Contents
Short answer
Built-in protection in modern operating systems plus updates is the baseline for many small businesses. Endpoint protection bundles this centrally, EDR also detects suspicious behaviour, and MDR is a service where experts review those signals for you. Not every small business needs EDR or MDR.
Why does this matter for small businesses?
Laptops and phones are the most common entry point: via attachments, downloads or unpatched software. Small businesses rarely have someone watching alerts continuously – so what matters is which level of protection fits your IT dependency.
- Endpoint
- Detection
- Investigation
- Response
What does it include?
Built-in protection and antivirus
Detects known malware through signatures and behaviour. Included in current operating systems.
Basic
Endpoint protection
Protection for several devices with a central overview: which devices are protected, up to date and showing issues?
Basic
EDR (endpoint detection and response)
Records activity on devices, detects suspicious patterns – even without a known signature – and allows countermeasures such as isolating a device.
Relevant with higher risk
MDR (managed detection and response)
A provider monitors EDR signals, assesses alerts and responds by agreed rules – including nights and weekends.
Relevant with higher risk
What does it protect against?
- Known and some unknown malware
- Spread of an attack if a device is isolated early (EDR/MDR)
- Unnoticed anomalies, if someone actually reviews signals
What does it not protect against?
- Phishing where credentials are typed into a fake site
- Devices without updates or without protection installed
- EDR alerts nobody reads
Which basic measures are often enough?
- 01Keep built-in protection active on all devices
- 02Automatic updates for system and applications
- 03A central overview once several devices are in use
- 04No everyday work with admin rights
When does a more advanced solution make sense?
EDR makes sense when the business depends heavily on IT, processes sensitive data or downtime would be costly – and someone can review alerts. Without that capacity, MDR is the better fit. Contractual response times and authority then matter.
Common mistakes
- Buying EDR with nobody assessing the alerts
- Running two protection products at once
- Using unprotected personal devices for business data
- Assuming MDR replaces updates and backups
Checklist
- Every work device has active malware protection
- Updates run automatically
- It is clear who sees alerts and responds
- With EDR/MDR: response times and authority are agreed
Frequently asked questions
Do I need EDR as a freelancer?
Usually not. Built-in protection, updates, MFA and backups cover most risks.
How is EDR different from antivirus?
Antivirus mainly looks for known malware. EDR watches behaviour and helps investigate and contain an attack.
Does MDR replace an IT provider?
No. MDR focuses on detection and response. Operations, updates and backups remain separate tasks.
Sensible next step
Check that protection and automatic updates are active on every work device, and clarify who sees alerts.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- NIST Cybersecurity Framework
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.