EDR is the tool that detects and stops threats on your laptops and servers. SIEM is the system that collects and correlates logs from everything. MDR is a human team that runs detection-and-response for you, 24/7. Most small companies need EDR first, MDR second (because nobody's watching the EDR at 3 a.m.), and a full SIEM only when compliance or scale demands it.
These three get sold interchangeably, and the confusion is expensive — companies buy a SIEM they can't staff, or an EDR nobody watches, and believe they're covered. They solve different problems. Here's the plain-language version, and the honest answer to what you actually need at your size, from a team that runs monitoring and detection for small companies.
EDR — the sensor and the trigger on every device
Endpoint Detection and Response lives on your laptops and servers. It watches behavior — not just known-malware signatures like antivirus did — so it catches the ransomware precursor, the suspicious PowerShell, the credential-dumping tool, and can automatically isolate a machine mid-attack. It's the modern floor for endpoint security, and the difference between "we detected the intrusion on machine 3 of 40 and quarantined it" and finding out from the ransom note. What EDR doesn't do: see the things that never touch an endpoint — the login to your cloud console from Belarus, the mailbox forwarding rule an attacker set in Microsoft 365, the firewall change. It watches devices, not the whole world.
SIEM — the place where everything is correlated
Security Information and Event Management collects logs from everywhere — endpoints, servers, cloud, identity provider, email, network gear — into one place, and correlates across them. That cross-source view is its superpower: the login in one log plus the data download in another plus the config change in a third add up to an attack no single source would flag. It's also the evidence store when something happens ("what do the logs say") and often a compliance requirement. The catch, and it's a big one for small companies: a SIEM is a powerful engine that produces alerts, and alerts require humans to investigate. An unwatched SIEM is an expensive log bucket. This is where more SMBs waste money than anywhere else in security tooling.
MDR — the humans who actually watch
Managed Detection and Response is the answer to "who's watching this at 3 a.m." — a service where a security team operates the tooling (EDR, often a SIEM) on your behalf, investigates alerts, and responds around the clock. For a company without a 24/7 internal security team — which is essentially every company under a few hundred people — MDR is what turns tools into protection. The tool detects; MDR is the someone who sees the detection, decides it's real, and acts at 3 a.m. while you sleep. It's the layer small companies skip and then wish they hadn't, because the tools were blinking into an empty room.
Side by side
| EDR | SIEM | MDR | |
|---|---|---|---|
| What it is | Software on endpoints | Log collection + correlation platform | A human service (often running EDR/SIEM) |
| Sees | Laptop & server behavior | Everything that sends logs | Whatever it's given — plus expert judgment |
| Acts? | Auto-isolate, block | Alerts only — no action | Yes — investigates & responds 24/7 |
| Needs staffing | Light (someone watches alerts) | Heavy (analysts, tuning) | None — that's the point |
| SMB cost shape | Per-endpoint/mo | Platform + data volume + people | Per-endpoint or per-user/mo, all-in |
| Fails when | Nobody watches it | Nobody staffs it | Scope is too narrow (feed it enough) |
The decision, by company size
The two mistakes that waste the most money
Buying a SIEM you can't staff. It's the impressive-looking purchase — a real security platform! — but a SIEM without analysts is a very expensive place to store logs you'll only read after the incident. Small companies should get SIEM capability through an MDR provider, where the humans come attached, rather than licensing one to watch it themselves. Buying EDR and thinking you're done. EDR is necessary and not sufficient: it detects and can auto-isolate, but the ambiguous alerts — the ones that turn out to be the real breach — need a human to judge. If nobody's watching, the tool blinks red into an empty room. In our ransomware response work, the companies that caught it early had someone (internal or MDR) actually watching the endpoint alerts. The ones who didn't found out from the ransom note.
