# EDR vs Antivirus: What Your Cyber Insurance Form Is Really Asking URL: https://limehawk.io/reports/edr-vs-antivirus Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Antivirus matches files against known malware. EDR watches behavior, isolates an infected PC, and keeps a record. Insurers asking about EDR mean the second. > **TL;DR** Antivirus compares files against signatures of malware someone has already seen. EDR (endpoint detection and response) watches what programs actually do on each computer, can cut an infected machine off the network, and keeps a timeline you can investigate afterward. When a cyber insurance questionnaire asks "do you have EDR?", antivirus alone is not a yes. EDR also isn't magic. It only works if a person reads the alerts and acts on them, and it can stay quiet on signed software that's unwanted but not technically malicious. - OneStart PCs, EDR quiet: 30 ## What is EDR? EDR stands for endpoint detection and response. It's software on every computer and server (the "endpoints") that watches what programs do, flags behavior that looks like an attack, and lets someone respond from a console. That response can be killing a process or cutting the machine off the network. It also keeps a history of activity on each machine, so you can see what happened before and after an alert. The "R" is the part that matters. CISA's guidance on [isolating endpoints from the network](https://www.cisa.gov/eviction-strategies-tool/info-countermeasures/CM0065) assumes "endpoint management software or endpoint detection and response (EDR)" is in place, because that's how responders pull a compromised machine off the network fast. CISA's [#StopRansomware Guide](https://www.cisa.gov/sites/default/files/2025-03/StopRansomware-Guide%20508.pdf) recommends "application allowlisting and/or endpoint detection and response (EDR) solutions on all assets." ## What's the difference between EDR and antivirus? Traditional antivirus asks one question: does this file match something we already know is bad? EDR asks a different one: is this program doing something an attacker would do? Antivirus is a lookup against a list. EDR watches behavior, can isolate the machine, keeps a timeline, and sends alerts to a person. NIST defines a signature as "a set of characteristics of known malware instances." Its [malware guide, SP 800-83 Rev. 1](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf), puts the limit bluntly. When attackers can send a unique attack to each victim, "largely signature-based security controls, such as antivirus software, cannot keep up with them." Here's what EDR adds on top of that: - **Behavior detection.** A spreadsheet that launches PowerShell, a process encrypting hundreds of files a minute, a new account added to the admin group at 2 a.m. None of those need a known signature to look wrong. - **Isolation.** One click (or an automatic rule) cuts the machine off from the rest of the network. CISA's isolation guidance exists to stop exactly what happens next: the attacker talking to their own servers and moving to other machines. - **An investigation timeline.** What ran, what it spawned, what it touched, what it connected to. The #StopRansomware Guide tells responders to examine "antivirus, EDR, IDS" and logs to find "evidence of additional systems or malware involved in earlier stages of the attack." Without that history, you're guessing which other machines to check. - **A human reading alerts.** The same guide says tools should be "properly configured to escalate warnings and indicators to notify security personnel." A detection nobody reads is just a log entry. EDR doesn't have to replace antivirus. Plenty of setups run both, and ours does. ## Why does my cyber insurance questionnaire ask about EDR? Carriers ask because they want to know whether an attack on one laptop gets stopped there or becomes a claim for the whole company. Ransomware usually doesn't hit everything at once. It lands on one machine, spreads, then encrypts. EDR is the control built to spot the spreading and cut that first machine off. Wording varies by carrier and by policy, but EDR now sits on the usual list next to MFA, encryption, tested backups, and an inventory. Our [cyber insurance readiness page](/services/compliance-backup) walks through that list. The thing to watch for is the checkbox. "Do you have EDR on all endpoints?" is not the same question as "Do you have antivirus?" If what you run is a signature scanner, the honest answer to the EDR question is no. Your answers on the application are statements you're making to the carrier, so get them right before you sign, not after a claim. "All endpoints" matters too. That includes servers, the reception PC, and the laptop that lives in somebody's car. ## EDR vs MDR vs XDR: what's the difference? These are industry labels, not standards, and vendors stretch them. In plain terms: - **EDR** is the tool. Sensors on endpoints, a console, isolation, a timeline. - **MDR (managed detection and response)** is EDR plus people. A team watches the alerts, often around the clock, and takes action. - **XDR (extended detection and response)** pulls in signals beyond the endpoint, like email, sign-ins, cloud apps, and the network, so one alert can show the whole chain. For a firm of 10 or 40 people, the label matters less than two answers. Is the sensor on every machine? And who acts when it fires at 11 p.m. on a Saturday? An "XDR" nobody watches is worse than a plain EDR somebody does. ## Does EDR catch everything? No. It catches a lot of things antivirus misses, but it has blind spots, and software that's unwanted but not technically malicious is one of the big ones. We cleaned [the OneStart browser hijacker off 30 machines](/reports/onestart-malware-removal) for one organization. OneStart had landed on 30 machines, and the client's EDR stayed quiet. The binaries were signed and it shipped with a "legitimate" uninstaller, which is how it slipped past antivirus too. The users knew something was wrong because their homepage changed and popups started. What fixed it was a removal script in the right order, then blocking the domain at the DNS filter so the next install never reached the machine. Cleaning up isn't the end either. We've picked up a laptop that a scan had already declared "clean" and found [Windows itself still broken from the malware](/reports/windows-system-maintenance). Green scans don't mean a machine is healthy. So EDR is one layer. DNS and web filtering, patching, email filtering, and least-privilege accounts cover what it doesn't. ## What should I ask an IT provider about EDR? Ask questions that get you evidence, not reassurance. Here's the list I'd use: 1. **Is it on every endpoint?** Servers, laptops that leave the office, the shared front-desk PC. Ask for the device list showing which machines have the agent and when each last reported in. 2. **Who reads the alerts, and when?** Business hours only, or nights and weekends too? What happens to an alert at 2 a.m.? 3. **Who can isolate a machine, and how fast?** Is isolation automatic for high-confidence detections, or does it wait for a person? 4. **How far back does the history go?** If you find out about something three weeks late, can you still see what happened? 5. **Can users turn it off?** NIST's guidance on antivirus says users "should not be able to disable or delete" it. The same goes for EDR. 6. **What can you give me for the insurance form?** You want something you can attach, not a verbal yes. ## Key takeaways - Antivirus matches files against known malware signatures. EDR watches behavior, isolates machines, and records what happened. - If your insurance application asks about EDR, a plain antivirus product is not a yes. Answer it truthfully. - EDR without a person reading the alerts is just a quieter log. Ask who reads them, and when. - MDR is EDR plus people. XDR pulls in signals beyond the endpoint. Neither label has one official definition, so ask what's actually included. - EDR has blind spots. Signed adware landed on 30 machines in one of our cases without the EDR raising a hand. ## What this looks like when we do it On our [managed IT and security service](/services/managed-it-security), EDR is part of the baseline on every managed endpoint. It isn't a tier or an add-on. That means detection, isolation, and a human reading the alert, with 24/7 monitoring behind it. It runs next to anti-malware, email filtering, password management, and DNS and web filtering, because EDR alone leaves gaps, as the OneStart case showed. When your carrier sends the questionnaire, we map your environment to it and hand you the screenshots and dates it asks for, so the "EDR on all endpoints" box is something you can prove. We tell you plainly if a box isn't true yet, and we close the gap before you sign. Staring at an insurance form that asks about EDR and not sure what you have? Book a call and we'll go through it with you.