MDR vs EDR in one sentence: EDR (endpoint detection and response) is software that records and blocks threats on each device, and MDR (managed detection and response) is that same software operated for you by a 24×7 security team that investigates and contains attacks. EDR costs $3 to $15 per endpoint per month and needs someone on your side to act on alerts. MDR costs $6 to $22 per device per month and comes with that someone, around the clock. If nobody in your company reads security alerts at 02:00 on a Sunday, you need MDR.
Updated October 6, 2026. Why the difference matters this year: the Sophos Active Adversary Report 2026 found that in 88 percent of ransomware cases the encryption was launched outside business hours, and attackers reached Active Directory a median of 3.4 hours after getting in. EDR will log every step of that. Only a person can stop it.
EDR vs MDR at a glance
| EDR | MDR | |
|---|---|---|
| What it is | Software agent on laptops, desktops and servers that detects, records and can block malicious behaviour | EDR or XDR operated by a 24×7 security team that investigates, hunts and responds |
| Who watches the alerts | You | The provider, 24 hours a day |
| What happens at 02:00 | An alert waits in a console until someone logs in | An analyst triages within minutes and isolates the device |
| Staff you need | A trained person with time every day, plus cover for nights and holidays | A contact for escalations |
| List price per device per month | $3 to $15 | $6 to $22 (ITSecOps: $8 to $16) |
| Best for | Under 50 endpoints with a named person who owns alerts | Everyone else, and any company under NIS2, CMMC, HIPAA, ISO 27001 or a cyber insurance questionnaire |
What MDR vs EDR costs at your size
| Devices | EDR per month | MDR per month | ITSecOps MDR per month |
|---|---|---|---|
| 25 | $75 to $375 | $150 to $550 | $200 to $400 |
| 50 | $150 to $750 | $300 to $1,100 | $400 to $800 |
| 100 | $300 to $1,500 | $600 to $2,200 | $800 to $1,600 |
| 250 | $750 to $3,750 | $1,500 to $5,500 | $2,000 to $4,000 |
The honest comparison is not EDR against MDR. It is MDR against EDR plus the salary of the people who would have to watch it. One seat covered 24×7 takes at least five analysts. See EDR pricing by vendor and MDR pricing by provider.
GET EDR AND MDR QUOTED SIDE BY SIDE
MDR vs EDR for small business: the rule
- Under 25 devices, low risk, no compliance: EDR built into Microsoft 365 Business Premium (Defender for Business) with a weekly review is a reasonable start.
- 25 to 50 devices: EDR only if a named person owns the alerts daily. Otherwise MDR.
- More than 50 devices, or any regulated data, or a cyber insurance policy: MDR. The extra $3 to $8 per device buys the night shift you do not have.
- You had an incident in the last 12 months: MDR, with active containment written into the contract.
When EDR alone is the right answer
If you already have a security team with 24×7 on-call cover, buying MDR duplicates them. Buy the best EDR for your platform and spend the difference on identity and email security. If your team covers the day but not the night, after-hours SOC cover fills exactly that gap.
Where XDR and SOC fit
XDR widens EDR to identity, email, cloud and network signals, and most MDR services in 2026 run on XDR telemetry; see MDR vs XDR and the full MDR vs EDR vs XDR guide. A managed SOC goes one step wider than MDR and covers every log source you have; see managed SOC pricing by company size.
Compare and price it: MDR vs XDR · EDR vs MDR vs XDR · MDR pricing and cost per device
Frequently asked questions
Is MDR better than EDR?
They are not rivals. EDR is the software, MDR is a team operating that software for you around the clock. MDR is the better purchase for any company that has nobody reading alerts at night and on weekends.
Does MDR include EDR?
Yes. Every MDR service runs on an EDR or XDR agent. Some providers bring their own, others manage the one you already have, such as Microsoft Defender for Business.
Can I add MDR to the EDR I already own?
Usually. ITSecOps runs MDR on Sophos, Microsoft Defender, SentinelOne and CrowdStrike, so you keep the licence you have and add the 24×7 team.
How much more does MDR cost than EDR?
Roughly double per device at list price: EDR is $3 to $15 per endpoint per month, MDR is $6 to $22 per device per month. For 50 devices that is $150 to $750 for EDR against $300 to $1,100 for MDR. ITSecOps MDR is $8 to $16 per device.
Is EDR enough for a small business?
Only if a named person reviews and acts on alerts every day, including weekends. Under about 50 endpoints with that person in place, EDR can be enough. Without that person, EDR is a recording of the attack.
What do cyber insurers ask for?
Applications increasingly ask whether endpoints have EDR and whether it is monitored 24×7. MDR answers both questions with yes.
GET A WRITTEN EDR OR MDR RECOMMENDATION
Written reply within 1 business day · No phone call unless you ask · Partner pricing on Sophos, Microsoft, SentinelOne and CrowdStrike