How this maps to what insurers and auditors ask
These acronyms aren't just architecture — they're on the forms. Cyber insurance applications now ask specifically about EDR deployment and, increasingly, managed detection; SOC 2 and other frameworks expect logging, monitoring, and a response capability. The practical read: EDR + MDR answers most of what a 2026 insurer or auditor wants from a small company far more cost-effectively than a self-run SIEM, because it delivers the detection-and-response outcome they're actually checking for. We cover the exact questionnaire language in our cyber insurance requirements guide.
How to actually buy this, without over-buying
The purchasing trap is treating these as three shopping trips. In practice, a small company should buy an outcome — "threats on our devices and accounts are detected and responded to, around the clock" — and let that dictate the components. For most companies under ~150 people, that outcome is best delivered as EDR plus MDR from one provider: the EDR is the sensor, the MDR is the humans watching it, and any SIEM-like log correlation you need comes bundled through the MDR's platform rather than as a separate license you'd have to staff. This is dramatically cheaper than the alternative small companies stumble into — buying a SIEM, discovering it needs analysts, and either hiring them or letting it rot. Ask a prospective provider three questions: what endpoints does the EDR cover and who watches its alerts at 3 a.m.; what non-endpoint sources (identity, cloud, email) do you ingest and correlate; and what's your response authority when something's confirmed — can you isolate a machine, or only email us? The answers tell you whether you're buying protection or just tooling. And map it back to the forms: the same EDR-plus-monitoring outcome is what your cyber-insurance questionnaire and most frameworks are really asking you to demonstrate.
A scenario: the 60-person company that bought backwards
A services firm around 60 people came to us after a scare. Their previous spend told the whole story: they'd licensed a well-known SIEM because a board member said they should "have a SIEM," paid for it for a year, and nobody had ever tuned it or watched it — it was ingesting logs into a void. Meanwhile half their laptops still ran legacy antivirus, not EDR, and nobody was watching anything at night. They'd spent real money and bought almost no protection, because they'd purchased a component instead of an outcome. The fix inverted it: EDR on every endpoint, an MDR service watching those alerts 24/7 with authority to isolate a machine, and the SIEM's useful log sources folded into the MDR's platform so the correlation happened where humans could act on it. Same budget order of magnitude, completely different result — because the question changed from "which product" to "who detects and responds, and when." That reframing is the single most useful thing a small company can take from this article.
Frequently asked questions
Is EDR just expensive antivirus?
No. Antivirus matches known-malware signatures; EDR watches behavior and can detect and respond to novel attacks — suspicious process chains, credential dumping, ransomware precursors — and isolate a machine automatically. The behavioral, response-capable part is the whole difference, and it's why insurers ask for EDR by name.
Do we need a SIEM for SOC 2 or HIPAA?
You need logging, monitoring, and the ability to investigate — which a SIEM provides, but which an MDR service also delivers, usually more cost-effectively for a small company. Frameworks care about the outcome (are events collected, watched, and actionable), not the product label. Get the capability; don't over-buy the platform.
Can't our IT provider just watch the EDR?
Ask precisely: do they monitor security alerts 24/7 with security analysts, or do they check a console during business hours? Those are very different products. General IT support watching an EDR dashboard between helpdesk tickets is not MDR — and attacks don't keep business hours.
What's the realistic first purchase for a 25-person company?
EDR on every endpoint, delivered with monitoring — either an MDR service or a security-capable provider watching it — after the free basics (MFA, tested backups, patching) are in place. That combination stops and catches the attacks that actually hit companies your size, without the cost of a SIEM you couldn't staff.
Where does a firewall or XDR fit in all this?
A firewall is network-perimeter control — complementary, not a substitute for endpoint detection. "XDR" (extended detection and response) is essentially EDR plus additional telemetry sources (network, cloud, email) correlated together — conceptually a step toward SIEM-like breadth, often delivered through an MDR. Don't get lost in the letters; anchor on the outcome: detect, decide, respond, 24/7.
Ask what to add next Our monitoring & detection
General guidance from our monitoring engagements; terminology (especially "XDR" and "MDR") varies by vendor — evaluate the actual service, not the acronym. Not vendor-specific advice.