Respond.
Cyber Essentials does not require you to buy MDR. Business-grade antivirus or EDR, installed on every device and kept up to date, plus an incident plan that says who acts on alerts, is the practical baseline. Our Cyber Essentials checklist lists every area.
Do it yourself or get help?
If you already pay for Microsoft 365 Business Premium (US$22 per user per month on Microsoft's page, October 2026), you already own Defender for Business with EDR. Many firms simply never onboard their devices. The set-up wizard in the Defender portal is a reasonable DIY job; test on one PC first.
If you want it set up for you, our Antivirus & Endpoint Protection Rollout (S$390) installs Defender for Business, Bitdefender, ESET or SentinelOne on up to 10 devices in your own account, with alerts going to your email. Protect Plus (S$35 per user per month, minimum 3 users) keeps protection, policies and Cyber Essentials evidence current. We do not provide 24/7 SOC monitoring, which needs a CSRO-licensed provider.
Frequently asked questions
EDR includes antivirus-style protection and adds behaviour monitoring, an activity timeline and remote response tools such as isolating a device. That makes it better at catching attacks that do not use an obvious malware file. It only helps if someone reads the alerts, so plan who responds before you buy.
Microsoft Defender Antivirus, built into Windows, is decent next-generation antivirus, but on its own it has no EDR and, without a tool such as Intune, no central view of all devices. For a business, Microsoft Defender for Business adds EDR, central management and vulnerability management for US$3 per user per month as of October 2026, and is included in Microsoft 365 Business Premium.
MDR is usually quoted per endpoint after a scoping call, and costs more than the EDR licence because it includes a 24/7 security team. Ask for a written quote covering the agent, monitoring, response actions and reporting. In Singapore, confirm the provider holds a CSRO licence for managed SOC monitoring.
No. Cyber Essentials expects malware protection on devices and a way to respond to incidents, but it does not require a managed 24/7 service. Business-grade antivirus or EDR on every device, kept up to date, plus an incident response plan naming who acts on alerts, is the usual baseline.
Yes, during agreed hours, as part of normal IT support. Round-the-clock monitoring sold as a managed SOC service is licensable in Singapore under the Cybersecurity Act, so a provider offering 24/7 SOC monitoring must hold a CSRO licence. Ask your provider which service they are actually offering.