In this guide · 8 sections
- 01Antivirus vs EDR vs MDR in plain English
- 02What CSA's Cyber Essentials expects
- 03Microsoft Defender for Business vs third-party products
- 04Questions to ask before choosing endpoint protection
- 05Who watches the alerts? The question most SMEs skip
- 06Licence counting and rollout tips
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
For 5 to 50 devices, pick a product with EDR and one cloud console covering Windows, Mac and mobile, decide who responds to alerts (you, an IT provider or an MDR service), and match licensing to your setup. If you already have Microsoft 365 Business Premium, Defender for Business is included.
Antivirus vs EDR vs MDR in plain English
These three terms describe layers, not competing products. Most business plans now bundle the first two.
| Layer | What it does | Who acts on it |
|---|---|---|
| Antivirus (EPP) | Scans and blocks known malware and suspicious behaviour on each device | Automatic |
| EDR (endpoint detection and response) | Records what happens on devices, flags attack patterns, lets an admin isolate a device or kill a process | An admin or IT provider who reviews alerts |
| MDR (managed detection and response) | A security team monitors your EDR alerts and responds, often around the clock | The MDR provider, under a contract |
Why EDR matters for a small business: many attacks now use legitimate tools and stolen passwords rather than obvious malware. Plain antivirus may not flag an attacker using remote access software on a finance PC; EDR can show the unusual activity and let someone cut that PC off the network.
What CSA's Cyber Essentials expects
CSA's Cyber Essentials mark is the Singapore baseline for SMEs. Under its Secure/Protect area it expects anti-malware protection installed and kept up to date on all devices, alongside secure configuration and access control. It does not require EDR or MDR, but a centrally managed product makes it far easier to prove every device is covered.
Our Cyber Essentials checklist lists the other requirements, such as updates, backups and incident response.
Microsoft Defender for Business vs third-party products
Microsoft's Defender for Business overview describes it as endpoint security for businesses with up to 300 users, built on Defender for Endpoint, with EDR, automated investigation and vulnerability management. Our Defender for Business vs antivirus guide covers it in depth.
Microsoft Defender for Business
US$3/user/mo annual; in Business Premium
- EDR included, managed in the Microsoft Defender portal
- Each user licence covers up to five devices
- Windows, Mac, iOS and Android
- Fits Intune and Microsoft 365 admin
Best for: Offices already on Microsoft 365, especially Business Premium.
Third-party business suites (ESET, Bitdefender and others)
Per device per year; quoted by vendor or reseller
- Own cloud console, independent of Microsoft 365
- EDR on higher tiers
- Often licensed per device, including servers
- Vendor MDR services available on some plans
Best for: Google Workspace offices, mixed environments or a preferred vendor.
Defender pricing is from Microsoft's Singapore product page, approximate, as of October 2026, before GST. Third-party vendors such as ESET and Bitdefender price by device count and tier, so get a written quote for your exact numbers. For engine quality, independent labs such as AV-Comparatives publish regular business test results.
Questions to ask before choosing endpoint protection
Use these with any vendor or IT provider. The answers matter more than brand names.
Endpoint protection buying checklist
Who watches the alerts? The question most SMEs skip
EDR produces alerts. If they go to an unread mailbox, you have paid for detection without response. Decide this before buying.
Handle alerts in-house if
- Someone technical checks the console daily
- You have under 10 devices and simple software
- You accept slower response outside office hours
- Automatic remediation covers most cases
Use an IT provider or MDR if
- Nobody on staff can judge a security alert
- You hold sensitive client, patient or financial data
- An attack overnight or at weekends would be costly
- Insurers or clients ask about monitoring
MDR is usually priced per device or user on top of the EDR licence. Several endpoint vendors, including ESET, sell MDR services, and some IT providers bundle monitoring into a monthly plan.
Licence counting and rollout tips
Licensing models catch people out. Microsoft licenses Defender for Business per user, with up to five devices each; many third-party products license per device, and servers often cost more.
List every device
Laptops, desktops, servers, Macs, company phones and tablets, with the person who uses each. Include devices at home used for work.
Choose the licence model
Per-user suits staff with several devices; per-device suits shared PCs and shift workers.
Remove the old antivirus first
Two active antivirus products conflict. Uninstall the old one cleanly, using the vendor's removal tool if needed.
Pilot on two or three devices
Check that business apps, printers and scanners still work before rolling out to everyone.
Turn on tamper protection and alerts
Make sure alerts go to someone who will act, and that users cannot switch protection off.
Check the console monthly
Look for devices that stopped reporting, failed updates and open alerts. Remove leavers' devices.
Staff using personal phones for work email need a separate decision; our BYOD and MDM guide covers it.
Do it yourself or get help?
For a small office on Microsoft 365 Business Premium, turning on Defender for Business through the setup wizard is a realistic DIY job. The harder parts are clean removal of old products, Mac and phone onboarding, and making sure someone acts on alerts.
Our Antivirus & Endpoint Protection Rollout (S$390) sets up Defender for Business, Bitdefender or ESET in your own account on up to 10 devices with alerts configured. For ongoing monitoring and updates, Protect Standard (S$19 per user per month) keeps devices checked month to month.
Frequently asked questions
The built-in antivirus engine is good, but on its own it is managed one PC at a time, with no central view, alerts or response tools. For a business, add central management, either through Microsoft Defender for Business, which uses the same engine with EDR, or through a third-party business product with a cloud console.
Many attacks now use stolen passwords and legitimate tools that plain antivirus may not flag. EDR records device activity and lets you isolate a compromised device. For businesses holding customer or financial data, EDR is worth having, provided someone reviews its alerts. Many business plans now include EDR at no extra tier.
Microsoft Defender for Business is listed at US$3 per user per month on an annual plan as of October 2026, before GST, and is included in Microsoft 365 Business Premium. Third-party vendors such as ESET and Bitdefender price per device per year by tier and quantity, so ask for a written quote for your device count.
Managed detection and response is a service where a security team monitors your EDR alerts and responds for you, often around the clock. It suits businesses with no technical staff, sensitive data or clients and insurers asking about monitoring. It costs extra per device or user, on top of the EDR licence.
Only one should be active. Two active antivirus products can conflict, slow devices down and block each other. When a third-party product is installed, Windows normally puts Defender Antivirus into a passive or disabled state. Remove the old product cleanly before rolling out a new one.